Last updated: 17 June 2026
1. Who We AreController: Szabina T. Wagner, sole trader trading as CBT Sound Therapy Address: 36 Guernsey Close, Popley, Basingstoke, RG24 9PS, United Kingdom Email: info@cbtsoundtherapy.com ICO Registration Number: ZB353017Professional membership: British Association for Counselling and Psychotherapy (BACP), membership no. 393111
2. About This PolicyThis Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website (www.cbtsoundtherapy.com) or engage with our therapy services.
We are committed to handling your personal data lawfully, fairly, and transparently, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). We are registered with the Information Commissioner's Office (ICO) under registration number ZB353017.
This policy applies to:
- visitors to our website;
- individuals who complete our triage quiz, contact form, or any other enquiry form;
- clients who receive therapy from us.
Our services are intended for adults aged 18 and over. We do not knowingly collect or process personal data from anyone under the age of 18. If you believe we have inadvertently received data from a minor, please contact us immediately so that we can delete it.
3. The Personal Data We CollectWebsite visitors and enquiries
Depending on how you interact with our website, we may collect:
- Identity and contact data: your name and email address, for example when you complete our triage quiz, contact form, or newsletter sign-up.
- Health information: details you choose to share about your symptoms or conditions, such as tinnitus, misophonia, or hyperacusis. This is special category (health) data and is subject to additional protections — see Section 4 below.
- Technical and usage data: information about your device, browser, and how you use our website, collected through cookies and analytics tools where you give your consent — see Section 9 below.
- Communications: the content of any messages you send us.
Therapy clients (in addition to the above)
- Booking data: your name and appointment time.
- Clinical records: therapy notes, session records, assessment information, and progress notes created during our therapeutic relationship.
- Online session data: where sessions take place via Google Meet, your participation in the video call involves data processing by Google. Sessions are never recorded.
Health information is classified as special category data under Article 9 of the UK GDPR and is treated with the highest degree of care and confidentiality.
We process your health data on the following bases, depending on the stage of our relationship:
Before therapy begins — website enquiries and triage quiz Where you share health information through our website (for example, via the triage quiz or contact form), we rely on your explicit consent under Article 9(2)(a) UK GDPR. You will be asked to tick a specific, separate consent box before submitting any health information. This consent is freely given, specific, informed, and unambiguous — distinct from any general acceptance of our Terms. You may withdraw it at any time.
During the provision of therapy Where we process health information as part of delivering our therapy services, we rely on health or social care purposes under Article 9(2)(h) UK GDPR, read together with the Schedule 1, paragraph 2 condition of the Data Protection Act 2018. This applies to the provision of health or social care treatment by a practitioner subject to a professional obligation of confidentiality. As a BACP-registered practitioner, Szabina T. Wagner is bound by such an obligation.
Where appropriate, we rely on both bases simultaneously.
Withdrawal of consent does not affect the lawfulness of any processing carried out before that withdrawal. Please note that we may be required to continue holding certain clinical records after consent is withdrawn, in order to fulfil our professional and legal obligations — see Section 10 on data retention.
5. How We Use Your Data and Our Lawful BasesPurposePersonal data usedLawful basis
Responding to enquiries
Name, email, any health information shared
Art. 6(1)(b) (pre-contractual steps); Art. 9(2)(a) (explicit consent) for health data
Triage and initial assessment
Health symptoms submitted via quiz or contact form
Art. 6(1)(b); Art. 9(2)(a) (explicit consent)
Providing CBT Sound Therapy sessions
Name, clinical records, booking data
Art. 6(1)(b) (performance of contract); Art. 9(2)(h) and DPA 2018 Sch. 1, para. 2
Managing appointments
Name, appointment time
Art. 6(1)(b)
Maintaining clinical records and meeting professional obligations
Clinical notes and therapy records
Art. 6(1)(c) (legal obligation); Art. 9(2)(h); DPA 2018 Sch. 1, para. 2
Sending marketing emails (opt-in subscribers only)
Name, email address
Art. 6(1)(a) (consent)
Operating and securing our website
Technical data
Art. 6(1)(f) (legitimate interests)
Website analytics (with your consent only)
Technical and usage data
Art. 6(1)(a) (consent)
Legitimate interests: where we rely on legitimate interests as our lawful basis, we have assessed that our interest in operating and securing our website does not override your rights or freedoms, given the minimal privacy impact of that processing.
6. Clinical SupervisionAs required by the BACP Ethical Framework for the Counselling Professions, we engage in regular clinical supervision. Supervision may involve discussing clinical cases with a qualified supervisor. Where this occurs, information is shared in anonymised or pseudonymised form wherever possible. Full details of how clinical supervision may involve your personal data are set out in the therapy consent form provided to you before your first session.
7. Service Providers (Data Processors)We use the following trusted third-party service providers. Each processes your data only on our behalf and under our instructions, subject to written data processing agreements:
ProviderPurposeData processedStorage location
Vercel
Website hosting, content management system, and privacy-friendly cookieless analytics
Name and email (from form submissions); technical and performance data
United Kingdom (London)
Neon
Database storage for quiz and form submissions
Name, email address
United Kingdom (London)
MailerLite
Email marketing for opt-in subscribers only. No health data is stored here.
Name, email address, email engagement data (opens and link clicks)
European Union
cal.eu
Appointment scheduling
Name, appointment time
European Union
Google Meet
Conducting online therapy sessions
Video and audio data during the session. Sessions are never recorded.
United States — see Section 8
Cookiebot (Usercentrics)
Consent management platform — presents the cookie banner, records your consent choices, and communicates those choices to other tools on this website
Your consent preferences, approximate country, date and time of consent
European Union
Google Tag Manager
Tag management — controls whether and when analytics scripts are permitted to load on your device, based on consent signals received from Cookiebot
No personal data collected directly; acts as a conditional loader for other tags
United States — see Section 8
Google Analytics 4 (GA4)
Website analytics — used to understand how visitors use our website in aggregate. GA4 only loads after you have given explicit consent via our cookie banner.
Technical and usage data (pages visited, session duration, device type, approximate location) — with consent only
United States — see Section 8
NordLocker (Nord Security)
Encrypted cloud storage for clinical notes and therapy records
Clinical records stored in end-to-end encrypted form. NordLocker has no technical ability to access or read the content of your files.
European Union / United States — see Section 8
8. International Data TransfersThe majority of our service providers store data within the United Kingdom or the European Union.
Transfers to the European Union are lawful under The Data Protection (Adequacy) (European Union) Regulations 2021 (SI 2021/1087), which recognise the EU as providing a level of data protection equivalent to UK law. No additional safeguards are required for these transfers.
Transfers to the United States are protected as follows:
- Google (Meet, Tag Manager, and Analytics 4): we rely on Google's UK Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner's Office, as the lawful transfer mechanism for data processed on Google's US infrastructure.
- NordLocker (Nord Security): we rely on Nord Security's International Data Transfer Agreement (IDTA) arrangements. As an additional and significant protective measure, all clinical records are end-to-end encrypted on our own device before upload, meaning NordLocker has no technical capability to access or read the content of those files at any location, including in the United States.
Our website uses cookies and similar technologies. Our approach is as follows:
Strictly necessary cookies are always active. These are essential to the basic functioning of our website and cannot be switched off. They do not collect information used for marketing or tracking purposes.
Analytics cookies (Google Analytics 4) are used to collect aggregated, anonymised information about how visitors interact with our website, including pages visited, session duration, and device type. Google Analytics 4 applies IP anonymisation by default. These cookies are only placed on your device and only data is transmitted to Google after you have actively given your consent via our cookie banner.
How consent is managed: our cookie banner is operated by Cookiebot, a consent management platform. When you first visit our website, you are presented with a cookie preference panel. Until you give consent, Google Tag Manager is configured with Google Consent Mode set to denied by default — meaning no Google analytics scripts execute, no Google cookies are placed on your device, and no data is sent to Google Analytics 4. Your consent choice is recorded by Cookiebot and respected on all future visits.
Vercel Web Analytics is used for basic performance monitoring. This tool is entirely cookieless, collects no personal data, and does not track you across other websites or devices.
You may change or withdraw your cookie consent at any time by clicking the Cookie Settings link in the footer of our website. Withdrawing consent will stop further analytics data collection; it does not affect any data collected prior to withdrawal.
10. How Long We Keep Your DataData categoryRetention period
Clinical and therapy records
7 years from the date of your last session, in accordance with BACP record-keeping guidance
Enquiries, triage quiz submissions, and non-converted leads
12 months from last contact, then securely and permanently deleted
Marketing subscribers (MailerLite)
Until you unsubscribe or withdraw consent; inactive subscribers are reviewed and deleted after 24 months of no engagement
Booking records (cal.eu)
Incorporated into your clinical record if therapy takes place; otherwise deleted after 12 months
11. Automated Decision-Making and ProfilingWe do not carry out any automated decision-making or profiling that produces legal or similarly significant effects in relation to you, as described in Article 22 of the UK GDPR. Whilst our triage quiz helps us to understand your needs, all decisions about the suitability of our services for you are made personally by Szabina T. Wagner.
12. Your RightsUnder UK data protection law, you have the following rights:
- Right of access — to request a copy of the personal data we hold about you (a Subject Access Request);
- Right to rectification — to ask us to correct any inaccurate or incomplete data;
- Right to erasure — to ask us to delete your data, subject to our legal and professional obligations to retain certain records;
- Right to restriction — to ask us to restrict our processing of your data in certain circumstances;
- Right to object — to object to processing carried out on the basis of our legitimate interests;
- Right to data portability — to receive a copy of data you have provided to us in a structured, commonly used, and machine-readable format;
- Right to withdraw consent — to withdraw consent at any time where our processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at info@cbtsoundtherapy.com. We will respond within one calendar month. There is no charge for making a request.
13. How to ComplainIf you have concerns about how we handle your personal data, please contact us in the first instance so that we can try to resolve the matter.
You also have the right to lodge a complaint directly with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection:
Website: ico.org.uk Telephone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Changes to This PolicyWe may update this Privacy Policy from time to time to reflect changes in our services, our use of technology, or applicable law. Any changes will be published on this page with a revised "last updated" date. We encourage you to review this policy periodically.
15. Contact UsSzabina T. Wagner — CBT Sound Therapy
36 Guernsey Close, Basingstoke, RG24 9PS, United Kingdom info@cbtsoundtherapy.com