1. Who we are and the scope of this notice

LTAS Therapy ("LTAS", "we", "our") provides psychosexual and relationship therapy, consultations, professional and educational services, and relationship resources and experiences. This notice explains how we handle personal information when you contact us, use our website, book or receive services, purchase or access resources, participate in activities, or otherwise communicate with us.

The data controller is Pathos Therapy Ltd, trading as LTAS Therapy. Contact: info@ltas.uk; postal address: Rectory Avenue, Rochford, Essex, United Kingdom. Where another organisation independently determines how it uses information, it is responsible for its own privacy notice. Clinical agreements, service terms and other notices may provide additional detail but do not replace this notice.

2. Information we may collect

Depending on how you interact with us, we may process your name, contact details, enquiry and correspondence history, appointment and booking details, invoices, payment status, transaction references, professional or referral details, and preferences about how we contact you.

Where you use therapy or consultation services, information may include assessment and referral details, relevant medical and personal history, relationship and sexual wellbeing information, session notes, therapeutic correspondence, safeguarding concerns and information you choose to share. Where you use educational resources or guided experiences, information may include your selections, written reflections, progress, results, invitations and material you choose to share with another participant.

We may also receive limited technical information needed for website operation, security and usage measurement, such as device and browser information, IP address, security logs and cookie preferences. We may receive information from a referrer, healthcare professional, partner or other person where appropriate and lawful. Please avoid submitting unnecessary information about other identifiable people.

3. Special Category Personal Data and Conditions for Processing

LTAS Therapy is the trading name of Pathos Therapy Ltd. In providing psychosexual and relationship therapy, consultations, educational resources and related services, we may collect and process information classified as special category personal data under Article 9 of the UK General Data Protection Regulation (UK GDPR).

This may include information about an individual's physical or mental health, sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, and other information falling within the categories protected by Article 9.

We recognise that this information requires additional protection. Where we process special category personal data, we identify an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9. Where applicable, we also comply with the additional requirements of the Data Protection Act 2018.

1. Health or Social Care: Article 9(2)(h)
Where processing is necessary for the provision of qualifying health care or treatment, including relevant clinical assessment, psychosexual and relationship therapy, clinical records and associated professional activities, we may rely on Article 9(2)(h) of the UK GDPR.

This condition is supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 and is subject to the professional confidentiality requirements of Article 9(3) of the UK GDPR and section 11(1) of the Data Protection Act 2018.

We restrict access to clinical information and maintain appropriate confidentiality, security and professional safeguards.

2. Explicit Consent: Article 9(2)(a)
For certain voluntary services, including self-guided educational or reflective activities that involve the collection of sensitive personal information outside qualifying clinical treatment, we may rely on explicit consent under Article 9(2)(a) of the UK GDPR.

Where explicit consent is required, we explain the purpose of processing, obtain a clear affirmative indication of consent and maintain an appropriate record. Individuals may withdraw consent at any time, although withdrawal does not affect processing lawfully undertaken before withdrawal.

3. Safeguarding and Substantial Public Interest: Article 9(2)(g)
In limited circumstances, we may process or disclose special category personal data where necessary to safeguard children or individuals at risk from neglect or physical, mental or emotional harm, where the requirements of Article 9(2)(g) and Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018 are satisfied.

Where applicable, confidential counselling, advice or support may also fall within Schedule 1, Part 2, paragraph 17, where processing without consent is necessary for reasons of substantial public interest and the specific statutory requirements are met.

Where we rely on either of these substantial public interest conditions, we maintain the required Appropriate Policy Document, including our data protection safeguards and retention and deletion procedures.

4. Legal Claims: Article 9(2)(f)
Where necessary for the establishment, exercise or defence of legal claims, we may process relevant special category personal data under Article 9(2)(f) of the UK GDPR.

5. Our Data Protection Safeguards
We apply appropriate technical and organisational measures to protect sensitive personal information, including restricted access, confidentiality obligations, secure storage, data minimisation and proportionate retention.

We do not assume that a single Article 9 condition applies to every service. The relevant lawful basis and special category condition are determined according to the purpose and circumstances of processing.

We maintain internal records of our processing activities, applicable lawful bases, special category conditions and relevant safeguards. We review these arrangements as our services and legal obligations change.

Where personal information is shared with another professional, organisation or service provider, we do so only where an appropriate legal basis exists and relevant confidentiality and data protection requirements are satisfied.

4. Why we use personal information and our lawful bases

We use personal information only for identified purposes and where a lawful basis applies. Depending on the activity, these may include:

• Responding to enquiries, arranging appointments and delivering services or purchased resources: performance of a contract or steps taken at your request before a contract (Article 6(1)(b)), where applicable.

• Maintaining appropriate clinical records, delivering professional care, safeguarding, managing disputes, protecting service security and administering our practice: legitimate interests (Article 6(1)(f)) where appropriate, or another applicable basis following assessment.

• Keeping legally required tax, accounting or other records and responding to binding legal duties: legal obligation (Article 6(1)(c)).

• Sending optional marketing messages where consent is required: consent (Article 6(1)(a)), alongside applicable electronic marketing rules.

We will not rely on consent merely because someone has agreed to therapy or accepted our terms. We will explain any different lawful basis that applies to a particular service. Where we rely on legitimate interests, we assess the impact on your rights and interests.

5. Therapy confidentiality and clinical records

We treat therapeutic information as confidential, subject to professional, ethical and legal exceptions. We may need to share proportionate information where there is a serious risk of harm, a safeguarding concern, a lawful requirement, or another justified reason explained in the therapy agreement or discussed with you where appropriate. We will normally discuss proposed sharing with you first when it is safe and practicable to do so.

We may, where appropriate, liaise with a GP, referrer or other healthcare professional to support your care. We will explain the purpose and seek your agreement where required, unless another lawful justification applies. Clinical supervision may involve discussion of case material for professional quality and safety, using minimisation and confidentiality safeguards.

Brief notes are stored in a password encrypted tablet with restricted access. Any electronic contact details, scheduling, messages, documents or records are protected by appropriate access and security controls. We do not promise that no third-party service provider processes information on our behalf.

We work in accordance with applicable professional and ethical standards, including those of COSRT and other relevant professional bodies where applicable. The separate client agreement provides more detail about confidentiality, records and the therapeutic relationship.

6. Other services, resources and joint participation

We may provide educational materials, questionnaires, guided conversations, workshops and other self-guided resources. Participation does not by itself create a therapist-client relationship or replace clinical advice. Where an experience allows two people to participate, each person's responses remain private unless that person actively chooses to share specific information. Paying for or inviting someone to an experience does not give access to their private answers.

We may record participation and operational information, such as an invitation being accepted, a resource being completed, purchase status, general referral source and optional feedback. We do not use private reflection answers for marketing or make them available to an administrator simply because the participant was personally invited. We may use anonymised or aggregated information to understand use of our services, provided individuals cannot reasonably be identified.

7. Payments, service communications and marketing

Where you purchase a service or resource, a payment provider may process your payment information under its own privacy terms. We receive the limited information necessary to confirm and administer the transaction, deal with refunds and maintain financial records; we do not need to store full payment card details.

We may send necessary service messages, including appointment information, invitations, sign-in messages, receipts, access information and notices about your account or service. These are different from optional marketing. Marketing messages are sent only where a valid legal basis and electronic marketing rules permit them. Where we ask for marketing consent, it is separate, optional and can be withdrawn at any time. We do not use clinical disclosures or private reflections to target advertising.

Where possible, sensitive results are made available through a secure access route rather than included in ordinary emails. You are responsible for protecting any copies you choose to download or share.

8. When we share information

We do not sell personal information. We may share only what is necessary with authorised personnel, professional supervisors, appropriately involved healthcare professionals, payment processors, website and technology providers, booking and communications services, accountants or professional advisers, regulators, public authorities or other recipients where there is a valid reason and lawful basis.

Providers acting on our instructions must be subject to appropriate contractual, confidentiality and security arrangements. Some providers act as independent controllers for their own purposes. We assess the arrangements that apply and do not share clinical or sensitive content with third parties for their own advertising purposes.

9. Security and international transfers

We take reasonable technical and organisational measures appropriate to the information and risks involved. These may include locked physical storage, access restrictions, authentication, secure transmission, backups, staff or contractor confidentiality, supplier checks and periodic review. No method of storage or communication can be guaranteed completely secure.

Some suppliers may store or access information outside the United Kingdom. Where UK data protection law requires safeguards for international transfers, we use an applicable adequacy arrangement or other lawful transfer mechanism and associated assessments where required.

10. How long we keep information

We keep personal information only for as long as necessary for the purposes described, taking account of professional record-keeping duties, legal requirements, limitation periods, safety and the nature of the service. Clinical records, enquiry correspondence, financial records, account details, saved reflections and privacy preference records may have different retention periods.

We securely delete or anonymise information when no longer needed, subject to lawful exceptions. Requests for deletion are considered individually and do not always override legal or professional retention obligations.

11. Your choices and data protection rights

Subject to the circumstances and applicable exemptions, you may ask for access to your personal information, correction of inaccurate information, erasure, restriction of processing, data portability, or object to certain processing. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Where we ask you to acknowledge a privacy notice or give consent, we may record the version of the notice or wording, your choice, date and time, and any later change or withdrawal. Acknowledging this notice is not the same as consenting to every use of information. Consent to processing is not consent to share personal reflections with another participant.

To exercise your rights, contact info@ltas.uk. We may ask for information needed to verify identity. We normally respond within one month, subject to any permitted extension. You may complain to the Information Commissioner's Office at www.ico.org.uk, although we welcome the chance to resolve your concern first.

12. Website cookies, analytics and external links

Our websites may use essential cookies or similar technologies for security, functionality and preferences. Where non-essential analytics or advertising technologies are used, we provide the information and choices required by applicable UK law before setting them. Links to third-party websites are governed by those providers' own notices. Please review them before providing personal information.

13. Children, automated processing and changes

All services and resources are intended for adults; where a service is suitable for children or young people, we apply appropriate consent, safeguarding and transparency arrangements. We do not use self-guided questionnaire results to make solely automated decisions that have legal or similarly significant effects on individuals. If we introduce materially different automated processing, we will assess and explain it before use.

We may update this notice as our services, suppliers or legal obligations change. The current version and effective date will be available on our website. We will give additional notice or request fresh consent when required by law.

14. Contact us

Data controller: Pathos Therapy Ltd, trading as LTAS Therapy

Privacy contact: info@ltas.uk

Postal address: Rectory Avenue, Rochford, Essex, United Kingdom

Website: www.ltas.uk

Notice version: 2.0  |  Effective: October 2026