DeVernon Psychotherapy Website Privacy and Cookie Policy

Who we are

This privacy notice explains how Karen Vernon, trading as DeVernon Psychotherapy collects and uses your personal data when you use our website, https://devernonpsychotherapy.co.uk, or get in touch with us via contacting the practice. It covers website enquiries, initial booking enquiries, testimonials and website marketing.

Karen Vernon is the data controller for DeVernon Psychotherapy and is responsible for your personal data (referred to as “we”, “us” or “our” in this notice). DeVernon Psychotherapy is run by Karen Vernon, trading as DeVernon Psychotherapy.

Contact details

Business name	Karen Vernon trading as DeVernon Psychotherapy
Address	10 Crosby Rd, Birkdale, Southport, PR8 4SU
Email	admin@devernonpsychotherapy.co.uk
Phone	07947 706565
Information Commission registration number	ZB806611 – registered organisation: Karen Vernon

[By providing us with your data, you confirm that you are over 13 years of age.]

Please let us know if your personal information changes by emailing admin@devernonpsychotherapy.co.uk, so that the information we hold stays accurate and up to date.

This policy covers our website and enquiries. This notice covers the website and initial enquiries. Clinical assessment, therapy records, treatment communications and related clinical administration are covered by the client privacy information supplied with your therapy agreement. Please contact us if you would like a copy before deciding whether to proceed.

If you become a client, how we use and look after your information, including your therapy records, is explained in our [client privacy notice / therapy agreement].

What data we collect and why

Personal data means any information that can identify you. It does not include anonymised data. We may process the following:

Type of data	What it includes	Why we use it	Lawful basis
Enquiry and communication data	Your name, email, phone number and anything you tell us through our contact form, email, phone, text or social media	To reply to you, arrange an initial conversation, and keep a record of our contact	Taking steps at your request before entering into a contract with us. For enquiries not about therapy, our legitimate interests in replying to you
Technical data	IP address, browser and device details, pages visited and time on site, Google Analytics	To keep the website working and secure, and to understand how it is used	Our legitimate interests in running and improving our website
Marketing data	Contact details, subscription preferences and evidence of permission	To send optional updates you requested and honour withdrawal	Consent; limited suppression records as needed to respect your preferences
Testimonials and approved photographs	Approved words, chosen attribution, any separately approved photo and the permission record	To publish feedback on the specific channels you agreed	Article 6 consent and Article 9 explicit consent where health information is revealed
Initial booking data	Contact details, appointment choice and necessary enquiry information	To arrange a requested consultation through the linked booking system	Steps at your request before a contract / performance of a contract; health information as described below

Health information

When you contact us, you may choose to tell us about your mental or physical health. This is special category data and we handle it with extra care. We use it only to respond to your enquiry and to assess whether our services are right for you.

For enquiries about arranging therapy, our Article 6 lawful basis is taking steps at your request before entering into a contract. Where necessary to assess suitability or provide healthcare, we process health information under Article 9(2)(h) of the UK GDPR and the applicable Data Protection Act 2018 health-care condition, subject to professional confidentiality. Other purposes, including publication of a testimonial, require their own appropriate lawful basis and special-category condition.

Please provide only information needed for your enquiry. Your message may include other sensitive information, such as beliefs, sexuality or information about an alleged offence. We do not routinely request this for a website enquiry. If received, we restrict its use and access and assess the relevant legal conditions before retaining or sharing it.

Testimonials and reviews

We sometimes share testimonials from people who have worked with us. Because a testimonial can show that someone has had therapy, we treat it as health information and only publish one with your explicit written consent.

We only publish words you have seen and approved, and we won’t change their meaning.
You choose how you are named, such as your first name, your initials or no name at all.
We remove details that could identify you, such as your job, family or where you live, unless you tell us you are happy for them to stay.
We publish a photograph alongside a testimonial only where you have separately and explicitly agreed to the particular photograph, identification and publication channels. Permission to publish words does not automatically include permission to publish an image.
We do not offer discounts or rewards in return for testimonials.

Giving a testimonial is your choice. Saying no, or changing your mind later, will not affect any therapy or support you receive from us.

You can withdraw your consent at any time by emailing admin@devernonpsychotherapy.co.uk. We will stop new use and remove material from channels we control without undue delay. We will explain any practical limits, including printed materials already distributed and copies or shares controlled by others. Withdrawal does not make earlier use unlawful where it was based on valid consent.

Our lawful basis is your consent, and the condition for processing health information is your explicit consent (UK GDPR Article 9(2)(a)).

If you leave a review on Google, Facebook, Trustpilot or another independent platform, that platform processes the review under its own terms and privacy information. Our replies will not disclose or confirm a therapy relationship. Before selecting and republishing an identifiable therapy review or photograph in our own marketing, we obtain appropriate explicit permission.

If a third-party review widget appears on our website, its technical data collection and cookie behaviour are described in the cookie information. You may contact us directly about a review displayed on our website; we will not require you to delete your original public review as the only way to request removal from our own channels.

Other points

If you do not give us information we need to provide our services, we may not be able to work with you. We will tell you if this is the case.
We will only use your data for the purpose we collected it for, or a compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the lawful basis.
We do not use enquiry or clinical information to make solely automated decisions that have legal or similarly significant effects on you. We do not use health information to create advertising audiences.

How we collect your data

Most of the data we hold comes directly from you, for example when you fill in our contact form, email us or phone us. We also collect some technical data automatically when you use our website, using cookies and similar technologies. See the Cookies section below for details.

We may receive technical data from our analytics provider.

Marketing

We send optional news or promotional emails only where you have opted in. Enquiring about therapy, booking an appointment or giving a testimonial does not automatically subscribe you. You can unsubscribe using an available unsubscribe link or by emailing admin@devernonpsychotherapy.co.uk. Administrative replies about your enquiry or appointment are separate from marketing.

We will never share your personal data with other organisations for their own marketing.

Who we share your data with

We only share your data where we need to, and only with:

Website platform, hosting and security suppliers, for operating and protecting the website.
Email and communications providers, for receiving and responding to enquiries.
Our website designer or developer, where authorised access is necessary for maintenance and support.
Booking and practice-management providers, including WriteUpp / Select and Book for the linked online booking service. Clinical records held in practice-management systems are addressed in the client privacy information.
Payment providers where needed for a booking or service transaction. Please use the provider’s secure payment process rather than sending card details through our enquiry form.
Email marketing and analytics suppliers, only where these services are enabled and subject to the applicable permissions described in this notice.
Third-party review, video or other embedded-content providers where those features are enabled, subject to their role and the applicable cookie choices.
Suppliers may act as processors on our instructions or as independent controllers for particular functions. We use appropriate contractual arrangements and assess their role rather than assuming every supplier is a processor.
our professional advisers and insurers, where needed
regulators, courts or other authorities, where the law requires it

We may share necessary, proportionate information where the law permits or requires it, including to address a serious safeguarding concern or protect life. We identify an appropriate Article 6 lawful basis and, where health or other sensitive information is involved, the additional legal condition that applies. We document the reason and limit the information shared.

We limit access to what is necessary. Processors working on our instructions must protect the information under appropriate data-processing terms. Independent controllers have their own legal responsibilities and privacy information.

International transfers

Some suppliers may store data or permit access outside the UK. Where a restricted international transfer occurs, we identify and apply the relevant protection, as appropriate to the provider, destination and processing:

the country has been approved by the UK Government as providing adequate protection;
for an eligible US recipient, a current certification covering the relevant processing under the UK Extension to the EU–US Data Privacy Framework; or
appropriate UK transfer safeguards, such as an International Data Transfer Agreement or UK Addendum, together with the required assessment and any supplementary measures. You can contact us for information about safeguards relevant to your data.

Keeping your data secure

We have security measures in place to stop your personal data being lost, used, changed or accessed without permission. Only people who need your data to do their job can access it, and they must keep it confidential.

We have procedures for suspected personal-data breaches. We notify affected individuals and the Information Commissioner’s Office (ICO) where the law requires us to.

How long we keep your data

We keep personal data only for as long as we need it for the purposes we collected it for, including any legal, accounting or reporting requirements.

When you contact us through our website, duplicate contact-form submissions stored within the website will be deleted after six calendar months from submission. Enquiry correspondence held separately will normally be deleted six months after the enquiry closes if it does not lead to a client relationship. We first preserve any information needed for an active enquiry, agreed waiting list, therapy record, safeguarding matter, complaint or legal obligation under the appropriate retention schedule. Deleting a website copy does not delete a necessary clinical record. Backups must be dealt with through a documented secure expiry process.

We retain an approved testimonial and its permission record while it is in use, and review whether continued publication remains appropriate. After withdrawal or removal, we retain only the minimum evidence needed to demonstrate permissions and handle relevant complaints or claims, under a documented, justified retention period. We do not retain unused photographs indefinitely.

The retention of assessment, therapy, financial and other clinical-administration records is explained in the client privacy information. Marketing contact information is retained while permission remains current; a minimal suppression record may be retained to respect an unsubscribe request.

When deciding how long to keep data, we consider how much there is, how sensitive it is, the risk of harm if it were misused, and our legal obligations.

Your rights

Under data protection law, you have the right to:

access the personal data we hold about you
have inaccurate data corrected
have your data erased
restrict how we use your data
object to how we use your data
data portability (receive your data in a usable format, or have it sent to someone else)
withdraw your consent at any time, where we rely on consent
complain to us and to the Information Commissioner’s Office (ICO). These rights are subject to the conditions and exemptions in the law.

You can read more about these rights on the Information Commission website - https://ico.org.uk. To exercise a right, contact admin@devernonpsychotherapy.co.uk.

There is usually no fee. We may charge a reasonable fee, or refuse the request, if it is clearly unfounded, repetitive or excessive.

We may ask you to confirm your identity before we respond, so that your data is not given to anyone who has no right to it. We may also ask for more information to help us find what you need.

How quickly we respond

We respond without undue delay and normally within one month. Where the law allows a longer period, or requires verification of identity or necessary clarification, we explain what we need and how this affects the applicable deadline. An extension for complexity or multiple requests can be up to a further two months, with an explanation within the required period.

How to complain

If you are unhappy with our handling of your personal data, email admin@devernonpsychotherapy.co.uk with the subject “Data protection complaint”, or write to the correspondence address above. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and communicate the outcome.

You can also raise a concern with the Information Commissioner’s Office (ICO), the UK data protection regulator, at https://ico.org.uk/make-a-complaint/. You do not have to wait for our permission to contact the regulator.

Cookies

Cookies and similar technologies store or access information on your device. The website’s actual tools, providers, purposes and durations must be confirmed before this section is published. The following categories describe the proposed consent approach; they do not confirm that every category is installed.

Cookie or tool	What it does	Do we ask first?
Essential website and security tools — exact names to confirm	Provide necessary functionality, proportionate security and form delivery	No, only where strictly necessary for the service you request
Cookie preference tool — name to confirm	Records and honours your cookie choices	No, where needed to remember those choices
Analytics — e.g. Google	Measures website use; document purpose, configuration and duration	Prior consent.

You can change or withdraw optional permissions through the website’s cookie controls using the cookie settings link at the bottom of each page or set your browser to refuse cookies. Refusing optional technologies should not prevent you from making a basic therapy enquiry.

Links to other websites

Our website may link to other websites, plug-ins and apps. Clicking those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy notices, so please read the privacy notice of each site you visit.

Changes to this notice

We review this notice regularly and will post any changes on this page.

Last updated for publication: 21^st October 2026.