Privacy policy

Ben Richardson (trading as That Music Therapy Lot) is the Data Controller responsible for your personal data. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB610818.

This notice explains how personal data and special category (health) data are collected, used, stored, and shared in connection with process-based music therapy and related practice administration. It is designed to meet UK GDPR and Data Protection Act 2018 requirements.

1. Lawful bases for processing

Personal data is processed under the following UK GDPR bases:

Standard personal data (Article 6): processing is necessary for the performance of a contract (delivering the music therapy service you have requested); where applicable, for legitimate interests (running and safeguarding the practice in a proportionate way); and where required to meet a legal obligation.
Health / special category data (Article 9): processing is necessary for the purposes of preventive or occupational medicine, or for the provision of health or social care or treatment, under Article 9(2)(h) UK GDPR, with appropriate safeguards.

Where consent is required for a specific activity (for example certain optional recordings in person), that consent will be obtained separately and can be withdrawn where the law allows, without affecting the lawfulness of processing before withdrawal.

2. Confidentiality & safeguarding

Your sessions are confidential. Information disclosed within sessions remains between you and your practitioner. Confidentiality will only be broken in exceptional circumstances:

Where there is a legal obligation or a disclosure indicating a severe crime has been or will be committed.
Where there is a clear, demonstrable risk of serious harm to yourself or someone else.

Wherever legally and safely possible, your practitioner will discuss any necessary threshold breach with you before sharing information with external agencies. Further detail is in the Safeguarding & complaints policy.

3. Third-party communication & updates

While explicit details and exact quotes from therapy remain confidential, overarching updates regarding progress, attendance, or broad themes may need to be shared with key stakeholders. These third parties may include:

Parents or legal guardians (where applicable).
Commissioning bodies (for example Local Authorities, NHS, or educational institutions funding the intervention).
Social Care services (where relevant to active support plans).
Special Educational Needs & Disabilities (SEND) professionals (for example SENCos) as part of statutory input, such as Annual Reviews.

Your practitioner will seek your permission prior to sharing thematic updates with external parties, provided it is safe to do so.

4. Clinical notes & assessment documentation

Music therapy practice requires ongoing documentation.

Notes are typically recorded following a session rather than during it (unless explicitly stated otherwise).
Notes capture progress, key themes, and relevant clinical observations over time to ensure quality of care.

5. Audio & video recording policy

In-person sessions

Audio or video recording during in-person sessions may occasionally be requested for supervisory, reflective, or clinical monitoring purposes. The rationale will be fully explained, and recording will only take place with your explicit written consent.

Online sessions

To support safety and security for both client and practitioner, and to manage risks inherent to remote therapy, online sessions are routinely recorded via secure, encrypted platforms.

Recordings are stored securely in cloud infrastructure protected by multi-factor authentication (2FA).
Recordings are treated with the same confidentiality as clinical notes and will never be shared externally unless required by a severe safeguarding threshold.
You retain the right to request access to or copies of your recordings at any time.

6. Data retention & erasure schedule

Unless a specific custom erasure timeframe is agreed upon in writing, data is retained according to the following schedule:

Online recordings

If the client is under 25 at the time of therapy, recordings are permanently deleted upon their 25th birthday.
If the client is over 25 at the time of therapy, recordings are permanently deleted 7 years following the date of the session.

Clinical notes & written reports

Retained securely in accordance with professional indemnity insurance requirements and legal standards for clinical record-keeping (typically 7 years past the end of therapy for adults, or up to age 25/26 for minors).

7. Third-party processors (sub-processors)

To deliver music therapy and administer the practice, personal data may be processed by carefully selected service providers acting on our instructions. Categories of sub-processor include:

Encrypted cloud storage and backup providers.
Electronic health record / practice management software (for example booking, notes, and client administration tools such as Splose or equivalent).
Secure video platforms for online sessions (for example Zoom, Microsoft Teams, or equivalent).
Payment gateways and invoicing providers.
Website enquiry tools (for example form delivery services used by this website to forward messages to hello@thatmusictherapylot.uk).

Where practicable, data is stored within the United Kingdom or the European Economic Area. If a transfer outside the UK/EEA is required, it will only take place with appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) as required by UK data protection law.

8. Your rights

Under UK data protection law you have rights in relation to your personal data. These include:

Right to be informed — to be told clearly how your personal data is collected, used, shared, and stored. This privacy notice is the main way that right is met.
Right of access — you may submit a Subject Access Request (SAR) to view or receive a copy of your records at any time, without needing to state a reason. Requests will normally be fulfilled within one calendar month.
Right to rectification — to have inaccurate personal data corrected.
Right to erasure (“to be forgotten”) — to request deletion in certain circumstances. This right is limited where records must be retained for legal, regulatory, safeguarding, or professional indemnity reasons (including many clinical health records).
Right to restrict processing — to limit how we use your data in certain situations.
Right to data portability — to receive data you provided in a structured, commonly used, machine-readable format where processing is based on consent or contract and is carried out by automated means.
Right to object — to object to processing based on legitimate interests, where applicable.
Rights related to automated decision-making — we do not use solely automated decision-making that produces legal or similarly significant effects about you.

To exercise any of these rights, contact hello@thatmusictherapylot.uk.

9. Right to complain to the ICO

You have the right to lodge a complaint with the UK regulator, the Information Commissioner’s Office (ICO), if you are concerned about how your personal data is handled.

Website: ico.org.uk
Helpline: 0303 123 1113

Our ICO registration number is ZB610818.

10. Contact

For privacy questions or data rights requests, email hello@thatmusictherapylot.uk.