Legal
Privacy Policy
Last updated September 2026. Here is exactly what we collect, why, and who can see it.
What we collect, and why
Account details
Your name and email address, so you can sign in and so we can reach you about your listing or account.
Who can see it: You and our team.
Profile content
The profile you publish — summary, approach, photo, fees, availability. For therapists this is deliberately public: it is what clients browse.
Who can see it: Anyone viewing the directory.
Verification documents
The qualification, membership, and insurance files you upload. They are stored in private storage and can only be opened by our vetting team. Once an application is approved, the files are detached from your record — they are never shown on your profile or shared with other users.
Who can see it: Our vetting team only.
Messages
Messages you send through the platform are stored so your conversation works, and are visible only to the two people in it. We do not read, sell, or share them.
Who can see it: Only the sender and recipient.
Enquiries and email replies
If you contact us — through the contact form or by email — we use the email address you give us for one purpose: to reply to you about your enquiry. We do not add you to any mailing list this way, we do not share your address with third parties, and we keep enquiry correspondence only as long as we are dealing with it (and for a short period afterwards as a record).
Who can see it: Our team only.
Payment details
Payments are handled securely by Stripe. We never see or store your full card or bank account details — only whether your subscription is active.
Who can see it: Stripe, our payment processor.
Usage analytics
Simple, aggregate counts of how features are used, so we can keep the platform fast and reliable. No advertising trackers.
Who can see it: Us, in aggregate.
Our lawful basis for processing
Under UK GDPR we need a lawful reason to handle personal data. Ours are:
Performance of a contract. Therapists join in order to be listed, so we must vet their qualification, professional membership and insurance to provide the service. Verifying documents, running your listing, and taking your subscription all rest on this basis.
Legitimate interest. We check the identity of everyone who joins, so the platform stays safe — clients can trust that every listed therapist is real, qualified, and insured.
Consent. Emails that are not essential to running your account — occasional updates, news and offers — are only sent to people who opted in with the unticked box at sign-up, or later from email preferences. We record when consent was given so we can show it on request. You can withdraw it at any time from that page, and emails essential to your account (verification codes, payment receipts, renewal reminders and security notices) are not affected by this choice.
Who we are
Thepsychotherapistindex is the data controller for the personal data described on this page. We are registered with the Information Commissioner’s Office (ICO) as a UK data controller. For any privacy question, or to exercise your rights, contact us via our contact form and we will treat it as a privacy matter.
How long we keep it
Account and profile data is kept while your account is open. Verification documents are detached from your record as soon as your application is approved. Messages are kept while your conversations are active. Anything you ask us to delete, we delete promptly.
How we protect your data
Access to your account and our systems is protected by encrypted connections and sign-in. Verification documents sit in private storage that only our vetting team can open, and messages are visible only to the two people in the conversation. We apply the least access we need to run the service, and we review what we hold so we keep only what is necessary.
Your rights & removal requests
You can ask us for a copy of your data, ask us to correct it, or ask us to remove your data or delete your account at any time. As a UK resident, you have rights under UK GDPR, including access, rectification, erasure, restriction of processing, objection, and data portability. We respond to every rights request within one calendar month.
Want your data permanently deleted? You have the Right to be Forgotten. Send us a deletion request and we will permanently remove your information from our system, usually within a day or two.
Complaining to the ICO
You have the right to complain to us first, via our contact form, and we will always try to resolve a privacy concern with you directly. You also have the right to make a complaint to the Information Commissioner’s Office, the UK supervisory authority for data protection, at any time, by visiting ico.org.uk or calling their helpline.