Tom Wells, Psychotherapist

Privacy & cookies

How this website uses your information and cookies, and how this differs from the confidentiality of psychotherapy sessions.

Last updated: 01.05.2026

1. Who I am

This website is run by Tom Wells, an individual psychotherapist practising in Edinburgh. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), I am the data controller for personal data collected through this site.

You can contact me about this notice, or any privacy question, at:
therapy@tomwellstherapy.co.uk

2. Scope: website vs. therapy records

This page is about data collected when you visit tomwellstherapy.co.uk or www.tomwellstherapy.co.uk – for example, when you browse pages, accept or reject cookies, or use the contact form.

It does not cover what happens once you become a psychotherapy client. Therapy notes and clinical records are held separately from this website in line with professional and legal obligations, including the BACP and COSCA ethical frameworks. I can provide a separate therapy privacy information sheet at or before our first appointment.

3. What information this website collects

3.1 Information you knowingly give

If you fill in the contact form or email me directly, I will normally receive:

  • Your name
  • Your email address and any phone number you choose to include
  • The message you write in the free-text box or email

Because this is an online contact route, it is not a secure clinical channel. To protect your privacy and keep within professional guidelines, please keep your message brief and general. You do not need to describe your difficulties in detail at this stage.

3.2 Automatic technical information

When you visit the site, standard technical information is collected automatically, such as:

  • Your IP address and browser type
  • Which pages are visited and for how long
  • Basic device information (for example mobile/desktop)

This information is a normal part of running a website and helps keep the site secure and reliable. It is not used to make automated decisions about you as an individual, and is not combined with therapy notes.

3.3 Cookies and similar technologies

This site uses no client-side analytics and sets no optional cookies. Visit numbers are counted at the server and network level only (see section 4.3), so no tracking script runs in your browser.

A small number of essential cookies may be set automatically by the hosting and CDN provider (Cloudflare) to keep the site secure and reliable. These are not used for analytics or advertising and cannot meaningfully be avoided without breaking site functionality. Further detail is in section 6.

4. How I use the information

4.1 Responding to enquiries

I use the information you send via the contact form or email in order to respond to your enquiry, arrange an initial conversation, and – if you choose to go ahead – set up therapy sessions. The legal bases for this are:

  • Taking steps at your request before entering a contract (UK GDPR Art. 6(1)(b)); and
  • Legitimate interests (Art. 6(1)(f)) in running a psychotherapy practice safely and efficiently.

4.2 Website security and reliability

Technical logs and certain essential cookies are used to:

  • keep the site secure and protect against abuse and spam;
  • ensure pages load correctly and consistently.

This includes security and performance services provided by my web host and content delivery/network provider (for example, Cloudflare), which process IP addresses and basic technical data in order to filter malicious traffic and deliver pages efficiently.

The legal basis is my legitimate interests in maintaining a secure and functioning website.

4.3 Analytics

This site uses Cloudflare (network-level request analytics) and AWStats (server log analysis) to count visits in aggregate. Both tools operate at the server or network level: no script runs in your browser, and nothing is stored on your device.

Because no information is stored on or accessed from your device, the cookie consent rules in PECR (Regulation 6) do not apply, and the Data (Use and Access) Act 2025 separately confirms a statistical-purposes exception for analytics of this kind. IP addresses are processed only briefly as part of request handling and are not used to identify or profile individual visitors; the legal basis is legitimate interests (UK GDPR Art. 6(1)(f)).

No personal data is collected, no advertising trackers are used, and data is not shared with third parties for any commercial purpose. No opt-out mechanism is required since no client-side storage is used, but you are welcome to contact me directly if you have any questions.

5. Who has access to your data

I do not sell your data or share it with third parties for advertising or social media profiling.

For the website to function, I use carefully chosen service providers who act as data processors and process data on my behalf under contract. These currently include:

  • Website hosting and infrastructure – your data is stored on secure servers operated by my hosting provider and protected using a content delivery/network service (for example, Cloudflare) to keep the site fast and secure. These services log IP addresses and requests for a limited period (typically up to around one month of detailed access logs, plus shorter-lived technical logs) for security and troubleshooting.
  • Contact form provider – the embedded contact form is provided by Google Forms, part of Google Workspace. Google processes the details you submit to the form and stores them securely so I can read and respond to them. Google acts as a data processor under its data processing terms.
  • Email provider – when you email me directly, your message is processed and stored by my email service provider (Google Workspace).
  • Map provider (if used) – if I embed a map in the "Fees & Location" page in future, the map provider (for example, Google Maps) may process limited technical data such as your IP address and approximate location to display the map correctly.

These providers are chosen with privacy and security in mind, and where data is transferred outside the UK or EEA, I rely on appropriate safeguards such as standard contractual clauses or equivalent protections.

Website-related data processed by these providers is kept separate from therapy notes and clinical records, which are stored and protected in line with professional requirements.

6. Cookies used on this site

This site does not use any analytics or advertising cookies, and there is no cookie banner because none is required (see section 4.3).

A small number of essential cookies may be set automatically by the hosting and CDN provider (Cloudflare) to protect against malicious traffic and ensure pages load reliably. These are needed for the site to work correctly and cannot be switched off from this site, though you can block them in your browser if you wish (which may affect site functionality).

If your browser sends a "Do Not Track" signal, no additional action is needed because no optional analytics or trackers run in any case.

7. How long your data is kept

  • Contact form and email enquiries – normally kept for up to 12 months from our last contact, unless we begin therapy together or the law requires a longer period. If you become a client, relevant information may move into your clinical record, which has different retention rules.
  • Technical logs – server and security logs are generally kept for a short period (often weeks to a few months, and typically no more than around one month of detailed archived access logs) to maintain security and troubleshoot technical issues. Aggregated visit statistics derived from these logs (e.g. via AWStats) are retained for longer but contain no personal data.
  • Cookies – any essential cookies set by the hosting/CDN provider are stored for their functional lifetime (typically the duration of your browser session or a defined period). You can delete them at any time via your browser.

8. Your rights

Under UK data protection law you have rights over your personal data, including:

  • to access a copy of your data;
  • to ask for inaccurate data to be corrected;
  • to request deletion of your data, in some circumstances; and
  • to restrict or object to certain types of processing.

To exercise these rights in relation to this website, please email therapy@tomwellstherapy.co.uk.

If you have concerns about how your data is handled, you can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Children and vulnerable people

This website is aimed at adults seeking psychotherapy for themselves. I do not knowingly collect information from children via this site. If you believe a child has provided information through the contact form, please let me know and I will delete it.

10. Changes to this notice

This privacy and cookies notice will be reviewed and updated from time to time, for example if I change service providers, adjust analytics, or update my professional obligations. The "last updated" date will appear at the top of this page and the latest version will always apply.