Privacy Policy
1. Who I am and what this policy covers
This policy explains how I collect, use and protect your personal information, and what rights you have. I take privacy seriously: much of my work depends on confidentiality.
I am Daniel Gilsenan, a psychodynamic psychotherapist, executive coach, and addiction and recovery specialist, working in private practice in London. For data protection purposes, I am the data controller for the information described here. I am registered with the Information Commissioner's Office (ICO), registration number ZC011634.
This policy covers:
people who contact me or visit danielgilsenan.com
people I see for psychotherapy, coaching or addiction and recovery work
people who register for or attend my webinars, workshops and events
people I supervise, and professional contacts
I process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: enquiries@gilsenan.com
2. What I collect, why, and on what legal basis
I collect only what I need. The law requires me to have a lawful basis for each use. Information about your health, including mental health and addiction, is "special category" data, which needs an additional condition.
If you get in touch with me, I collect your name, contact details and whatever you tell me about why you're getting in touch. I use this to reply and to arrange an initial conversation. My lawful basis is taking steps at your request before we agree to work together, and my legitimate interest in responding to enquiries. Any health information you share is covered in section 3.
If you are a client, I collect your contact details, your GP's details, an emergency contact, the dates of our sessions, brief clinical notes, and invoicing and payment records. I use these to provide therapy or coaching, to keep appropriate records, and to invoice you. My lawful basis is our contract, and my legal obligation to keep financial records. Health information is covered in section 3.
If you register for or attend an event, I collect your name, your email address, any optional details you choose to give, and whether you attended. I use these to run the event, send you joining details, and follow up with the materials. My lawful basis is my legitimate interest in running the event, and your consent if you choose to join a mailing list.
If I supervise you, I collect your contact details, the dates of our sessions, brief notes and invoicing records, so that I can provide supervision. My lawful basis is our contract and my legitimate interests.
If you are a professional contact, I hold your name, contact and work details to maintain our professional relationship and for referrals. My lawful basis is my legitimate interests.
If you visit my website, see section 6 on cookies. My lawful basis is my legitimate interest in running the website, and your consent for any non-essential cookies.
Where I rely on legitimate interests, I have considered whether my interests are outweighed by your rights, and you can object at any time (section 6).
I do not sell your data, and I do not use it for automated decision-making or profiling.
3. Clients: confidentiality and clinical records
Health information. When you see me for psychotherapy or addiction and recovery work, I will hold information about your health. I process it under Article 9(2)(h) UK GDPR (health or social care) and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. As a registered psychotherapist I am bound by a professional duty of confidentiality, and by the ethical frameworks of the British Psychoanalytic Council (BPC) and the British Association for Counselling and Psychotherapy (BACP).
What I record. I keep brief notes: session dates, key themes, and anything relevant to your care or safety. I do not record sessions.
Coaching. Coaching records are kept separately from therapy records and contain only what is needed for the work. If health matters come up in coaching, I treat them with the same confidentiality.
Supervision. As my professional bodies require, I discuss my work with a clinical supervisor. I do this without identifying you, and my supervisor is also bound by confidentiality.
Limits of confidentiality. What you tell me stays between us, except in rare circumstances where I may need to share information without your consent:
where I believe there is a serious risk of harm to you or to someone else
where there is a safeguarding concern about a child or an adult at risk
where the law requires it, for example a court order, or information relating to terrorism or money laundering
Where it is safe and appropriate, I will talk to you first.
Corporate-arranged work. If your coaching or therapy is arranged or paid for by an employer or agency, I share only what we have agreed in advance, usually attendance and invoicing. I do not share the content of our sessions.
Professional will. If I become unable to practise, a nominated fellow clinician will have access to your contact details only, so they can let you know and help arrange continuing support.
4. Webinars, events and enquiries
Registering for an event. When you register for one of my webinars or workshops, I collect your name and email address, and any optional details you choose to give. Online events run on Microsoft Teams, which records who registered and who attended.
I use this information only to:
send your confirmation, joining link and reminders
send a follow-up email with the session materials and sources of support
understand attendance, so I can improve future events
What I don't do. My webinars are not recorded or transcribed. I don't share registration or attendance lists with anyone. I don't add you to a mailing list unless you have actively opted in, and you can unsubscribe at any time.
Questions and polls. Where I use anonymous Q&A or polls, your answers are not linked to your name in what I can see.
Sensitive topics. Some events deal with sensitive subjects such as addiction. Registering for an event tells me nothing about you, and I make no assumptions about why anyone attends. I keep registration lists securely and delete them after the period set out in section 5.
Enquiries. If you contact me by email, phone or through the website, I use what you tell me only to reply and, if you wish, to arrange an initial conversation. If we don't go on to work together, I delete your enquiry after the period set out in section 5.
5. Sharing, transfers, retention and security
Who I share data with. I use a small number of trusted service providers, who act on my instructions and must keep your data secure:
I use Microsoft 365 (Outlook, Teams and OneDrive) for email, video sessions, webinars and secure file storage. I use Zoho Books for invoicing and accounts. My website, danielgilsenan.com, and its contact form are hosted by Squarespace. My accountant sees my financial records only, to prepare my accounts and tax returns.
I may also share information with my professional bodies or insurers if there is a complaint or claim, with my nominated clinician under my professional will, or where the law requires it (section 3). Otherwise, I share nothing without your consent.
International transfers. Some providers may store or process data outside the UK. Where they do, I rely on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.
How long I keep data.
I keep clinical and coaching records for seven years after our work ends, and supervision records for seven years after supervision ends. I keep invoicing and financial records for six years after the end of the relevant tax year. If you get in touch but we don't go on to work together, I keep your enquiry for six months. I keep event registration and attendance data for three months after the event. If you join my mailing list, I keep your details until you unsubscribe.
After these periods, I delete or securely destroy the data.
Security. I keep records on password-protected, encrypted devices and accounts, with multi-factor authentication. Any paper notes are kept in a locked cabinet. Only I have access to clinical records.
6. Your rights, cookies and complaints
Your rights. Under UK data protection law, you have the right to:
ask for a copy of the personal data I hold about you
ask me to correct anything inaccurate or incomplete
ask me to delete your data, where I have no legal or professional reason to keep it
ask me to restrict how I use your data
object to my using your data on the basis of legitimate interests, including for any marketing
ask for your data in a portable format, where this applies
withdraw consent at any time, where I rely on consent
To use any of these rights, email me at enquiries@gilsenan.com. I will respond within one month. There is normally no charge. Some rights are limited: for example, I may need to keep clinical or financial records for the periods in section 5.
Cookies. danielgilsenan.com uses cookies that are needed for the site to work. With your consent, it also uses analytics cookies from Squarespace to understand how the site is used; these collect information such as pages visited and general location, not your name. You can accept or decline them in the cookie banner, and change your choice at any time. I do not use advertising cookies.
Complaints. If you are unhappy with how I have handled your data, please contact me first and I will try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this policy. I will update this policy when my practice or the law changes. The date below shows when it was last updated.
Last updated: 1 November 2026