Privacy Policy
Last updated: 16/06/2026
1. About this policy
This policy explains how I collect, use, store and protect your personal information, and the rights you have over it. It applies to visitors to this website, people who contact me, clients who go on to work with me, and anyone who signs up to my newsletter.
I am committed to handling your information carefully and transparently, and to meeting my obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who I am
Repattern Therapy is the online private practice of Roman Romeo, an integrative counsellor based in Leeds and working online across the UK. In this policy, "I", "me" and "my" refer to Repattern Therapy.
I am the data controller for the personal information described here, which means I am responsible for deciding how it is held and used.
Contact: RepatternPsychotherapy@gmail.com
3. The information I collect
Depending on how you interact with me, I may collect:
When you make an enquiry (via the contact form or email): your name, email address, phone number (if you choose to give it), and anything you write in your message.
If you become a client: your contact details; an emergency contact and/or GP details (only if we agree to this); brief notes about the work we do together; and any health or personal information you share that is relevant to your therapy.
If you sign up to my newsletter: your email address (only when you actively opt in).
When you use this website: limited technical and usage information collected by the website platform and any analytics tools (see Cookies and the website below).
Some of the information you share — particularly anything about your mental or physical health — is treated as special category data, which carries extra protection under data protection law.
4. How I collect your information
I collect most of your information directly from you — through the contact form, by email, and during our sessions. Some technical information is collected automatically when you use the website, through cookies and similar technologies.
5. How I use your information, and my lawful basis
Data protection law requires me to have a valid "lawful basis" for using your information. This section sets out what I use it for and why.
When you contact me with an enquiry, I use your information to respond to you and to arrange a consultation. My lawful basis for this is taking steps at your request before entering into a contract, together with my legitimate interest in responding to people who get in touch.
If you go on to work with me, I use your information to provide counselling and to keep appropriate records of our work. My lawful basis for this is the performance of our contract. Because therapy involves information about your health, which is given extra protection in law, I also rely on the condition that allows such information to be processed for the provision of health or social care or treatment (UK GDPR Article 9(2)(h)), and/or on your explicit consent.
If you opt in, I use your email address to send you my newsletter, along with any discounts and offers. My lawful basis for this is your consent, which you give by ticking the opt-in box and can withdraw at any time.
Finally, I use your information where necessary to meet my legal, regulatory and professional obligations — for example, responding to a complaint, cooperating with my insurer or professional body, or acting on a safeguarding concern. Depending on the situation, my lawful basis for this is a legal obligation, my legitimate interests, or — where there is a risk to life — the protection of someone's vital interests.
6. Confidentiality and its limits
What you share with me in therapy is treated as confidential. There are a small number of situations where I may need to share information without your consent, namely:
where there is a serious risk of harm to you or to another person;
where there is a safeguarding concern, particularly involving a child or a vulnerable adult; or
where I am required to do so by law (for example, a court order or certain statutory obligations).
I discuss confidentiality and its limits with every client at the start of our work. As part of good professional practice, I also discuss my casework in clinical supervision; where possible this is anonymised, and my supervisor is bound by the same confidentiality.
7. Who I share your information with
I do not sell your information, and I never share it for someone else's marketing.
I may share limited information with:
my clinical supervisor (anonymised wherever possible);
your GP or emergency contact — only with your agreement, or in an emergency where there is a risk to life;
my professional body or insurer — only where necessary, for example in connection with a complaint or claim;
8. Where your information is stored, and security
Your information is held securely, with access limited to me. Electronic records are protected with passwords and encryption where possible, and any paper notes are kept securely.
Some of my service providers (such as Google and Squarespace) may store or process information on servers outside the UK, including in the USA. Where information is transferred outside the UK, I rely on appropriate safeguards recognised under UK data protection law (such as UK adequacy regulations, standard contractual clauses, or the UK extension to the EU–US Data Privacy Framework).
9. How long I keep your information
I keep your information only for as long as I need it:
Enquiries that do not become therapy: kept for up to 6 months, then securely deleted.
Client records: kept for 7 years after the end of our work, in line with my professional indemnity insurer's and professional body's guidance. (Records relating to a child or young person are kept for longer — typically until they reach 25.)
Newsletter: kept until you unsubscribe.
10. Your rights
Under UK data protection law you have the right to:
be informed about how your information is used (this policy);
access a copy of the information I hold about you;
ask me to correct information that is inaccurate or incomplete;
ask me to erase your information (though I may need to keep some records to meet my legal and professional obligations);
ask me to restrict how I use your information;
request the transfer of your information (data portability);
object to certain uses of your information; and
withdraw consent at any time for anything based on your consent, such as the newsletter.
To exercise any of these rights, please contact me at RepatternPsychotherapy@gmail.com. I will respond within one month.
11. Marketing
I will only send you marketing emails (my newsletter, discounts and offers) if you have actively opted in by ticking the relevant box. Every marketing email includes an unsubscribe link, and you can opt out at any time. Opting in is entirely optional and is never required in order to contact me or work with me.
12. Cookies and the website
This website may use cookies — small files stored on your device — including essential cookies that help the site work and, where applicable, analytics cookies that help me understand how the site is used. You can control or delete cookies through your browser settings. [If you add a separate cookie policy or cookie banner, link or refer to it here.]
13. How to raise a concern or complain
If you have any concern about how I handle your information, please contact me first at RepatternPsychotherapy@gmail.com. I take any complaint seriously and will acknowledge it within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
14. Changes to this policy
I may update this policy from time to time. The "last updated" date at the top shows when it was last revised.
15. Contact
Roman Romeo, Repattern Therapy RepatternPsychotherapy@gmaill.com.