Rollswood Therapy - website privacy notice
Last updated: 29 September 2026
Who looks after your information
Rollswood Therapy respects your privacy. This notice explains how personal information is used when you visit this website, contact the practice, book appointments or receive therapy.
The controller responsible for this information is Lee Grant, operating as a sole trader under the name Rollswood Therapy.
Rollswood Therapy provides therapy only to adults aged 18 and over.
For privacy enquiries or to exercise your information rights, contact:
- Email: explore@rollswoodtherapy.com
- Telephone: 07785 716247
- Postal address: Rollswood Therapy, 10 Rollswood Road, Welwyn, Hertfordshire AL6 9TX, United Kingdom.
Enquiries through the website
The Contact page offers an Email Lee button and a displayed email address. The button opens your own email application with the practice address filled in. Your message is sent through your email provider to the practice's email service; it is not submitted through a Squarespace enquiry form.
Please include only the information needed for an initial enquiry. You do not need to describe your clinical history or provide detailed information about other people in your initial message.
Your enquiry is used to respond to you, discuss the support you are seeking and, where appropriate, arrange a consultation. Sending an enquiry does not subscribe you to a newsletter.
Lee Grant is the only person authorised within the practice to access enquiry emails. The practice mailbox is hosted by IONOS and accessed through Microsoft Outlook. Lee confirms that the practice mailbox and personal Gmail mailbox appear as two separate mailboxes in Outlook.
Enquiries that do not lead to therapy are deleted once this is clear. Lee permanently clears the Deleted Items folder at the end of each day, sometimes twice a day. Lee confirms that the practice retains no additional copies of deleted enquiries.
Why the practice may use your information
To respond to your request for therapy, arrange appointments and provide the agreed service, the practice uses information necessary to take steps at your request before a contract or to perform that contract (UK GDPR Article 6(1)(b)). This does not cover unrelated marketing or unnecessary information.
Where health information is necessary to assess or provide confidential therapy, the condition is Article 9(2)(h), together with the Data Protection Act 2018, Schedule 1 paragraph 2 and section 11. This concerns health care or treatment under a duty of confidentiality. It is separate from permission to use an optional AI tool.
Optional AI transcription and preparation of AI-assisted summaries rely on consent under Article 6(1)(a) and explicit consent for health information under Article 9(2)(a). You can decline or withdraw this consent and still receive therapy.
Necessary clinical record keeping has a separate purpose from optional AI processing. During therapy, records needed to provide the agreed care are processed on the contract and confidential-healthcare bases above. Where records are necessary to establish, exercise or defend legal claims, the bases are legitimate interests under Article 6(1)(f) and Article 9(2)(f). Only relevant, proportionate records are retained for this purpose. Your rights, the sensitivity of the information and the need for retention must be considered.
Records needed to comply with tax law are processed under Article 6(1)(c), legal obligation. Necessary website security and administration are legitimate interests under Article 6(1)(f), subject to a documented assessment of necessity and your rights.
Booking appointments
The booking links take you to the Rollswood Therapy client portal provided by Zanda. Information you enter there is handled through that booking service. The website enquiry option opens your email application; there is no native Squarespace enquiry form.
Zanda sends appointment reminders by email and text message, and invoice reminders by text message.
Zanda invoices include a payment link that takes clients to Stripe to pay by card. Direct bank transfer to the practice’s Starling Bank account is also available.
You can read Zanda’s privacy policy for information about its role and services. For questions about how Rollswood Therapy uses your booking information, contact the practice directly.
Zanda is the practice-management platform. Practice contracts are signed and held in Zanda, and Lee uses those contracts to establish whether a person proceeds to therapy. These contracts are not held in Squarespace. Upheal, Inc. is also used for AI-assisted client notes.
During client registration and completion of the general client information form, the practice collects full name, address, email address, mobile phone number, title, pronouns and GP surgery details. GP surgery details are optional. Clients may also choose to describe previous mental-health conditions and their reasons for seeking therapy on the general client information form. These history and reasons questions are optional; the reasons for seeking therapy can instead be discussed during an introductory call. This describes registration and client information, not a list of fields on the public appointment-booking screen.
Upheal’s recorder temporarily captures and processes session audio. Recording retention is switched off; the provider describes deleting audio after successful processing. Transcripts and notes are retained separately.
Upheal transcribes sessions, and Lee uses the transcription summaries to prepare clinical notes. Before transcription, clients receive an AI scribe consent form with their welcome email and are required to sign it. Clients may decline AI transcription and still receive therapy; Lee then prepares notes by another method. Therapy notes are kept from the beginning of therapy. Notes, transcripts and summaries are retained throughout therapy and for seven years from the end of your final therapy session with Rollswood Therapy, as confirmed by Lee. Longer retention may be necessary where a legal, insurance or claim-related preservation obligation applies.
Clients may withdraw consent to AI transcription. Future transcription then stops and Lee continues preparing notes by another method. Lee confirms that existing AI transcripts are deleted when consent is withdrawn, while note summaries are retained for seven years after the final therapy session. Withdrawal stops future optional AI processing and does not affect the lawfulness of processing before withdrawal. A summary is retained after withdrawal only insofar as it forms a necessary clinical record for the separate care or legal-claims purposes described above. This is not a blanket entitlement to keep all AI-generated material.
Lee is a registered BACP member (registration number 416268) practising under its Ethical Framework. Client work is discussed confidentially with a BACP-accredited clinical supervisor; identifying details are limited to first initials, gender and age. Clients are informed about supervision in their therapy agreement or privacy information. This information is not described as fully anonymous.
Monthly Musings
Monthly Musings is not currently accepting subscriptions through this website.
Cookies and website services
Squarespace hosts this website and processes technical information needed to deliver and secure its pages. Website fonts are served through the site rather than Google Fonts. The website does not use a Squarespace enquiry or newsletter form.
Use Accept all, Decline all or Manage cookies on the banner to choose optional cookies. You can change your choice at any time through Cookie Preferences. Necessary cookies remain enabled. Optional analytics and advertising cookies depend on your choices; Squarespace activity logging is disabled.
| Cookie | Purpose and documented duration |
|---|---|
| crumb | Helps prevent forged requests; session cookie. |
| Locked | Remembers access to a password-protected page; session cookie, relevant while password protection is enabled. |
| ss_performanceCookiesAllowed | Remembers your performance and analytics choice; 30 days. |
| ss_marketingCookiesAllowed | Remembers your advertising choice; 30 days. |
Durations are described in Squarespace’s cookie reference. Your browser may remove cookies sooner. Website media may also use local storage to remember player preferences.
Links to Facebook, Instagram and Zanda take you to separate services with their own privacy information.
Who receives information and where it is processed
The current website arrangements include Squarespace for hosting, the practice’s email service for enquiries, and a link to the public Zanda appointment-booking portal. Native enquiry and newsletter collection forms have been removed. The practice accepts card payments through Stripe and direct transfers to Starling Bank. Lee handles client invoices and payment administration. The practice’s accountant sees bank statements showing payments received from Stripe. Clinical information is not needed for this accounting purpose. Payment providers and banks still process information for their services, and lawful disclosures may apply. Upheal supports the preparation of clinical notes as described above.
Providers process information for the functions described here. Zanda Health Pty Ltd processes client information on the practice’s instructions and acts separately as controller for its own account administration. Upheal, Inc. provides AI-assisted documentation under its EU/UK processing agreement. Squarespace provides hosting, IONOS provides the practice mailbox and Microsoft Outlook is used to access it. Stripe and Starling also process information for their own payment, banking and legal obligations.
Provider information is available from Zanda, Upheal, Squarespace, Stripe and Starling.
Some providers and their subprocessors process information outside the UK. Their published arrangements include contractual safeguards for international transfers, such as standard contractual clauses and the UK Addendum where applicable. Processing is not described as exclusively UK-based. Contact Lee for information about safeguards relevant to your information.
Information may also be disclosed where required by law or where justified to address a safeguarding concern, with disclosure limited to what is necessary.
How long information is kept
UK GDPR does not prescribe a fixed retention period for psychotherapy or counselling records. Information is kept only for as long as necessary for its documented purpose and applicable obligations. The seven-year practice schedule takes account of the practice’s Balens insurance retention requirement. Retention must still be necessary for each type of record. A review and deletion process may be manual; the law does not require automation. No automated deletion is currently claimed. Clinical records need a separate justified schedule from enquiries that do not lead to therapy.
| Information | Retention |
|---|---|
| Enquiries that do not lead to therapy | Deleted as soon as it is clear the enquiry will not lead to therapy. Lee clears Deleted Items permanently at least at the end of each day. Lee confirms no additional practice-held copies. Provider backup copies may follow separate technical retention cycles. The website uses direct email rather than form submission. |
| Booking and client administration | Seven years after the client’s final therapy session, subject to applicable preservation obligations. Financial records are addressed separately below. Automated deletion has not yet been configured. |
| Invoices and payment records required for tax | The statutory minimum described below applies. |
| Newsletter subscriptions | Subscriptions are not currently collected through this website. |
| Technical and cookie information | Provider-specific durations and site settings |
| Therapy notes, transcripts and summaries | Kept throughout therapy, then seven years from the end of your final therapy session with Rollswood Therapy, subject to applicable preservation obligations. AI transcripts are deleted earlier if AI consent is withdrawn; note summaries remain subject to the stated schedule. Financial records have a separate schedule. |
Financial records
Invoices, payment records and related evidence needed for the practice’s sole-trader tax returns must be retained for at least five years after the 31 January submission deadline for the relevant tax year. Longer retention applies where required for an HMRC enquiry or another legal preservation obligation. GOV.UK specifies 15 months after submission for returns sent more than four years after their deadline; an ongoing enquiry can require longer preservation.
Your choices and rights
Depending on the circumstances and lawful basis, you may request access to your information, correction, deletion, restriction of use, transfer of certain information, or object to its use. Some rights are subject to exceptions. Where processing relies on consent, you may withdraw it.
Contact the practice using the details above. Reasonable information may be requested to verify your identity before disclosing personal information.
If you are concerned about how your information is handled, you can raise the concern with the practice. You also have the right to complain to the Information Commissioner’s Office. See the ICO’s information for the public and complaints guidance.
Changes to this notice
The notice will be updated when the practice’s arrangements change. The date above shows when this notice was last updated.