Laura Muldoon: Founder of Ramsbottom Therapy®

Last updated: 14 October 2026

Your privacy is very important to Ramsbottom Therapy (Laura Muldoon) and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. 

This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended, including: 

• Why I am able to process your information and what purpose I am processing it for

• Whether you have to provide it to me 

• How long I store it for

• Whether there are other recipients of your personal information 

• Whether I intend to transfer it to another country 

• Whether I do automated decision-making or profiling, and 

• Your data protection rights. 

If you have any questions about my data protection policy, you can contact me, Laura Muldoon, via laura@ramsbottomtherapy.co.uk ‘Data controller’ is the term used to describe the person/organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me. I am registered with the Information Commissioner’s Office (ICO) ZA201838. My postal address is: 21 Union Street, Ramsbottom Bury and my phone number is: 07847 530 318. 

My lawful basis for holding and using your personal information - under UK GDPR, we must have a valid legal reason (lawful basis) to process your personal data. Because we process both ordinary personal data and special category health data, we rely on two separate legal bases: 

Article 6 basis (ordinary personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage us for therapy, we enter into a contract, and we need to process your personal data to fulfil that contract. 

Article 9 basis (special category health data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. 

As a BACP registered accredited psychotherapist, we are a health professional for the purposes of this provision. The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes). This processing is carried out by a qualified psychotherapist who is bound by a duty of confidentiality under the BACP Ethical Framework for the Counselling and Psychotherapy Professions. 

How I use your information - whilst you are accessing therapy we collect personal data directly from you: 

• When you first contact us to enquire about therapy (by phone, email, or through our website contact form) 

• Contact details — your name, address, telephone number, and email address 

• Enquiry details — information you submit via our website contact form

• During your initial assessment or intake session

• Health and therapy-related information — presenting issues, relevant medical history, mental health history, current medications, and GP details where appropriate

• Contract and consent information — signed agreements and consent forms 

• Session notes — brief records of our therapeutic work together, including observations and progress

• Financial records — invoices and payment information

• Throughout our ongoing therapeutic work together 

• Through any correspondence between us, including emails and telephone calls 

Alternatively, your GP or other health professional may send me your details when making a referral or a parent or trusted individual may give me your details when making an enquiry on your behalf. If you decide not to proceed, I will ensure all your personal data is deleted within 12 months. 

Everything you share in therapy is confidential. However, there are specific circumstances where we may need to break confidentiality: 

• Risk of serious harm — if we believe you or someone else is at immediate risk of serious harm 

• Safeguarding concerns — if we become aware of concerns about the safety of a child or vulnerable adult 

• Legal requirement — if we receive a court order requiring disclosure 

We will always try to discuss any potential breach of confidentiality with you first, unless doing so would itself put someone at risk. Where possible, we will only share the minimum information necessary. 

How I collect and store your data - I use the secure, encrypted and password protected practice management platform, Google workplace and Microsoft 365 business to collect and store your personal data. These details will be stored securely in Google workplace/Microsoft 365 business and will only be accessible to me. 

Online Bookings - when you make an online booking or payment, Ramsbottom Therapy will send a booking notification to you via email. 

Your payment details - all payments made through our bacs service are made through the secure Lloyds Business banking server. My website therefore does not hold your payment information. Anonymised payment details are recorded in our financial income reports. These reports will only hold your first name, last name initial and unique client reference number. The HMRC requires that I retain this information for 5 years after the end of the financial year. 

Your therapy sessions - everything that you discuss with me is confidential. Confidentiality will only be broken if there is concern about your safety or the safety of someone else or I am instructed to do so by a Court of Law. I will always endeavour to speak to you about this first.

Working remotely - during remote working I will ensure that I am conducting online and telephone sessions in a quiet, private and confidential setting. I have selected video calling platforms that offer end to end encryption to ensure maximum privacy (ZOOM / Microsoft Teams, please ). Please note however that I cannot be held responsible for any breaches that occur due to failures in this technology. 

Session notes - I keep brief notes of each session. These are anonymised and are stored in a locked filing cabinet or within a password protected file within the secure Google workplace/Microsoft 365 business systems. These notes are for my use only and help to keep a track of everything that is being discussed. In line with industry guidelines, these notes will be kept securely for up to seven years after your therapy comes to an end. After this time, they will be confidentially destroyed. 

If your sessions are paid for or arranged via a third party, (e.g. your employer, a friend, or a family member), other than payment requests, invoices or receipts your therapy information will not be shared. Details about what is discussed in your sessions will remain confidential between us. Any other information can only be shared if you provide your written consent. 

Supervision - as a BACP registered accredited psychotherapist, we are required to attend regular clinical supervision. This is an essential part of maintaining safe and ethical practice. During supervision, we may discuss our therapeutic work. When we do so: • Your name and any identifying details are not shared with our supervisor • We use anonymised or pseudonymised case material only • Our supervisor is a qualified professional bound by the same confidentiality obligations as we are • Our supervisor is bound by their own professional body's ethical framework 

Clinical will - a clinical will is a plan that ensures your records are handled appropriately if we become incapacitated, seriously ill, or pass away. I have an agreement in place should the need arise and your details will remain confidential and stored securely. My Therapeutic Executor will have access, by password, to the names of anyone currently receiving therapy from myself, should the need arise to advise you of my death or incapacitation. This access will only be used in these extreme circumstances and for no other reason.  

Your communications with us - Google workplace and Microsoft 365 business are the only platforms that will be used to communicate with you. e.g all of our email accounts use the secure Microsoft 365 server and are double password protected If you send an email to your therapist’s email address, only they will have access to it. All phones, tablets and laptops used to respond to your emails are encrypted, fully protected with anti-virus software and password protected. 

Data Usage - e.g. I will only use your email address and telephone number to contact you about your appointments. Your phone number may also be used to issue appointment reminders via text message. 

After therapy has ended - Our retention periods are: Therapy records (adult clients): 7 years after our last session in line with the Limitation Act 1980 and standard professional indemnity insurance requirements: Financial records: 5 years HMRC legal requirement. 

Website enquiries (non-clients) 12 months (legitimate interest in responding to enquiries). After the applicable retention period, records are securely destroyed. Paper records are shredded, and electronic records are permanently deleted. 

I will never pass on your contact details to any third party organisations for the purposes of sales, marketing or research and will never use your personal data for any purposes other than the administration of the counselling service I am providing to you i.e. to arrange, cancel and rearrange appointments and collect payment for sessions. 

Your rights - under UK GDPR Under UK data protection law, you have the following rights regarding your personal data: 1. Right to be informed — to know how we use your data (this privacy policy fulfils this right) 2. Right of access — to request a copy of the personal data we hold about you (known as a subject access request) 3. Right to rectification — to ask us to correct any inaccurate data we hold about you 4. Right to erasure — to ask us to delete your data in certain circumstances (please note this may not apply where we are required to retain records for professional or insurance purposes) 5. Right to restrict processing — to ask us to limit how we use your data in certain circumstances 6. Right to data portability — to receive your data in a portable format in certain circumstances 7. Right to object — to object to certain types of processing 8. Rights related to automated decision-making — we do not use automated decision making or profiling in our practice

To exercise any of these rights, please make a subject access request (Use and Access) Act 2025 by contacting me via laura@ramsbottomtherapy.co.uk. We will conduct a reasonable and proportionate search of our records. We will respond to your request within 1 month of receiving your request. 

Instances where I would not be able to comply with your request are as follows: 1. a) It is necessary for me to retain these records in order to continue providing an effective service 2. b) We are compelled to retain these records by a Court of Law 3. c) We require these records in order to establish, exercise or defend legal claims.

Consent - Consent is obtained when you enquire and book your first session with Ramsbottom Therapy via Google workplace forms. e.g When you book your first session with us via Ramsbottom Therapy, you will be asked to tick a checkbox to confirm that you consent to the storage and processing of your personal data for the purposes of providing therapeutic services. You are entitled to withdraw this consent at any time and can do so by emailing me via laura@ramsbottomtherapy.co.uk 

Breaches of data protection - in the event of any breach of Ramsbottom Therapy data protection policies, I will notify you and the Information Commissioner’s Office (ICO) within 72 hours and will seek to rectify this immediately. 

Raising concerns - if you have any concerns about our use of your personal information, you can make a data protection complaint to us: 

Ramsbottom Therapy

Laura Muldoon

Email: laura@ramsbottomtherapy.co.uk 

Telephone: 07847530318 

Post: 21 Union Street Ramsbottom Bury, BL0 9AN 

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also notify the Information Commissioner’s Office (ICO). I am registered with ICO under the reference number ZA201838. The ICO’s address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113 

We review this privacy policy annually and whenever our practices change significantly.

If we make any significant changes to how we handle your personal data, we will inform you directly.