Last updated: 25 July 2026

CBT with Kristy takes your privacy seriously and is committed to protecting your personal information.

This privacy policy explains what information I collect, why I collect it, how it is used and stored, when it may be shared, and the rights you have under UK data-protection law.

Kristy Arnold, trading as CBT with Kristy, is the data controller responsible for your personal information.

Business name: CBT with Kristy
Data controller: Kristy Arnold
Address: 67 Enville Street, Stourbridge, DY8 1XW
Email: kristyarnold1@gmail.com
Telephone: 07592 128205

If you have a question or concern about how your personal information is handled, please contact me using the details above.

Depending on how you contact me and whether you become a client, I may collect:

• Your name, address, email address and telephone number
• Your date of birth and age
• Contact details for a parent, guardian or emergency contact where appropriate
• Information supplied through my website contact form, email, telephone, WhatsApp or another communication service
• Referral information received from you, BUPA or another authorised referring party
• Information about your physical and mental health, symptoms, medication, treatment history and personal circumstances
• Assessment information, therapy goals, clinical notes and records of appointments
• Relevant information about relationships, family circumstances, education, employment or significant life events
• Risk, safeguarding and emergency information
• BUPA membership, authorisation and billing details where applicable
• Payment, invoice and appointment information
• Technical information collected when you visit my website, such as your IP address, browser, device and cookie preferences

Please do not include highly sensitive medical or personal information in the website contact form unless it is necessary. Initial contact only needs to contain enough information for me to respond to your enquiry.

I work with children and adolescents as well as adults.

When therapy involves someone under 18, I may collect information about the young person and their parent or guardian. I will explain confidentiality and the use of information in a way that is appropriate to the young person’s age and understanding.

The involvement of a parent or guardian will depend upon the young person’s age, capacity, circumstances and therapeutic needs. A parent or guardian does not automatically have access to everything discussed during therapy. However, information may be shared when required for safeguarding, safety or legal reasons.

I may receive information:

• Directly from you
• From a parent or guardian
• Through the website contact form
• During telephone, face-to-face or online consultations
• Through email, WhatsApp or Microsoft Teams
• From BUPA when it has been authorised to refer you or administer your treatment
• From another person or organisation where you have authorised the referral or where there is another lawful reason to provide the information

If I receive your information from another source, I will normally explain this to you at our first contact or as soon as reasonably possible.

I use personal information to:

• Respond to enquiries
• Arrange and manage consultations and therapy appointments
• Assess whether my services are suitable for your needs
• Provide safe, appropriate and effective CBT
• Create and maintain accurate clinical records
• Monitor progress and manage risk
• Communicate with you about your appointments or treatment
• Liaise with BUPA about authorised treatment, administration and payment
• Process payments and maintain accounting records
• Meet professional, safeguarding, insurance and legal responsibilities
• Protect the security and proper operation of my website and services
• Handle questions, complaints and requests concerning personal information

I do not use your therapy information for advertising, and I do not send marketing emails or newsletters.

Under the UK General Data Protection Regulation, I must have a lawful basis for processing personal information.

Depending on the circumstances, I rely upon:

• Contract: when information is needed to take steps at your request before therapy begins or to provide therapy under our agreement
• Legal obligation: when I must retain or disclose information to meet a legal responsibility
• Legitimate interests: when using information is reasonably necessary to administer and protect my practice, maintain appropriate records, communicate with clients, establish or defend legal claims, or provide a safe professional service
• Vital interests: in an emergency where using or sharing information is necessary to protect someone’s life
• Consent: where consent is specifically required, such as for certain optional disclosures or uses

Information about physical or mental health is legally classed as special-category information and receives additional protection.

Where I process health information to provide therapy, I generally rely upon the condition that the processing is necessary for the provision and management of health treatment and is carried out under a professional duty of confidentiality.

In other circumstances, I may process special-category information where:

• You have given explicit consent
• It is necessary to protect someone’s vital interests
• It is necessary for the establishment, exercise or defence of a legal claim
• Another relevant legal condition applies

What you discuss during therapy is treated as confidential.

I will not normally share identifiable information without your knowledge and, where appropriate, your consent. However, confidentiality is not absolute. Information may need to be shared if:

• I believe there is a serious or immediate risk of harm to you or another person
• There is a safeguarding concern involving a child or vulnerable person
• Disclosure is required by law, a court order or an authorised regulatory body
• It is necessary to prevent or detect serious crime
• It is necessary to establish, exercise or defend a legal claim
• A medical emergency makes disclosure necessary to protect life

Where possible and appropriate, I will discuss a proposed disclosure with you first. I will only disclose information that is relevant and necessary.

I may also share limited information with:

• BUPA, where it is funding or administering your authorised treatment
• Professional advisers, including my insurer, legal adviser or accountant, where necessary
• A clinical supervisor, with information anonymised wherever reasonably possible
• Technology and cloud-service providers that help me securely host the website, store records, manage email or provide online communication services
• Emergency services, safeguarding authorities or healthcare professionals where a safety, legal or safeguarding need arises

Service providers acting on my behalf are expected to protect the information and use it only for the service they provide.

I may provide or arrange services using telephone, email, Microsoft Teams, WhatsApp or face-to-face appointments, according to your needs and what we agree.

Electronic communication always carries some privacy and security risk. You should use a private device, secure internet connection and suitable location when attending online therapy.

WhatsApp, Microsoft and other communication providers operate under their own privacy terms. You may choose not to use WhatsApp if you would prefer to communicate by telephone or email.

I will not knowingly make an audio or video recording of a therapy session without discussing it with you and obtaining appropriate permission in advance.

My website is hosted and supported by third-party website and technology providers.

When you visit the website, essential technologies may be used to make it function correctly and keep it secure. With your permission, additional cookies or similar technologies may be used to understand website traffic and improve the visitor experience.

The website may also use or include third-party services such as:

• GoDaddy website hosting and contact-form services
• Vimeo video
• Google reCAPTCHA
• Website analytics and security tools

These services may receive technical information such as your IP address, browser information, device information and your interaction with embedded content.

You can accept or decline optional cookies through the website’s cookie controls. You can also change or remove cookies using your browser settings, although disabling essential cookies may affect how the website works.

The separate privacy policies of third-party services explain how they use information collected through their technology.

Some website, cloud-storage and communication providers may process information in countries outside the United Kingdom.

Where this happens, I will take reasonable steps to ensure that appropriate safeguards are used, such as a UK adequacy decision, approved contractual protections or another lawful transfer mechanism.

I use reasonable technical and organisational measures to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

These measures include appropriate password protection, access controls, secure cloud-based storage and limiting access to those who genuinely require the information.

No internet, email or cloud-storage system can be guaranteed to be completely secure. If a personal-data breach creates a risk to your rights and freedoms, I will take appropriate action in accordance with data-protection law.

I keep personal information only for as long as it is reasonably required for therapy, professional, insurance, safeguarding, tax or legal purposes.

My usual retention periods are:

• Enquiries that do not lead to therapy: up to six months after the last contact
• Adult client records: seven years after therapy ends or the last clinical contact
• Records concerning clients under 18: until the client’s 25th birthday or seven years after therapy ends, whichever is later
• Financial and tax records: for at least the period required by HM Revenue & Customs
• Complaints, safeguarding matters or legal claims: for as long as reasonably necessary to investigate and manage the matter and meet relevant legal or insurance requirements

I may retain information for longer if there is an ongoing complaint, safeguarding concern, legal claim, regulatory requirement or instruction from an insurer.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

Depending on the circumstances and lawful basis being used, you may have the right to:

• Ask for a copy of the personal information I hold about you
• Ask me to correct information that is inaccurate or incomplete
• Ask me to erase your information
• Ask me to restrict how your information is used
• Object to certain uses of your information
• Ask for certain information to be transferred to you or another organisation
• Withdraw consent where consent is the lawful basis being used
• Complain about how your information has been handled

These rights are not absolute. For example, I may need to retain some information to comply with a legal obligation, protect someone’s safety or establish or defend a legal claim.

I do not use personal information to make decisions about you through solely automated decision-making or profiling.

To exercise your rights, contact me at kristyarnold1@gmail.com. I may need to request information to confirm your identity before releasing or changing personal information.

If you have a concern about how I have collected, used, stored or shared your information, please contact me first:

Email: kristyarnold1@gmail.com
Telephone: 07592 128205
Post: CBT with Kristy, 67 Enville Street, Stourbridge, DY8 1XW

I will acknowledge a data-protection complaint within 30 days, investigate it appropriately and explain the outcome.

You also have the right to complain to the UK data-protection regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

This website may contain links to other websites. I am not responsible for the privacy practices or content of external websites. You should read the privacy information provided by those organisations before submitting personal information.

I may update this privacy policy to reflect changes to my services, technology, professional requirements or the law.

The date at the top of the policy shows when it was most recently updated. Please revisit this page periodically to remain informed about how your information is protected.