Privacy Policy
Door2Therapy Ltd, trading as DoorToTherapy / TerapiaDePaso
Last updated: 29 July 2026
1. Introduction
Door2Therapy Ltd ("we," "us," "our"), trading as DoorToTherapy / TerapiaDePaso, respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and safeguard your data when you access our online therapy services.
Data Controller:
- Name: Door2Therapy Ltd, trading as DoorToTherapy / TerapiaDePaso
- Address: 4th Floor Regent Street, London, W1B 4HB, United Kingdom
- Email: info@doortotherapy.com
- Website: doortotherapy.com
Professional Registration:
- UK: Health and Care Professions Council (HCPC) – Registration No: PYL040507
- Spain: Colegio Oficial de Psicólogos de Madrid – Registration No: M-25309
We comply with the General Data Protection Regulation (GDPR) and UK GDPR.
2. Information We Collect
Personal Information:
Name, date of birth, contact details, emergency contacts, GP/primary care clinician.
Health Information (Special Category Data):
Medical and mental health history, medications, session notes, assessments, treatment plans.
Technical Information:
IP address, device info, session logs.
Payment Information:
Billing address, payment details (Stripe primary, Revolut backup), invoice history (Xero).
3. Legal Basis for Processing
We process your data under the following legal bases:
- Contract performance (Article 6(1)(b) GDPR) - to provide therapy services
- Explicit consent (Article 9(2)(a) GDPR) - for processing health data
- Health/social care purposes (Article 9(2)(h) GDPR) - for clinical care
- Legal obligations (Article 6(1)(c) GDPR) - to comply with professional requirements
- EU Representative (Article 27 GDPR) - for EU clients
4. How We Use Your Information
- Provide therapy services and maintain clinical records
- Appointment scheduling and communication
- Process payments and manage invoicing
- Respond to emergencies and safeguarding concerns
- Comply with professional and legal requirements
5. Retention of Data
- Clinical records: Adults - 7 years after last contact; Minors - until age 25 or 7 years after last contact (whichever is longer)
- Administrative correspondence: 7 years
- Payment records: 6 years (tax compliance)
- Longer retention may occur if legally required (e.g., ongoing legal proceedings)
6. Who We Share Your Information With
With Your Consent:
- Referrals to other healthcare professionals
- GP reports and care coordination
- Family members (when you authorize this)
Legal/Regulatory Requirements:
- Safeguarding authorities (risk of harm)
- Court orders and legal proceedings
- Crime prevention and detection
- Professional regulators (HCPC, Colegio Oficial de Psicólogos)
Service Providers (Data Processors):
Carepatron
Clinical records, scheduling, and telehealth platform
Administrative communication only (no clinical content)
Zoom / Google Meets
Alternative/backup videoconferencing when Carepatron telehealth is unavailable
Stripe
Primary payment processing (GDPR and PCI-DSS compliant)
Revolut Business
Backup payment processing and business funds
Xero
Accounting and invoicing
7. International Data Transfers
All our service providers operate within the EU/EEA/UK or have appropriate GDPR-compliant data transfer mechanisms in place:
- Carepatron, Zoom, Google Meets, Stripe, Revolut, Xero: EU/EEA/UK servers with GDPR compliance
- WhatsApp: Used for administrative purposes only, no permanent storage of clinical data
8. Data Security
We implement robust security measures to protect your data:
- Encryption: All data encrypted in transit and at rest
- Two-Factor Authentication (2FA): Required for all systems
- Limited Access: Only authorized personnel can access your data
- Regular Backups: Secure, encrypted backups of all records
- End-to-End Encrypted Sessions: Video sessions use secure, encrypted connections
- Secure Payment Processing: PCI-DSS compliant payment systems
- Physical Security: Devices protected with passwords and encryption
9. Your Rights
Under GDPR and UK GDPR, you have the following rights:
Right of Access
Request copies of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion (subject to legal obligations)
Right to Restrict Processing
Limit how we use your data
Right to Data Portability
Receive your data in a portable format
Right to Withdraw Consent
Withdraw consent at any time
Right to Object
Object to certain types of processing
Right to Complain
Lodge a complaint with supervisory authorities
To exercise any of these rights, please contact us at: info@doortotherapy.com
10. Confidentiality Limits
We may break confidentiality without your consent in the following circumstances:
- Risk of serious harm to yourself or others
- Child or vulnerable adult safeguarding concerns
- Legal obligations (court orders, statutory requirements)
- Prevention or detection of serious crime
11. Clinical Supervision
Anonymous client data may be discussed in clinical supervision to ensure quality of care. All supervisors are bound by the same confidentiality standards. Identifying information is removed or pseudonyms are used.
13. Children and Young People
- UK: Clients aged 13+ can consent to therapy independently
- Spain/EU: Clients aged 16+ can consent independently
- Younger clients require parental/guardian consent
- Records for minors kept until age 25 or 7 years after last contact (whichever is longer)
14. Data Breaches
In the unlikely event of a data breach:
- We will notify supervisory authorities within 72 hours
- Affected clients will be notified if there is a high risk to their rights
- All steps taken will be documented and reviewed
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- We will notify you via email
- The updated date will be displayed at the top of this policy
- Continued use of our services after changes indicates acceptance
16. Contact & Complaints
Contact Us
Email: info@doortotherapy.com
Address: 4th Floor Regent Street, London, W1B 4HB, United Kingdom
EU Representative: Luis de Ossorno García
C/ Buen Gobernador 11, 1C, 28027 Madrid, Spain
Email: dpo@doortotherapy.com
File a Complaint
UK Clients:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Spain/EU Clients:
Agencia Española de Protección de Datos (AEPD)
Website: aepd.es
17. Consent Statement
By booking and attending therapy sessions with Door2Therapy, you acknowledge that you have read and understood this Privacy Policy and consent to:
- The collection and processing of your personal and health data as described
- Video sessions being conducted via secure platforms
- Administrative communication via email and WhatsApp
- Data retention periods and confidentiality limits outlined above
Therapist: Santiago de Ossorno Garcia
Trading as: DoorToTherapy / TerapiaDePaso
Professional Registration: HCPC PYL040507 | Colegio Oficial de Psicólogos de Madrid M-25309
