Gallant Therapy
Client Privacy Notice
Your privacy, confidentiality and personal information
Last reviewed: August 2026
Your privacy matters.
When you enter psychotherapy, you may share deeply personal and sensitive information. This notice explains what information I collect, why I need it, how it is protected, when it may need to be shared, and the rights you have over your information.
I aim to handle your information with care, respect and transparency.
1. Who is responsible for your information?
For the purposes of UK data protection legislation, Gallant Therapy, Mr Shaan Malhotra is the Data Controller for personal information collected in connection with your psychotherapy.
Contact details
Gallant Therapy
Email: enquiries@gallanttherapy.co.uk
Website: www.gallantherapy.co.uk
2. What information might I hold?
Depending upon our work together, I may hold information including:
- your name
- date of birth
- address
- email address
- telephone number
- emergency contact details
- GP or other healthcare details where relevant
- appointment information
- invoices and payment records
- information provided during your initial enquiry or assessment
- information relevant to your psychological and emotional wellbeing
- relevant health information
- brief psychotherapy/session notes
- correspondence between us
- information relating to risk or safeguarding where necessary
- your Therapy Agreement and consent information.
I aim to collect and retain only information that is necessary and proportionate to providing a safe and professional therapeutic service.
3. Sensitive information
Psychotherapy inevitably involves information of a particularly private nature.
Information concerning your physical or mental health is regarded as special category personal data under UK data protection law (GDPR) and receives additional protection. Depending upon what you choose to discuss, therapy may also involve other sensitive aspects of your life, relationships, identity, beliefs or experiences.
You are never expected to disclose something simply because you are attending therapy.
4. Why do I process your information?
Your information may be used to:
- respond to your enquiry
- determine whether I am able to offer an appropriate service
- arrange and provide psychotherapy
- communicate with you about appointments
- maintain appropriate professional records
- issue invoices and maintain financial records
- support safe and effective therapeutic practice
- fulfil safeguarding responsibilities
- respond appropriately where serious risk arises
- meet legal, regulatory, ethical or insurance obligations
- manage complaints or concerns.
I will not use information disclosed during psychotherapy for unrelated marketing purposes.
5. Legal basis for processing
Data protection law requires there to be an appropriate legal basis for processing personal information.
Depending upon the circumstances, Gallant Therapy may process your information because it is necessary:
- to enter into or fulfil our therapeutic agreement
- to meet a legal obligation
- for legitimate interests associated with providing and managing a safe professional psychotherapy service
- to protect vital interests in exceptional circumstances.
Where special category information, including health information, is processed, an additional lawful condition under UK GDPR legislation will apply.
Where I rely specifically upon your consent for a particular use of information, you will be able to withdraw that consent, subject to any legal or professional obligations that require information to continue to be retained.
6. Psychotherapy notes
I maintain appropriate records of my clinical work.
These are intended to be concise, relevant and proportionate to the professional purpose for which they are created.
They are not intended to be a word-for-word account of everything you say during therapy. Records are maintained and stored with due regard to confidentiality and data protection requirements.
7. Confidentiality
Information you share during psychotherapy will ordinarily remain confidential.
I will not routinely disclose information about you to your family, employer, GP or other professionals without your knowledge or permission.
There are, however, limits to confidentiality.
Information may need to be disclosed where:
- I believe there is a serious risk of harm to you or another person
- safeguarding concerns arise
- disclosure is required by law
- I am required to comply with a court order
- another exceptional legal or professional obligation requires disclosure.
Where it is safe and appropriate, I will aim to discuss a concern or proposed disclosure with you beforehand.
Where disclosure without your consent is necessary, I will seek to disclose only information that is relevant and proportionate to the circumstances.
8. Clinical supervision
Regular clinical supervision is an important part of safe and ethical psychotherapy practice.
I discuss my clinical work with an appropriately qualified supervisor to support reflection, professional development and safe practice.
Wherever practicable, unnecessary identifying information is not used during supervision.
My supervisor is also required to respect professional confidentiality.
9. Your GP and other professionals
I do not routinely contact your GP simply because you are attending psychotherapy.
There may, however, be circumstances in which communication with your GP or another healthcare professional would be helpful.
Ordinarily, I would discuss this with you and seek your agreement before making contact.
In exceptional circumstances involving serious risk, safeguarding or another compelling legal or professional responsibility, information may need to be shared without prior consent.
10. Emergency contact information
I will ask you to provide details of someone who could be contacted in an emergency. Providing an emergency contact does not give that person general access to information about your therapy.
They would only be contacted where there was an appropriate and proportionate reason to do so.
11. Online therapy
If we work online, personal information may necessarily be processed through electronic communication and video-conferencing systems.
I take reasonable steps to use appropriate systems and maintain privacy when working remotely.
You also have a role in protecting your privacy and are encouraged to participate in online therapy from a private environment using a device and internet connection you consider secure.
For safety purposes, I may need to establish your physical location during an online appointment, particularly if you are attending from somewhere other than your usual location.
12. Email and electronic communication
Email, text messaging, WhatsApp and other electronic communications can be convenient but cannot be guaranteed to be completely secure.
I therefore encourage clients not to send highly sensitive clinical information by ordinary email or text unless necessary.
Electronic communication between sessions should normally be used for practical matters such as arranging or changing appointments rather than as a substitute for psychotherapy.
13. Who might information be shared with?
Your information is not sold to third parties.
Where necessary, limited information may be processed or shared with:
- my clinical supervisor
- accountants or financial professionals, where appropriate
- insurers or professional advisers where legitimately required
- healthcare, safeguarding or emergency services where necessary
- courts, law enforcement agencies or regulatory authorities where disclosure is legally required.
Where third-party services process personal information on behalf of Gallant Therapy, appropriate consideration is given to privacy and data protection.
14. How is your information protected?
I take reasonable technical and organisational steps to protect personal information
from:
- unauthorised access
- inappropriate disclosure
- alteration
- accidental loss
- destruction or misuse.
Electronic information is protected using appropriate security measures.
Paper records, where used, are stored securely.
Access to identifiable clinical information is restricted to those who have a legitimate professional reason to access it.
15. How long will information be retained?
Clinical and administrative records will be retained for seven years, as stipulated by my professional indemnity insurance policy, following the end of our work, unless there is a legal, regulatory, insurance or safeguarding reason requiring a different retention period.
Financial records may need to be retained for a different period to meet taxation and accounting requirements.
Once information is no longer required, it will be securely destroyed or deleted. I will periodically review my retention arrangements to ensure that information is not kept longer than necessary.
16. If I become unexpectedly unavailable
I maintain appropriate professional arrangements for circumstances in which serious illness, incapacity or death prevents me from contacting clients myself.
An appropriately designated professional may, where necessary, be given limited access to essential information solely for purposes such as informing clients of my unavailability and ensuring the safe management of professional records.
They would not have unrestricted access to your therapy simply because they had been designated for this purpose. Confidentiality would continue to apply.
17. Your information rights
Depending upon the circumstances and applicable legislation, you may have rights
including:
- being informed about how your information is used
- requesting access to personal information held about you
- requesting correction of inaccurate information
- requesting deletion of information in certain circumstances
- requesting restriction of processing in certain circumstances
- objecting to certain uses of your information
- requesting transfer of information where applicable
- withdrawing consent where consent is the basis upon which information is being processed.
Some rights are not absolute. For example, I may need to retain particular information because of legal, safeguarding, insurance or professional obligations.
If you wish to exercise one of your rights, please contact me.
18. Concerns about your information
If you have a concern about how your information has been handled, please contact me in the first instance:
Gallant Therapy, Shaan Malhotra
Email: enquiries@gallanttherapy.co.uk
I will take your concern seriously and seek to resolve it appropriately.
You also have the right to raise a concern with the Information Commissioner’s
Office (ICO), the UK’s independent regulator for data protection.
19. Changes to this notice
This Privacy Notice may be updated when legislation, professional guidance or Gallant
Therapy’s working practices change.
Where a change materially affects how existing client information is handled, I will take reasonable steps to bring this to your attention.
A final word about your privacy
Psychotherapy depends upon trust and the therapeutic relationship between client and therapist; you and I.
Protecting your information is therefore more than an administrative requirement. It is part of the respect, safety and confidentiality I seek to offer within our therapeutic relationship.
Please ask me if there is anything about your privacy or confidentiality that you would like me to explain.
Gallant Therapy
www.gallantherapy.co.uk
enquiries@gallanttherapy.co.uk
Last reviewed: August 2026
Next review: August 2028