Chalk Circle Therapy Counselling in Berlin and Online

Last updated: 15 June 2026

Who we are

Chalk Circle Therapy is a psychotherapy practice run by Patrick Renner. I am registered with the Information Commissioner's Office (ICO) under registration number ZA437914.

My practice website is https://chalkcircletherapy.org and my compliance page with all data protection documents is available at https://chalkcircletherapy.policydiary.co.uk.

What personal data we collect

I collect and process the following types of personal data:

Contact and identification data:

• Your name, address, telephone number, and email address
• Emergency contact details

Health and therapy-related data:

• Details of your presenting issues and reasons for seeking therapy
• Information about your mental and physical health history where relevant to our work
• Session notes recording our therapeutic work together
• Any assessments or outcome measures we use
• Details of any medications or other treatments you are receiving

Administrative data:

• Appointment dates and times
• Invoices and payment records
• Correspondence between us

Important: Your health and therapy information is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection because of its sensitive nature, and I take particular care in how I collect, store, and process it.

How we collect your data

I collect your personal data directly from you:

• When you first contact me to enquire about therapy (by email, telephone, or through my website)
• During our initial consultation and intake process
• Throughout our therapy sessions together
• Via email or telephone communication between sessions
• When you complete any forms, assessments, or questionnaires I provide

I do not collect personal data about you from third parties unless you specifically ask me to liaise with another professional (such as your GP) and provide your explicit consent.

Why we process your data — lawful basis

Under UK GDPR, I must have a valid legal reason (known as a "lawful basis") to process your personal data. Because your therapy records include health information, I need to satisfy two separate legal tests:

Article 6 basis (for all personal data):

I process your data under Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide you with psychotherapy services. I cannot fulfil that contract without collecting and processing certain information about you.

Article 9 basis (for special category health data):

I process your health and therapy data under Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care purposes) is also met. I am a registered psychotherapist subject to the duty of confidentiality required by the UK Council for Psychotherapy (UKCP) Code of Ethics and Professional Practice.

Professional obligations and CPD

I am required by the UK Council for Psychotherapy (UKCP) to attend regular clinical supervision. This is an essential part of maintaining safe and effective practice. I may discuss our therapeutic work with my supervisor to reflect on and improve the care I provide to you.

When I do so:

• Your name and any identifying details are not shared with my supervisor
• I use anonymised or pseudonymised case material only — this means I remove or change details that could identify you
• My supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is also bound by their own professional body's ethical framework

Supervision discussions are solely for the purpose of ensuring I provide you with the best possible care and meet my professional standards.

Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor — a trusted fellow therapist who has agreed to act on my behalf if I become suddenly unable to practise due to death, serious illness, or incapacity.

If this happens, my Clinical Executor will:

• Contact you to let you know I am no longer able to see you
• Offer to provide you with referral information for other therapists if appropriate
• Handle your records confidentially and in accordance with this privacy policy
• Ensure your records are either securely transferred to a new therapist of your choice (with your consent), retained securely for the remainder of the retention period, or securely destroyed — depending on your wishes and the circumstances

My Clinical Executor is bound by the same professional confidentiality obligations as I am. They will only access the minimum information necessary to contact you and manage your records appropriately.

Who we share your data with

I take the confidentiality of your data very seriously. In the normal course of our work together, I do not share your personal data with anyone without your explicit consent.

However, certain third parties may have limited access to specific data:

Clinical supervisor: As explained above, my supervisor may hear anonymised case material during supervision. They never receive your name or identifying details.

Bookkeeper: My external bookkeeper has access to invoice data only (your name, dates of sessions, and amounts paid) for the purpose of managing my accounts. They do not have access to any clinical information or session notes. My bookkeeper is bound by a confidentiality agreement.

Third-party digital services: I use the following third-party services which may process limited data:

• Google Analytics — to understand how visitors use my website
• Facebook Pixel — to measure the effectiveness of advertising
• WebHealer — my website hosting provider
• Zoom — for online therapy sessions where applicable

Each of these services operates under a data processing agreement. I can provide links to their privacy policies on request.

I never sell your personal data.

International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

• Google Analytics (Google LLC, USA)
• Facebook Pixel (Meta Platforms Inc, USA)
• Zoom (Zoom Video Communications Inc, USA)
• WebHealer (WebHealer Ltd, UK — no international transfer)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision, which is why these additional safeguards are necessary.

You can request a copy of the relevant transfer safeguards by contacting me.

How long we keep your data

I keep your data only for as long as necessary. The retention periods are:

After the applicable retention period ends, your records are securely destroyed. For digital records, this means secure deletion using methods that prevent data recovery.

Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed: You have the right to know how I collect and use your data. This privacy policy fulfils that right.

Right of access: You can ask me for a copy of the personal data I hold about you. This is sometimes called a "subject access request." Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.

Right to rectification: If any of your personal data is inaccurate or incomplete, you can ask me to correct it.

Right to erasure: In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I am required to keep records for professional or legal reasons, such as to meet insurance requirements or comply with the Limitation Act 1980.

Right to restrict processing: You can ask me to limit how I use your data in certain circumstances, for example if you dispute its accuracy.

Right to data portability: Where technically feasible, you can ask me to transfer your data to another service provider in a commonly used electronic format.

Right to object: You can object to processing based on legitimate interests. I will stop unless I can demonstrate compelling legitimate grounds.

Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing. I do not use automated decision-making in my practice.

To exercise any of these rights, please contact me at: patrick.renner [at] mac.com

I will respond to your request within one month. There is no fee for most requests, although I may charge a reasonable fee if a request is manifestly unfounded or excessive.

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. If you are unhappy with how I have handled your personal data, please let me know and I will do my best to resolve the issue.

To make a complaint:

• Visit https://chalkcircletherapy.policydiary.co.uk and use the "Make a complaint" tab
• Or email me at: patrick.renner [at] mac.com

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are limited circumstances where I may need to share information without your consent:

• Risk of serious harm: If I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep people safe.
• Safeguarding concerns: If I become aware of concerns about a child or vulnerable adult being harmed or at risk of harm, I have a duty to report this to the appropriate authorities.
• Legal requirement: If I receive a court order requiring me to disclose information, I am legally obliged to comply.

I will always try to discuss any disclosure with you first, unless doing so would itself put someone at risk. Where possible, I will let you know what information I need to share and why.

Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make changes that affect how I handle your data, I will inform you directly.

The current version of this policy is always available at https://chalkcircletherapy.policydiary.co.uk.