What is written down, and who could ever see it.
Two different things, often muddled. Confidentiality is about what I may repeat. Data protection is about what I record and store.
What you say here stays here
I do not discuss you with your partner, your family, your employer or your GP. I will not confirm to anyone that you are a client. If we pass in Lewes I will not greet you first, which is not rudeness — it is so that you are never put in the position of explaining who I am.
The exceptions, in full
- Clinical supervision. I discuss my work monthly with an experienced supervisor, as the BACP Ethical Framework requires. You are not named. My supervisor is bound by the same confidentiality.
- Serious risk to life. If I believed you or someone else was in immediate danger, I might need to contact your GP or the emergency services. Wherever it is possible I would discuss this with you first and involve you in the decision.
- Risk to a child or a vulnerable adult. I have a responsibility to act on a disclosure of ongoing harm.
- Certain terrorism and money-laundering legislation, which places a legal duty on me regardless of confidentiality.
- A court order. If a court orders disclosure of my notes I must comply. This is rare, and it is one of the reasons my notes are brief.
Outside those five situations, nothing you say leaves the room. Telling me you are having a difficult time, or that you have thought about not being here, does not by itself trigger any of them. People often assume it does, and stay quiet about the very thing they came to say.
What I record and how long I keep it
Michael Deane is the data controller. The lawful bases are legitimate interests for arranging and providing therapy, contract for taking payment, and legal obligation for financial records. Special category health data is processed under Article 9(2)(h) — the provision of health or social care.
- Contact details
- Your name, email address and telephone number, so that I can arrange and change appointments.
Kept for as long as we are working together, and for six years afterwards.
- Session notes
- Brief handwritten notes — a few lines per session, enough to remember what we discussed.
Stored in a locked cabinet, identified by initials only, separately from your contact details.
- An initial record
- Your GP’s name, any medication, and anyone else involved in your care, taken at the first session.
Held so that I can act responsibly if there is ever a serious concern about your safety.
- Invoices
- Dates of sessions and amounts paid.
Kept for six years, as HMRC requires.
What you can ask for
Under UK GDPR you may ask to see the information I hold about you, ask me to correct it, ask me to delete it where I am not legally required to keep it, ask me to restrict how it is used, and object to processing. Ask by email and I will respond within one month, at no charge.
If you are not satisfied with how I have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.
Email and video calls
Ordinary email is not fully secure, which is why I keep emails short and practical and do not discuss the content of sessions in them. Online sessions use an end-to-end encrypted video service and are never recorded.
This website
This site sets no cookies, runs no analytics, embeds nothing from third-party services, and does not track you. Nobody is told that you visited it. Messages sent through the contact form are delivered to my email address and are not stored anywhere else.
Complaints about the therapy itself
If something about the work goes wrong, I would much rather you told me directly. If that is not possible or does not resolve it, the BACP operates a professional conduct procedure and you can complain to them about a registered member.
How to reach me about any of this
Michael Deane, Stillpoint Therapy,
Second floor, 14 Fisher Street, Lewes, East Sussex, BN7 2DG
hello@stillpointtherapy.co.uk
Last updated August 2026.