- Data controller
- Peter Cartwright trading as ThoughtShift Therapy
- Website
- thoughtshifttherapy.co.uk
- Business correspondence address
- 6 Strathearn Way, Kilmaurs, KA3 2DS
- ICO registration number
- CSN3863899
- Effective date
- 2 September 2026
This notice explains what personal information ThoughtShift Therapy collects, why it is used, how it is protected and shared, how long it is kept, and the rights available to you. It applies when you visit the website, make an enquiry, use Microsoft Bookings, communicate with the practice or receive therapy.
1. Who is responsible for your information?
Peter Cartwright, trading as ThoughtShift Therapy, is the data controller for the personal information described in this notice. This means ThoughtShift Therapy decides why and how that information is used.
ThoughtShift Therapy is an independent private practice. It is separate from NHS Scotland. Information collected through the private practice is not an NHS record and will not be placed in an NHS system merely because the therapist also has separate NHS employment.
No Data Protection Officer is currently appointed. Privacy questions and requests should be sent to Peter Cartwright using the contact details in section 16. The need for a Data Protection Officer will be reviewed if the scale or nature of the practice changes.
2. Information we may collect
The information collected will depend on your contact with the practice and what is necessary for safe, appropriate care. It may include:
- Identity and contact information, such as your name, date of birth, address, email address, telephone number, preferred contact method and pronouns.
- Booking and administration information, including appointment dates, attendance, cancellation or rescheduling information, Microsoft Bookings responses and relevant correspondence.
- Payment and transaction information, including fees, invoices, payment status and refunds. An invoice will be sent to you once an appointment has been booked. Payment must be made within 24 hours of booking an appointment. If payment is not received then the appointment will be cancelled.
- Referral and support information, such as GP details, emergency contacts, parent or carer details, the source of a referral, and information from another professional where appropriate and lawful.
- Health and clinical information, including presenting difficulties, relevant personal and medical history, medication, assessment information, CBT formulations, goals, session notes, outcome measures, risk and safeguarding information, agreed plans and clinical correspondence.
- Information about neurodevelopmental differences, disability, race or ethnicity, religion or belief, sex life or sexual orientation where you choose to share it and it is relevant to your care. These are special categories of personal data and receive additional legal protection.
- Complaints, feedback, insurance or legal information where needed to respond to a concern, meet professional obligations or establish, exercise or defend a legal claim.
- Technical information needed to operate and protect the website, such as IP address, browser/device information, security logs and essential cookies that may be processed by the hosting provider.
Website enquiry form
The website enquiry form currently prepares a message in your own email application. The website does not itself submit the form into a separate ThoughtShift Therapy database. Your name, email address, optional telephone number, enquiry type, preferred reply method and message are sent only when you review the prepared email and choose to send it. Please do not include detailed medical or urgent-risk information in an ordinary email.
Website cookies and analytics
At the date of this draft, ThoughtShift Therapy does not intentionally use non-essential advertising or marketing cookies. The website host may still process essential technical information to deliver and secure the site.
3. How we obtain information
Most information is obtained directly from you, including during an enquiry, booking, consultation or therapy session. Information may also come from a parent or carer, a referrer, a GP or another professional where you have agreed, where the person has appropriate authority, or where another lawful basis permits the disclosure. Administrative and technical information may be generated by Microsoft 365, the website host, email systems, Facebook or a future payment provider when you use those services.
4. Why we use information and our lawful bases
UK data-protection law requires a lawful basis for using personal data and an additional condition for health information and other special-category data. The principal bases expected to apply are set out below. The precise basis may depend on the circumstances, and ThoughtShift Therapy should maintain an internal record of processing activities that confirms these choices.
| What we use information for | UK GDPR Article 6 basis | Health and other special-category information |
|---|---|---|
| Responding to enquiries, assessing suitability and taking steps requested before therapy begins | Contract / steps before a contract (Art. 6(1)(b)); legitimate interests where appropriate (Art. 6(1)(f)) | Health care or treatment (Art. 9(2)(h)) where health information is necessary |
| Booking, delivering and managing therapy; communicating about appointments | Contract (Art. 6(1)(b)) | Health care or treatment (Art. 9(2)(h)), supported by DPA 2018 Schedule 1 condition 2 and professional confidentiality |
| Clinical records, continuity of care, quality, supervision and professional accountability | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) | Health care or treatment (Art. 9(2)(h)); legal claims where necessary (Art. 9(2)(f)) |
| Safeguarding, responding to serious risk and protecting vital interests | Legal obligation (Art. 6(1)(c)), vital interests (Art. 6(1)(d)) or legitimate interests (Art. 6(1)(f)), depending on the circumstances | Vital interests (Art. 9(2)(c)), health care (Art. 9(2)(h)) or substantial public interest (Art. 9(2)(g)) where the legal conditions are met |
| Fees, refunds, bookkeeping, tax and fraud prevention | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | Normally not required; if relevant health information is involved, the appropriate Art. 9 condition above will also be identified |
| Complaints, insurance matters, regulatory enquiries and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)) | Legal claims (Art. 9(2)(f)) and, where relevant, health care (Art. 9(2)(h)) |
| Website operation, service security and prevention of misuse | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) | Special-category information is not intentionally used for this purpose |
| Optional news or marketing in the future | Consent (Art. 6(1)(a)), which can be withdrawn at any time | Health information will not be used for marketing |
5. Professional confidentiality and clinical records
Therapy information is treated as confidential and access is limited to people who need it for their role. Confidentiality is not absolute. Information may be shared without consent where this is required by law or professional duties, or where there are serious concerns about abuse, neglect, safeguarding or the safety of you or another person. Where it is safe and appropriate, ThoughtShift Therapy will try to discuss this with you first.
Relevant, accurate and timely clinical records may be kept to support safe care, continuity, accountability and professional standards. Sessions will not be audio or video recorded unless this is specifically agreed in advance, a separate lawful basis is identified and clear information is provided about the purpose, access and retention of the recording.
6. Children and young people
- Children and young people have privacy rights in their own right. Information will be explained in clear, age-appropriate language, and their views, understanding and best interests will be considered.
- Depending on age, understanding, capacity and the legal circumstances, privacy information may be provided directly to the young person and also to a parent or carer.
- The involvement of parents or carers, and what may be shared with them, will be discussed before therapy begins and reviewed as needed.
- A parent or carer booking or paying for therapy does not automatically have a right to see confidential session information.
- Information may be shared without consent when necessary to meet safeguarding, legal or professional duties or to protect someone from serious harm.
- Requests to access a young person's information will be considered carefully, including who holds the relevant data rights and whether disclosure could cause harm or reveal another person's information.
7. Who we may share information with
Information is shared only where necessary, proportionate and lawful. Recipients may include:
- Peter Cartwright and, if the practice grows, authorised therapists, administrative staff or contractors who need access for their role and are bound by confidentiality, data-protection and security requirements.
- Professional supervisors, normally using the minimum necessary or appropriately de-identified information wherever possible.
- Microsoft, which supplies Microsoft Bookings, Outlook, Teams and OneDrive/SharePoint for business administration, communication, video appointments and secure record storage.
- Website hosting, domain, email-security and IT-support providers acting under appropriate contractual and confidentiality arrangements.
- Accountants, professional indemnity insurers, legal advisers, regulators, courts or law-enforcement bodies where reasonably necessary and lawful.
- A GP, NHS service, emergency service, social work service, school, parent/carer or another professional where you agree, where coordinated care is needed and lawful, or where a safety, safeguarding, legal or professional exception applies.
ThoughtShift Therapy does not sell personal information. Health information will not be used for third-party advertising.
Facebook and third-party services
If you contact ThoughtShift Therapy through Facebook or use another third-party platform, that provider will process information under its own privacy terms as an independent controller for parts of the service. Facebook should not be used for detailed clinical information or urgent support. You may instead contact the practice by business email.
8. Microsoft 365, storage and security
ThoughtShift Therapy currently intends to use a business Microsoft 365 tenant for email, bookings, Teams appointments and storage in OneDrive/SharePoint. Microsoft states that OneDrive and SharePoint data is encrypted in transit and at rest. Encryption is one safeguard and does not by itself make every way of using the service secure.
ThoughtShift Therapy will use proportionate technical and organisational measures, which should include:
- multi-factor authentication, strong access controls and separate named accounts for each worker;
- need-to-know permissions, with clinical files kept in a controlled practice location rather than personal folders or shared links;
- secure devices, screen locks, supported software, malware protection and encryption where appropriate;
- regular review of sharing links, audit information, account access, backups and recovery arrangements;
- written confidentiality, data-processing, training and offboarding requirements for staff and contractors; and
- procedures for identifying, containing, recording and, where required, reporting a personal-data breach.
No online system or email service can be guaranteed completely risk-free. ThoughtShift Therapy will review its security as the practice changes and will limit access to what is necessary.
9. International transfers
Microsoft and other service providers may process or support personal information from countries outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, ThoughtShift Therapy will rely on an applicable adequacy regulation or put in place an approved safeguard, such as the UK International Data Transfer Agreement or UK Addendum, together with any required risk assessment. Relevant provider contracts and subprocessor information will be reviewed.
10. How long we keep information
Information is kept only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, professional, insurance, safeguarding and accountability requirements. ThoughtShift Therapy will maintain a written retention schedule and review information securely when the relevant period ends.
The retention decision will take account of the type and sensitivity of the record, the client's age (including whether the record relates to a child), clinical and safeguarding context, continuity of care, professional and insurer requirements, tax or accounting rules, limitation periods, complaints or legal claims, and whether continued retention is necessary and proportionate.
Clinical records: retained under the applicable professional, legal and insurance criteria, with longer periods considered where records concern children, safeguarding or an unresolved claim or complaint.
Enquiries that do not lead to therapy: kept only as long as reasonably needed to respond, manage any agreed follow-up and deal with a complaint or safety concern, then securely deleted under the retention schedule.
Booking and correspondence records: retained as part of the clinical or administrative record where relevant, otherwise deleted under the applicable schedule.
Financial records: retained for the period required by tax, accounting and legal obligations.
You may ask for the retention period or criteria applying to your particular record. Information will be securely deleted, anonymised or otherwise disposed of when no longer required.
11. Your data-protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
- be informed about how your information is used;
- request access to your personal information and receive a copy;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased, where the right applies;
- ask for use of information to be restricted;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format, where the right applies;
- withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful use; and
- complain to ThoughtShift Therapy and to the Information Commissioner's Office.
To make a request, email peter.cartwright@thoughtshifttherapy.co.uk. Reasonable information may be requested to verify identity and protect confidentiality. A response will be provided without undue delay and within the period required by law.
12. Automated decisions and profiling
ThoughtShift Therapy does not make decisions about you based solely on automated processing where the decision has legal or similarly significant effects. Microsoft Bookings may automate appointment availability, confirmations and reminders, but clinical and suitability decisions are made by a person.
13. Complaints about use of your information
If you have a concern, contact Peter Cartwright at peter.cartwright@thoughtshifttherapy.co.uk. ThoughtShift Therapy will provide a clear route for privacy complaints, acknowledge a data-protection complaint no later than 30 days after receipt, investigate it without undue delay, keep you appropriately informed and explain the outcome.
You may also complain to the UK Information Commissioner's Office (ICO). You do not have to wait for ThoughtShift Therapy to agree with your concern before contacting the ICO.
ICO complaints: ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113
14. If you do not provide information
You may choose not to provide information. However, if information is reasonably required to assess suitability, provide therapy safely, arrange appointments, meet safeguarding duties or comply with the law, ThoughtShift Therapy may be unable to offer or continue the service.
15. Changes to this notice
This notice may be updated when services, systems, staff, legal requirements or data practices change. The current version will be published on the website with its effective date. Material changes affecting existing clients will be explained directly where appropriate.
16. Contact
Privacy contact: peter.cartwright@thoughtshifttherapy.co.uk
Website: thoughtshifttherapy.co.uk
Business correspondence address: 6 Strathearn Way, Kilmaurs, KA3 2DS
Young person's summary
Your information and therapy
This is a shorter explanation for children and young people. You can ask Peter to explain anything that is unclear, and you can also read the full Privacy Notice.
What information might be kept?
ThoughtShift Therapy may keep your name and contact details, appointment information, what you would like help with, important things you share in therapy, plans made together and information needed to keep you or someone else safe.
Why is it kept?
The information helps Peter understand how to support you, remember what has been agreed, provide safe therapy, arrange appointments and meet professional and legal responsibilities.
Who can see it?
Your information is private and only people who need it for their work should see it. Peter may discuss the work in professional supervision, using as little identifying information as possible. Information is not normally shared with a parent, school, GP or another professional without discussing it with you, unless the law or a serious safety or safeguarding concern means it needs to be shared.
What about parents or carers?
Parents or carers can be important in helping therapy work, especially for younger clients. You, Peter and your parent or carer will discuss how they can be involved and what information may be shared. Paying for therapy does not automatically mean someone can read your therapy notes.
What can I ask for?
You can ask what information is held about you, ask for mistakes to be corrected, ask how it is used and raise a concern. Some information may need to be kept or withheld if the law, safety, another person's privacy or professional duties require it. Peter will explain this if it applies.