Privacy Statement
Last updated: 24th July 2026
I understand how important your privacy is. I take care to maintain your confidentiality in accordance with current data protection laws (GDPR, 2018) and the ethical guidelines of the British Association for Behavioural & Cognitive Psychotherapies (BABCP). These guidelines are designed to protect your confidential material and ensure that I always conduct myself with professionalism and integrity.
Data Controller: Menah Raven-Ellison, trading as Bonhay Therapy
Contact: menah@bonhaytherapy.com
ICO registration: ZB591433
In order to provide you with the best service possible, I hold your personal contact details and records of your therapy sessions. Below is important information about how this information is held and used.
Your personal information
At the point of booking your initial consultation with me, you'll be asked for personal contact information - for example, your name, address, email address and telephone number - and you may also choose to share details of the issues you're looking for help with.
Your contact information is stored securely on an encrypted laptop and can only be accessed by me.
In order to fulfil my duty of care to you, at your initial consultation or first treatment session I will ask for contact information for your GP and an elected emergency contact person. These details are stored securely and are only accessible to me.
This personal information will be held for the duration of your therapy, after which it will be deleted.
Please note that I keep a record of your name and client reference number for seven years after the end of your therapy, so that I can respond effectively to any future requests regarding your notes and treatment.
I will never pass on your contact details to any third party organisations for sales, marketing or research purposes, and will never use your personal data for any purpose other than administering the therapy service I'm providing to you - i.e. to arrange, cancel and rearrange appointments, and to collect payment for sessions.
Your therapy sessions
Everything you discuss with me is confidential. Confidentiality will only be broken if there is concern about your safety or the safety of someone else, or if I am instructed to do so by a Court of Law. I will always endeavour to speak to you about this first.
When working remotely, I ensure that I conduct online and telephone sessions in a quiet, private and confidential setting. I use the Zoom video calling platform, which offers end-to-end encryption to help ensure your privacy. Please note, however, that I cannot be held responsible for any breaches that occur due to failures in this technology.
I discuss my clinical work with a supervisor, to ensure I'm offering you the best service possible. These conversations are bound by confidentiality, and you will only ever be referred to by your first name.
I keep notes of each session. These are anonymised and stored in a locked filing cabinet and within a password-protected file on my laptop. These notes are for my use only, and help me keep track of what's being discussed. In line with BABCP guidelines, notes are kept securely for up to seven years after your therapy ends, after which they are confidentially destroyed.
If your sessions are paid for or arranged via a third party (e.g. your employer, a friend, or a family member), your therapy information will not be shared with them beyond payment requests, invoices or receipts. What's discussed in your sessions remains confidential between us. Any other information can only be shared with your written consent.
Your communications with me
My email account is password protected, and only I have access to it.
All phones, tablets and laptops used to respond to your emails are encrypted, protected with anti-virus software, and password protected.
Mailing list
If you choose to sign up to my mailing list, I will collect your email address and name in order to send you occasional updates and insights related to perimenopause and wellbeing. This is entirely separate from the data I hold for therapy administration, and is based on your specific consent to receive these communications.
I use MailerLite to manage this mailing list. You can unsubscribe at any time using the link included in every email, or by contacting me directly. Signing up to the mailing list, or unsubscribing from it, has no effect on any therapy services you receive from me.
About this website
This website is hosted by Squarespace. Squarespace collects personal data when you visit this website, including:
Information about your browser, network and device
Web pages you visited prior to coming to this website
Web pages you view while on this website
Your IP address
Squarespace needs this data to run the website, and to protect and improve its platform and services. Squarespace analyses the data in de-personalised form.
Analytics
This website collects personal data to power site analytics, including information about your browser, network and device, your IP address, and details of your use of the site (clicks, internal links, pages visited, scrolling, searches and timestamps).
I share this information with Squarespace, my website analytics provider, to understand site traffic and activity.
Cookies
This website uses cookies and similar technologies - small files or pieces of text that download to your device when you access the website.
Functional and required cookies, which allow Squarespace to securely serve this website to you, are always in use. Analytics and performance cookies are only used once you acknowledge the cookie banner.
For more information about the cookies used on this site, visit Squarespace's own cookie information page.
Webform submissions
When you submit information to this website via a webform (for example, to book a consultation or get in touch), I collect the data you provide in order to track and respond to your submission. This information is processed through Squarespace, my website provider, so that they can deliver website services to me.
Data usage
I will only use your email address and telephone number to contact you about your appointments, or to share information pertinent to your therapeutic process.
Your phone number may also be used to issue appointment reminders via text message. You can opt in or out of text updates at any time.
Your rights
Any personal data I hold is retained in accordance with the GDPR (2018). Under these guidelines, you have the following rights:
The right to request access to your data. You can request to view the information I hold about you (contact details, appointment logs, etc.) at any time. If, during therapy, you'd like to see your session notes, please let me know. Should you need a copy of your notes after your therapy has ended, you can request this by emailing or calling me.
The right of rectification. At any point during your time using my service, or during the seven years afterwards while I retain your records, you have the right to request amendments to your contact details or session notes. You can exercise this right by speaking to me directly or contacting me in writing.
The right to be forgotten. You can request that I delete and confidentially destroy the information I hold about you and your sessions at any time, by contacting me.
There are some circumstances in which I would not be able to comply with such a request:
a) Where it's necessary for me to retain records to continue providing an effective service b) Where I'm compelled to retain records by a Court of Law c) Where I require records to establish, exercise or defend legal claims
Consent
When you book your first session with me, you'll be given a therapy contract and asked to provide a digital signature confirming your consent to the storage and processing of your personal data for the purposes of providing therapeutic services.
You're entitled to withdraw this consent at any time by emailing me at menah@bonhaytherapy.com.
Breaches of data protection
In the event of any breach of my data protection policies, I will notify you and the Information Commissioner's Office (ICO) within 72 hours, and will seek to rectify the breach immediately.
Raising concerns
Should you have any concerns about my data protection practices, you're welcome to raise these with me directly, or to notify the Information Commissioner's Office. I am registered with the ICO under reference number ZB591433.
If your concern relates to my professional conduct more broadly, rather than specifically to data protection, you can also contact the British Association for Behavioural & Cognitive Psychotherapies (BABCP), my professional accrediting body.