Privacy policy

• General privacy information
  
• Information we collect and what we use it for
• Lawful processing of personal data
  
• Retention of data
• Recipients of personal data
• Security
  
• Your rights
• Cookies
• Cookies we use 

UKCP privacy notice

General

The UK Council for Psychotherapy (UKCP) is the leading organisation for the education, training, accreditation and regulation of psychotherapists and psychotherapeutic counsellors in the UK. We exist to promote and maintain high standards of the practice of psychotherapy and psychotherapeutic counselling for the benefit of the public throughout the United Kingdom.  UKCP is a charity registered in England and Wales (charity no. 1058545, company no. 3258939).

UKCP is registered as a data controller with the Information Commissioner’s Office (ICO). Registration number Z500659X.

If you have any questions regarding this policy, please contact our data protection lead using the following details:

• address: UK Council for Psychotherapy (UKCP), York House, 221 Pentonville Road, London N1 9UZ
• email: dataprotection@ukcp.org.uk.

We handle personal information in line with UK data protection law. This includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.

We may update this privacy policy from time to time. When we do, we will post the amended version on this page and change the date at the bottom.

UKCP is a membership organisation, a professional association and a regulator and we only collect the personal data required to carry out these functions.

This policy applies to personal information we collect about:

• visitors to our websites
• people who use our services, for example to book an event
• our members, including individual and organisational members
• people who make a complaint, or are the subject of a complaint, through our complaints and conduct process
• trustees, committee members and volunteers
• job applicants and current and former employees, workers and contractors
• suppliers and their staff
• anyone else who contacts us or sends us information.

Information we collect and what we use it for

Visitors to our websites

When you visit our website, we collect standard internet log information and details of how visitors use the site. This helps us understand things like how many people visit different parts of the site. We collect this information in a way that does not identify anyone, except when members log in to the members area.

We may use your personal information to monitor and improve our website.

Our website includes https://www.psychotherapy.org.uk and other subdomains we use to provide content and services to members, such as https://www.ukcp.org.uk and https://psychotherapy.my.site.com. The last of these gives access to the UKCP register, the list of trainee therapists and the members area, which includes our supervisors directory.

When you use our website, for example to book an event or send an enquiry, we may ask for information that can identify you, such as your name. We also collect your internet protocol (IP) address.

Search engine

We log search queries and results anonymously to help us improve our website and search. Neither UKCP nor any third party collects user-specific data from this.

People who use our online services

We offer various services to our members, volunteers and the public.

For the public, these include:

• find a therapist: a practitioner search on our website
• public surveys
• newsletters and email updates
• event booking
• our social media accounts on platforms such as Facebook, Instagram, LinkedIn and X.

For members, these include:

• the members area of our website
• the members forum
• member surveys
• newsletters and email updates
• event booking.

We run most of these services ourselves. Some surveys and event bookings may be partly hosted by third parties, such as Eventbrite or SurveyMonkey.

We only ask for personal information when the service needs it and we never ask for more than necessary. We only use your details to provide the service you asked for and for closely related purposes. If you book or sign up for one of our services, you can cancel in line with its terms and conditions.

When you pay online, we store details such as your name and address securely. Where we use a third-party processor, we have agreements with them to make sure your information is stored securely and in line with UK data protection law.

Promoting our events

We use speakers’ names and photos to promote our events. We usually ask speakers for these directly. Occasionally we use information from a speaker’s own website, but we always tell them before we use it. We keep this information afterwards for reference only, to help us see which ways of promoting events work best. 

People who telephone us

When we receive a call from or about a UKCP member, we may record the details of the call in the ‘activity history’ section of the member’s database record to help us administer their membership. 

We also store phone numbers and call times. On occasion we may record phone calls for training or monitoring purposes; if we do this, we will tell you before the call is recorded.

People who email us

We may monitor any email you send us, including attachments, for security reasons and to check compliance with our office policies. We may also use email monitoring or blocking software. The relevant teams keep your emails for as long as we need them, in line with the retention of data section below.

When we receive an email from or about a UKCP member, we may record its details in the ‘activity history’ section of the member’s database record. This helps us administer their membership.

Communications

We may use your personal information to send you newsletters and information about our work and events. You can unsubscribe at any time. Members can update their mailing preferences in the members area. If you’re not a member, email us at communications@ukcp.org.uk to be removed from our mailing list.

We take photos and film at our events for PR and marketing. At each event, we put up a notice explaining that filming or photography is taking place, with a contact person for anyone who doesn’t want to be filmed or photographed.

When we feature someone in more detail, for example in a blog or magazine article, we explain how we will use their words and images and confirm their consent before publishing. If they later decide they don’t want their image used during the two-year consent period, they can contact us and we will remove it from our library.

Complaints about UKCP

We take all complaints about UKCP seriously. We only use the personal information you give us to deal with your complaint and to check the quality of our service. Find out how to make a complaint about UKCP.

Complaints about our members

We have a strict complaints and conduct process. To deal with a complaint, we need certain details, which usually include personal information. This may include special category data, such as health information. Find out how to make a complaint about a UKCP member.

We process this information as part of our regulatory role. We may need to keep and use it even if the complaint is withdrawn, for example if we decide an investigation is needed to protect the public. We keep this information secure and only people who need it can access it.

We usually have to share the complainant’s identity with the member concerned. We will always tell the complainant before we do this. If they object, we will consider whether we still need to share it, in fairness to the member being investigated. In some cases, we can accept anonymous complaints.

We never publish the names of complainants. If a complaint is upheld, we publish certain details about the member in line with our publication of decisions policy. Members know before they register that they are subject to our complaints and conduct process and related policies.

To avoid duplicate complaints being made to different regulatory bodies, we may share information about complaints with other bodies. These include the British Association for Counselling and Psychotherapy (BACP) and the British Psychoanalytic Council (BPC). We send these bodies a link to our decisions and hearings page, which shows the registrant’s name and the adjudication panel’s decision. If they ask for more information, we will only share it for their regulatory work.

Membership information

When you apply for membership, we ask for certain information so we can process your application and create your record on our database. This includes:

• name
• home address (kept confidential and for internal use only)
• work address (for full clinical members, this may appear on our Find a Therapist tool)
• telephone number
• personal and work email addresses
• organisational membership details
• course details (for student and trainee members)
• any criminal convictions or ongoing complaints (see the special category data section below)
• date of birth
• indemnity insurance details
• gender
• other diversity information, such as disability or ethnicity (see the special category data section below).

If you choose to be listed in our supervisors directory, members can see your name and contact details in the members area.

Each year we send membership renewal notices. If you choose automatic renewal, our payment provider securely stores your card details so we can take your annual payment. Direct Debit payments are also processed by our payment provider. We may also contact your organisational member to confirm you are still a member and that your contact details are up to date.

As a regulator, we need to make sure our registrants meet our standards. Each year we audit a random sample of 3 per cent of our full clinical members. We ask them for their:

• name
• organisational membership details
• membership number
• supervision details, including their supervisor’s name, contact details and UKCP membership information.

We process this information in line with our registrant sample audit policy. We record the results on the registrant’s database record and destroy any paper or electronic copies within one year of completing the audit report.

We collect this information to carry out our membership and regulatory functions.

Volunteers

We may use the personal information we collect from you to:

• process volunteer applications, communicate with you and assess your suitability for the role
• administer all aspects of your volunteering role
• administer your volunteer records
• support you in your volunteering with UKCP
• match your skills and expertise with volunteering and development opportunities
• analyse volunteer involvement and engagement
• improve our volunteering services and processes, for example by asking for your feedback
• process bank details for expense claims.

We may also collect diversity information, such as disability or ethnicity (see the special category data section below).

Organisational members

We list each organisational member’s contact details on our website. The organisation chooses what we show. This can be general contact details or the name and work contact details of a named person.

We may also hold details of other named contacts at the organisation, if they would like to receive our emails and updates for organisational members. We collect this information when an organisation applies to join and update it at each five-yearly review or whenever the organisation tells us about a change.

We use this information to:

• let members and the public know how to contact the organisation
• contact the organisation about its five-yearly review
• contact the organisation about any membership queries
• send updates and information to organisational members.

Job applicants, employees, workers and contractors

Our separate HR privacy notice explains how we use the personal information of job applicants and current and former employees, workers and contractors. To request a copy, email hr@ukcp.org.uk.

Committee members and trustees

When someone takes up a trustee or committee member position, we use the information they provide to process their appointment and support them in their role.

We may collect, store and use:

• contact details, such as name, title, address, telephone numbers and personal email address
• photos and recordings
• date of birth
• gender
• bank details for paying expenses
• start date and term of appointment
• appointment information, including CV, references, academic qualifications, declarations of interest and checks such as the bankruptcy and disqualified directors registers
• records of their role, such as role description, training records and professional memberships
• information about their use of our information and communications systems.

We may also collect more sensitive information, including health information, criminal convictions and diversity information such as disability or ethnicity (see the special category data section below).

We share bank details with a third party that processes expense payments.

We keep personal information about unsuccessful candidates for up to three months after the appointment process ends, then securely delete it. We may use anonymised information about candidates to improve our future recruitment.

Special category data

Some of the information we hold is more sensitive. The law calls this ‘special category data’. It includes information about health, ethnicity, sexual orientation and disability. We also hold information about criminal convictions, which has similar protections.

We may process this information:

• about our members, such as criminal convictions, to uphold high standards in the profession and protect the public
• about complainants and members involved in a complaint, such as health information or sexual orientation, where we need it to deal with the complaint
• about employees, such as health information, where we need it for their employment 
• about volunteers, with their consent
• for equality and diversity monitoring.

We only process this information where the law allows, for example with your explicit consent, to meet our regulatory responsibilities or to monitor equality of opportunity.

We collect diversity information, such as disability or ethnicity, to understand the make-up of the profession and the people we work with. This helps us design fair and inclusive services and policies and spot any gaps. You don’t have to give us this information, and choosing not to will not affect your application or membership.

We take particular care of this information. We use appropriate security measures and only people who need it can access it.

Lawful processing of personal data

We only process your personal data where we have a lawful basis to do so under Article 6 of the UK GDPR. We rely on consent, contract, legal obligation and legitimate interests.

Consent – When you join UKCP, we ask whether you would like to receive news about our work, events and the profession, including information from other organisations that we think may interest you. We send this information ourselves and never pass your contact details to other organisations for marketing. You can withdraw your consent at any time by updating your mailing preferences in the members area. You will then only receive essential information about your membership.

Contract – We need to process our members’ personal data to meet our obligations to them. For example, we check qualifications to confirm eligibility for membership, and we let members know about elections to the Board of Trustees. When you book a paid event, or a free members’ event, we process your details to manage your booking.

Legal obligation – We process some personal data because the law requires us to, for example to meet our tax, accounting and employment obligations.

Legitimate interests – We may process personal data where it is necessary for our legitimate interests as an organisation, as long as this does not override your rights and freedoms. For example:

• to carry out our regulatory and public protection work, such as dealing with complaints about our members, which may include personal data of people who are not members
• to run and improve our services, such as Find a Therapist, our website and the members area
• to send members information about courses or events we think may interest them, as this promotes the profession and our charitable aims.

When we deal with complaints, a member may face an adverse decision. We consider that our interest in maintaining high standards and protecting the public outweighs this.

You can change your preferences about receiving information from us at any time in the members area or by contacting us.

Transfers outside the UK

Some of the organisations that provide services to us, such as cloud storage, survey and event booking providers, may store or access personal data outside the UK. When this happens, we make sure your information is protected to a standard that is not materially lower than in the UK. We use at least one of these safeguards:

• transferring data only to countries the UK government has approved as providing adequate protection, including the European Economic Area (EEA)
• transferring data to US organisations certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge)
• using contracts approved for UK transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

When we rely on contracts, we first assess whether the receiving country's protections are adequate. For more information about how we protect your data when it is transferred outside the UK, email dataprotection@ukcp.org.uk.

Retention of data

We only keep personal information for as long as we need it for the purposes we collected it for, including to meet any legal, accounting or reporting requirements. When we no longer need it, we securely delete or destroy it.

To decide how long to keep information, we consider:

• how much information there is, what it is and how sensitive it is
• the risk of harm if it were used or shared without permission
• why we hold it and whether we could achieve that another way
• any legal requirements.

Our complaints and conduct retention policy explains how long we keep information relating to complaints about our members. For details of how long we keep other types of information, email dataprotection@ukcp.org.uk.

Recipients of personal data

As well as the organisations mentioned elsewhere in this policy, we may sometimes need to share personal data with:

• current, past or future employers, for example when responding to a reference request
• healthcare, social care and welfare professionals
• education, training and accrediting organisations and examining bodies
• suppliers who provide goods and services to us, such as the mailing house for our membership renewal reminder letters and magazine
• people making an enquiry or complaint, for example to an organisational member or another regulatory body
• the police, for example if a criminal investigation involves one of our registrants
• government departments
• voluntary and charitable organisations
• ombudsmen and regulatory authorities.

We only share personal data where we have a lawful basis to do so and only share what is necessary.

Security

We keep your personal information confidential and store it securely. We control who can access it, and only people who need it can see it.

We only share your information where necessary, and only when we are satisfied the other organisation is entitled to receive it and will keep it secure.

We take the security of your personal information seriously. However, no method of sending or storing information online is completely secure.

Other websites

If you follow a link from our website to another website, this policy no longer applies. We recommend reading the privacy policy of any website you visit.

Your rights

Under data protection law, you have rights over the personal information we hold about you. To use any of these rights, email dataprotection@ukcp.org.uk or write to our data protection lead at the address at the top of this page. We will usually respond within one month of receipt. 

Access – You can ask for a copy of the personal information we hold about you (known as a ‘subject access request’) and check we are using it lawfully.

Correction – You can ask us to correct information that is incomplete or inaccurate. We may need to check the accuracy of the new information you give us.

Erasure – You can ask us to delete your personal information where there is no good reason for us to keep it. This includes where you have successfully objected to us using it, where we may have used it unlawfully or where the law requires us to delete it. We may not always be able to agree, for example because of our regulatory responsibilities. If so, we will explain why.

Objection – Where we rely on legitimate interests, you can object to us using your personal information if you have reasons relating to your situation. We will stop unless we have compelling legitimate grounds to continue, such as our role in protecting the public. You can also object to direct marketing at any time.

Restriction – You can ask us to pause using your personal information:

• if you want us to check it is accurate
• if our use of it is unlawful but you don’t want us to delete it
• if you need us to keep it to establish, exercise or defend legal claims, even though we no longer need it
• if you have objected and we are checking whether we have overriding legitimate grounds to use it.

Data portability – If we hold your information electronically and use it based on your consent or a contract, you can ask us to send it to you, or to another organisation, in a format that is easy to reuse.

Automated decisions – Some of our processes are automated. For example, your membership may lapse automatically if you do not complete your renewal. We will let you know if this happens. If you disagree with a decision made this way, you can ask for a member of staff to review it, share your views or challenge the decision by emailing dataprotection@ukcp.org.uk.

Withdrawing consent – Where we rely on your consent, you can withdraw it at any time. This won’t affect anything we did before you withdrew it. If you withdraw consent, we may not be able to provide some services and we will tell you if this is the case.

How to complain

If you’re unhappy with how we’ve used your personal information, you can complain to us. Email dataprotection@ukcp.org.uk or follow our complaints about UKCP policy and procedure. We will acknowledge your complaint within 30 days of receipt, look into it without undue delay and let you know the outcome.

If you’re still not satisfied, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

Cookies

Like many websites, we use cookies. A cookie is a small amount of data sent to your browser from a website and stored on your device.

With your consent, we use cookies for analytics, marketing and to improve your experience. Cookies help us understand how visitors use our site so we can keep improving it. They also enable features like saving therapists to your shortlist when using our Find a Therapist tool.

We don't use cookies to directly identify you. However, some analytics and marketing tools use online identifiers that may be considered personal data under data protection law.

You can manage your cookie preferences through the cookie banner when you first visit our site, and change them at any time through the banner.

You can also control cookies through your browser settings, including blocking all cookies. Note that blocking cookies may affect how parts of our site work.

Some cookies and local storage entries on our website are set by embedded third-party content, including Vimeo video players. These services may process data on servers outside the UK and EEA. In some cases, the provider does not disclose the exact destination. We recommend reviewing Vimeo's privacy policy directly at vimeo.com/legal/privacy/policy.

Some cookies on our website, including __cf_bm and _cfuvid, are provided by Cloudflare, which delivers content and security services for us. Cloudflare may process data in the United States and Europe, and relies on the UK’s International Data Transfer Addendum, together with the EU Standard Contractual Clauses, when data is transferred outside the UK and EEA. Find out more in Cloudflare's Data Processing Addendum at cloudflare.com/cloudflare-customer-dpa/.

For more guidance on controlling cookies, visit aboutcookies.org.

Cookies we use

We aim to keep this notice under review to reflect changes to law or practice.

Updated: October 2026