MGTS Privacy Notice
22 Sept 2026
1. Who we are
The Middle Ground Therapy Service (MGTS) is a reduced-fee, trainee-led counselling service based at Smart Therapy's Lavender Hill centre. MGTS is operated by Smart Therapy Ltd, which is the data controller responsible for your personal information.
Smart Therapy Ltd is registered with the Information Commissioner's Office (ICO) as a data controller (registration reference ZA790620).
Our Data Protection Lead is Amy Launder, who is also MGTS's Programme Lead and Safeguarding Lead. Any question about this notice, or about how we handle your information, can be sent to mgts@smarttherapyltd.com.
This notice explains what personal information MGTS collects about you, how and why we use it, who we share it with, and what rights you have. It should be read alongside your MGTS Counselling Agreement and Client Information Pack, which set out the confidentiality of therapy itself.
2. What personal information we collect
Depending on your stage with MGTS, we may collect:
Contact and identifying details — your name, address, email, phone number, and emergency contact, given when you enquire, book an assessment, or become a client.
Assessment and clinical information — what brings you to therapy, your history, and your responses to the outcome questionnaires we use at assessment and at every 12-session review.
Therapy notes — brief, factual records your therapist keeps of each session.
Booking, attendance and payment information — session times, attendance record, and payment history for the £35 session fee.
Safeguarding and risk information — where relevant to keeping you or someone else safe.
Correspondence — emails or messages you send us, for example about scheduling or a concern.
We collect this information directly from you, principally through our website enquiry form, intake form, at assessment, and during the course of therapy.
3. Special category data
Much of what we hold about you — your therapy notes, assessment information, and anything relating to your mental health, relationships, trauma or risk — is classed as special category data under UK GDPR. This is information the law recognises as needing extra protection, and we treat it accordingly: it is kept confidential, accessed only by those who need it for your care, and never used for any purpose beyond providing and supervising your therapy.
4. How and why we use your information
We use your information to...
Our legal basis
Assess your needs and allocate you to a trainee therapist
Performance of a contract with you, and (for health-related information) the provision of health treatment
Provide and review your therapy, including outcome measures at assessment and every 12 sessions
Performance of a contract with you, and the provision of health treatment
Manage bookings, attendance and payment of the £35 session fee
Performance of a contract with you
Enable clinical supervision of your therapist, as required for safe practice
Our legitimate interest in providing an ethical, well-governed service, and the provision of health treatment
Safeguard you or another person from serious harm, or meet a legal obligation (for example a court order)
Legal obligation, and vital interests / substantial public interest where safeguarding is engaged
Handle a complaint or concern you raise
Legitimate interest in resolving concerns fairly
Because therapy notes and related information are special category data, we also rely on the UK GDPR condition for the provision of health treatment by a professional bound by a duty of confidentiality (such as BACP's Ethical Framework), or, where appropriate, your explicit consent.
5. Confidentiality and who we share your information with
Therapy is confidential. As part of normal, ethical practice, your therapist discusses their work in regular clinical supervision — this happens for every client, and identifying details are shared only where necessary.
Beyond supervision, we will only share your information in the following circumstances.
We are legally required to share information, with or without your consent, where:
it may help prevent an act of terrorism or bring a person responsible for one to justice;
we become aware of drug trafficking, money laundering, or Female Genital Mutilation (FGM);
a court orders disclosure, for example through a court order or witness summons.
We may need to share information, with or without your consent, where:
there is a serious risk of harm to you or to another person, including risk of suicide or serious self-harm;
there are safeguarding concerns relating to a child;
there are safeguarding concerns relating to an adult who is unable to protect themselves from abuse or neglect because of care and support needs.
Wherever possible, we will discuss this with you first. Your clinical records are not automatically shared with your GP or added to your NHS medical record; information is only shared with your GP or another professional with your explicit consent, unless the exceptions above apply.
We also share limited personal information with trusted organisations who provide services to us, including our GDPR-compliant secure practice management system, our website and booking platforms, and our payment processor for session fees. These organisations only process your information on our instructions and are required to keep it secure.
We do not sell your information to anyone, and we do not use it for marketing without your separate, explicit consent.
6. How long we keep your information
We keep your personal details and clinical records for 7 years from your last contact with MGTS, in line with our professional and legal record-keeping obligations, and then securely destroy them.
If you enquire about MGTS but do not go on to become a client, we keep the limited information you gave us for a shorter period, only for as long as needed to respond to your enquiry.
7. Keeping your information secure
Your information is held on secure, password-protected systems, with access limited to those who need it to provide or support your care. Paper records, where used, are kept locked away and destroyed securely when no longer needed. If a data breach ever affects your information, we will assess and, where required, report it to the Information Commissioner's Office within 72 hours, and let you know if it puts you at high risk.
8. Your rights
Under UK GDPR, you have the right to:
Access the personal information we hold about you, including your therapy notes (a subject access request);
Rectification of information that is inaccurate or incomplete;
Erasure of your information in some circumstances, although as a regulated health service we are usually required to keep clinical records for the retention period set out above;
Restriction of how we use your information in certain circumstances;
Object to our use of your information where we rely on legitimate interests;
Withdraw consent at any time, where consent is our basis for processing, without affecting anything already done.
To exercise any of these rights, contact our Data Protection Lead at mgts@smarttherapyltd.com. We will usually respond within one month. In limited circumstances, we may need to withhold or redact information — for example, where disclosure would cause serious harm or reveal another person's confidential information.
9. Concerns and complaints
If you have a concern about how we have handled your information, please contact our Data Protection Lead at mgts@smarttherapyltd.com in the first instance, so we can look into it.
If you remain unhappy with our response, you have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO) www.ico.org.uk Telephone: 0303 123 1113
This is separate from any complaint about the therapy itself, which is handled under our Complaints Policy.
10. Changes to this notice and how to contact us
We may update this notice from time to time, for example to reflect a change in our practice or the law. The version in use will always be available on the MGTS pages of the Smart Therapy website.
For anything relating to this notice or your personal information, contact:
Amy Launder, Data Protection Lead Middle Ground Therapy Service, c/o Smart Therapy Ltd Email: mgts@smarttherapyltd.com
Last updated: 22 September 2026.