Website Privacy & Cookie Policy
Last updated: 28 July 2026
Introduction
Welcome to Lucy Russell's privacy policy. I respect your privacy and am committed to protecting your personal data. This privacy policy will inform you as to how I look after your personal data when you visit my website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.
Important information and who I am
Purpose of this privacy policy
This privacy policy aims to give you information on how I collect and process your personal data through your use of this website, including any data you may provide when you enquire about or book a service.
This website is not intended for children and I do not knowingly collect data relating to children.
Please note that by accessing or using my website, you will also be bound by the Website Terms of Use at www.lucy-russell.com/website-terms, and if you book my services, you must also comply with the Terms and Conditions for Supply of Services at www.lucy-russell.com/terms-of-service.
Controller
I am the controller and responsible for your personal data (referred to as "I", "me" or "my" in this privacy policy).
Name: Lucy Russell
Location: London, England
Email: enquire@lucy-russell.com
I am based in London, England, and work with clients globally, primarily online via Zoom. On occasion I offer in-person appointments by individual arrangement only.
Contact details
If you have any questions about this privacy policy or my privacy practices, please contact me at enquire@lucy-russell.com. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO) at www.ico.org.uk. I would appreciate the chance to deal with your concerns before you approach the ICO so please contact me in the first instance.
Changes to the privacy policy
I keep my privacy policy under regular review. This version was last updated on 28 July 2026. It is important that the personal data I hold about you is accurate and current. Please keep me informed if your personal data changes during your relationship with me.
Third-party links
This website may include links to third-party websites, plug-ins and applications. I do not control these third-party websites and am not responsible for their privacy statements.
The data I collect about you
I may collect, use, store and transfer different kinds of personal data about you, grouped as follows:
Identity Data includes first name, maiden name, last name, marital status, title, date of birth, occupation and gender.
Lifestyle Data includes caffeine intake, alcohol consumption and exercise habits.
Contact Data includes billing address, email address and telephone numbers.
Location Data includes your country of residence, collected for service delivery purposes and in connection with my professional insurance obligations.
Medical Data includes medical history, current medication and GP contact information. This is special category data under UK GDPR and is processed only with your explicit consent for the purpose of providing therapeutic services.
Financial Data includes payment transaction data processed securely by my payment providers. Full card details are not stored by me.
Transaction Data includes details about payments to and from you and other details of services you have purchased from me.
Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access this website.
Usage Data includes information about how you use my website, products and services.
Marketing and Communications Data includes your preferences in receiving marketing from me and your communication preferences.
Special category data Where you provide information about your health, medical history, or presenting concerns as part of enquiring about or receiving my services, this constitutes special category personal data under Article 9 of UK GDPR. I process this data only with your explicit consent and solely for the purpose of providing therapeutic services to you. You have the right to withdraw your consent at any time, though this will not affect the lawfulness of processing carried out before withdrawal. Clinical records are retained in accordance with my professional insurance obligations, as set out in the Data Retention section below.
How is your personal data collected?
Direct interactions. You may give me your Identity, Contact, Medical and Financial Data by filling in forms or by corresponding with me by email or otherwise. This includes personal data you provide when you book appointments, complete intake and consent forms, or contact me.
Automated technologies. As you interact with my website, I will automatically collect Technical Data about your equipment, browsing actions and patterns via cookies and server logs.
Third parties. I receive personal data about you from analytics providers such as Google Analytics, and from payment providers such as Stripe Payments Europe Ltd and PayPal (Europe) S.à.r.l. et Cie S.C.A.
Practice management. Appointments and forms are currently managed through Acuity Scheduling. This system is in the process of being transitioned to Cliniko, a UK GDPR-compliant practice management platform. During and following this transition, all personal data including health information will be handled in accordance with UK GDPR requirements.
How I use your personal data
I will only use your personal data when the law allows me to, including where I need to perform a contract with you, for my legitimate interests, to comply with a legal obligation, or where you have given explicit consent for the processing of special category data. Purposes include registering you as a client, managing bookings and payments, delivering services, complying with professional and insurance obligations, and improving my website and services.
Disclosures of your personal data
I may share your personal data with service providers acting as processors who provide IT and system administration services. All third-party service providers are required to take appropriate security measures to protect your personal data and are not permitted to use it for their own purposes. I may also share personal data where required by law or to protect the safety of any person.
International transfers
I am based in London, England, and work with clients globally. Some of my service providers may process data outside the UK. Where data is transferred outside the UK, I ensure appropriate safeguards are in place in accordance with UK data protection law. Where you are based outside the UK, any personal data you provide to me will be transferred to and processed in the UK.
Data security
I have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. All third parties who process personal data on my behalf are subject to a duty of confidentiality.
Data retention
I will only retain your personal data for as long as reasonably necessary to fulfil the purposes I collected it for. Clinical records (including health information, session notes, intake forms and consent documents) are retained for a minimum of seven years following the date of the last session. Where treatment was provided to a client who was a minor at the time, records are retained for a minimum of seven years from the date that client turns eighteen. When your personal data is no longer required, I will delete or anonymise it securely.
Your legal rights
Under UK data protection law, you have the right to: request access to your personal data; request correction of any incomplete or inaccurate data; request erasure of your personal data; object to processing; request restriction of processing; request transfer of your personal data; and withdraw consent at any time where I am relying on consent. To exercise any of these rights, please contact me at enquire@lucy-russell.com. Note that some rights are subject to limitations, for example I may not be able to erase clinical records I am required to retain under professional insurance obligations.
Cookie Policy
My website uses cookies to distinguish you from other users and to improve my site. I use strictly necessary cookies (required for the operation of my website), analytical cookies (to recognise and count visitors), functionality cookies (to recognise returning visitors), and targeting cookies (to record visits and pages viewed).
I will ask for your permission to place non-essential cookies on your device. You can block cookies by activating the relevant setting on your browser, though this may affect some functionality. For further information on cookies, visit ico.org.uk/your-data-matters/online/cookies/ or contact me at enquire@lucy-russell.com.
Glossary
Legitimate Interest means the interest of my business in conducting and managing my business to enable me to give you the best service and most secure experience.
Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that I am subject to.
External Third Parties Service providers acting as processors who provide IT and system administration services, including Squarespace, Zoom, Acuity Scheduling, Stripe Payments Europe Ltd and PayPal (Europe) S.à.r.l. et Cie S.C.A. Appointments are currently managed through Acuity Scheduling, which is in the process of being replaced by Cliniko, a UK GDPR-compliant practice management platform.