Privacy policy

Ruta Gabalis Integrative Therapy
Last updated: October 2026

Your privacy matters to me. Therapy depends upon trust, and part of that trust is knowing that personal information shared with me is treated with care, respect and appropriate confidentiality.

This privacy notice explains what information I collect, why I collect it, how it is used and stored, when it may need to be shared, and the rights you have in relation to your personal information.

I am Ruta Gabalis, trading as Ruta Gabalis Integrative Therapy, and I am the data controller for the personal information processed within my private practice.

If you have any questions about this notice or about how your information is handled, you can contact me at:

Email: info@rutagabalis.co.uk
Website: www.rutagabalis.co.uk

Information I may collect

The information I hold depends upon your relationship with the practice and may include:

  • your name, date of birth and contact details;
  • information provided when you make an enquiry or book an initial conversation;
  • appointment and attendance information;
  • emergency contact details;
  • GP or other relevant healthcare-professional details;
  • information about physical or mental health, medication or previous treatment where this is relevant to the therapeutic work;
  • information you choose to share during therapy;
  • brief factual therapy notes;
  • correspondence relating to appointments and the administration of therapy;
  • invoices and payment records; and
  • information necessary to respond appropriately to safeguarding or serious-risk concerns.

I aim to collect only information that is relevant to providing and safely administering the service.

Information about physical and mental health is treated as special-category personal data and receives additional protection under data-protection law.

Why I use your information

I use personal information where necessary to:

  • respond to enquiries;
  • arrange and manage appointments;
  • provide counselling, Integrative Therapy and related therapeutic services;
  • understand information relevant to safe and appropriate therapeutic work;
  • maintain appropriate clinical records;
  • communicate about practical matters relating to therapy;
  • manage invoices, payments and business records;
  • meet professional, ethical, safeguarding, insurance and legal responsibilities;
  • protect you or another person where there is a serious concern about safety; and
  • understand and manage the operation of my practice, using aggregated or appropriately minimised information wherever individual identification is unnecessary.

I do not use information disclosed within therapy for advertising or direct marketing.

Lawful basis for processing

Different lawful bases may apply depending upon why information is being processed.

For ordinary personal information, I principally rely upon:

Contract — where processing is necessary to take steps at your request before therapy begins or to provide the therapeutic service we have agreed.

Legitimate interests — where information is reasonably necessary for the safe, ethical and effective administration of my professional practice, provided that those interests do not override your rights and interests.

Legal obligation — where I am required to retain or disclose particular information by law.

Vital interests may apply in rare circumstances where processing is necessary to protect someone’s life.

Information concerning physical or mental health is special-category data. Where applicable to the therapeutic services I provide, I process this information under the provisions of UK data-protection law relating to the provision and management of health or social care/treatment and the associated duty of confidentiality. Other Article 9 conditions may apply in particular circumstances. ICO

I do not rely upon consent as the general lawful basis for all processing simply because you have chosen to enter therapy. Where consent is specifically required for a particular use of information, it will be sought separately.

Therapy records and confidentiality

I keep minimal factual notes to support safe and ethical therapeutic practice. These are stored securely and are not routinely shared with other people or organisations.

Therapeutic information is confidential. There are, however, limited circumstances in which confidentiality may need to be broken. These include situations where:

  • you or another person may be at serious risk;
  • there is a safeguarding concern involving a child or vulnerable person; or
  • disclosure is required by law.

Where it is safe and appropriate to do so, I will aim to discuss this with you before information is disclosed.

As part of ethical professional practice, aspects of therapeutic work may be discussed in clinical supervision. Information used in supervision is anonymised as far as reasonably possible and is shared for the purpose of maintaining safe and effective therapeutic practice.

These arrangements reflect the confidentiality provisions within my therapeutic agreement.

How your information is stored and used

I use carefully selected digital services to administer the practice. Depending upon how you work with me, these may include services used for:

  • secure email and business communications;
  • appointment booking and calendar management;
  • online sessions;
  • invoicing, accounting and payment processing;
  • website enquiries;
  • secure document and record storage; and
  • website analytics and advertising measurement.

These providers process only the information necessary for the particular service they provide and are selected with privacy and security in mind.

Some technology providers may process information outside the United Kingdom. Where this occurs, I take reasonable steps to ensure that appropriate safeguards recognised under UK data-protection law are in place.

I do not currently use generative AI services to process identifiable therapy records or the content of therapy sessions. If this changes in the future, I will review the data-protection implications and update this privacy notice before introducing the new processing.

 

Online therapy

Online therapy is normally provided through Zoom. Your name and information necessary to establish and administer the online appointment may therefore be processed through the platform.

Sessions are not routinely recorded by me.

Clients are responsible for choosing a suitably private environment for online therapy and for the security of their own device and internet connection.

 

Appointments and booking

Appointment information may be processed through my booking and calendar systems. This can include your name, contact information, the service booked, appointment time, duration and location or online-session information.

This information is used to administer the therapeutic relationship and may also contribute to aggregated practice analysis, such as understanding demand for different services, appointment capacity and patterns of service use.

Where analysis does not require identification of individual clients, information will be aggregated or minimised accordingly.

Payments and financial records

Information required for invoicing and accounting is processed separately from the therapeutic content of sessions wherever practicable.

Payment providers and financial institutions may process information necessary to complete transactions.

Certain financial records must be retained for the periods required by tax and accounting legislation, which may differ from the retention period for therapy records.

How long I keep information

Minimal therapy records are normally retained for five years following your final session, in accordance with my current record-keeping policy.

Other information may have different retention periods. For example, financial records may need to be retained for longer where required by tax or accounting law.

Enquiry information that does not result in therapy will not be retained indefinitely and will be deleted when there is no longer a reasonable professional or administrative reason to keep it.

Where there is a safeguarding matter, complaint, legal issue or insurance requirement, relevant information may need to be retained for longer.

Website enquiries

If you contact me through the website, I receive the information you choose to provide through the enquiry form. This is used to respond to your enquiry and, where appropriate, arrange an initial conversation or therapeutic work.

Please avoid including detailed or highly sensitive therapeutic information in the website enquiry form. There will be an appropriate space for this if we decide to work together.

Cookies, analytics and advertising

My website uses cookies and similar technologies for essential website functions and, where you consent, for analytics and advertising measurement.

I use Google services, including Google Analytics and Google Ads, to understand how people find and use the website and to assess the effectiveness of advertising.

Non-essential analytics and advertising technologies are subject to the choices you make through the website’s cookie-consent system.

You can change or withdraw your cookie choices through the cookie settings available on the website.

The ICO requires websites to explain their use of cookies and generally requires agreement before non-essential cookies are used. ICO

 

Sharing information

I do not sell client information.

Personal information may be shared only where there is an appropriate reason to do so, which may include:

  • service providers acting on my behalf in operating the practice;
  • my clinical supervisor, normally using anonymised information;
  • healthcare or safeguarding professionals where necessary and lawful;
  • emergency services where there is a serious and immediate safety concern;
  • professional advisers, insurers or regulatory/professional bodies where necessary; or
  • another person or organisation where disclosure is required by law.

Only information relevant to the particular purpose will be shared.

Your rights

Depending upon the circumstances and the lawful basis being used, data-protection law gives you rights that may include the right to:

  • ask what personal information I hold about you;
  • request a copy of your personal information;
  • ask for inaccurate information to be corrected;
  • request restriction of processing in certain circumstances;
  • request deletion of information in certain circumstances;
  • object to particular forms of processing; and
  • request transfer of certain information where the right to data portability applies.

These rights are not absolute. For example, information may sometimes need to be retained because of legal, safeguarding, professional or insurance obligations.

You are welcome to contact me if you would like to exercise a data-protection right or understand how your information is being handled.

The ICO requires privacy notices to explain applicable individual rights and specifically requires the right to object to be brought clearly to people’s attention.

You have the right to object to processing based upon legitimate interests. If you wish to object, please contact me and I will consider your request in accordance with data-protection law.

 

Concerns or complaints

If you have concerns about how I have handled your personal information, I would welcome the opportunity to address them directly first.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

Information Commissioner’s Office

 

Changes to this notice

I may update this privacy notice as my practice, technology or legal obligations change.

Where a change materially affects how existing client information is used, I will take reasonable steps to bring the change to the attention of those affected before beginning the new processing. The ICO specifically requires new uses of personal information to be communicated before that processing begins.