DDMT Privacy Notice
Debbie Dyer Music Therapy (DDMT)
Version 1.0 | August 2026
This notice explains how Debbie Dyer Music Therapy (DDMT) collects, uses, stores and shares personal information. DDMT aims to explain this as clearly as possible and to handle personal information respectfully, confidentially and securely.
1. Who is responsible for your information?
Debbie Dyer Music Therapy (DDMT) is a sole-trader music therapy practice. Debbie Dyer is responsible for how DDMT uses personal information.
Contact:
Email: debbiedyermusictherapy@gmail.com
Telephone: 07880 699088
2. What information might DDMT collect?
Depending on the service, DDMT may collect information such as your name and contact details; information needed to arrange or provide music therapy; registration and consent information; relevant health, communication, support or accessibility information; clinical/music therapy notes and reports; correspondence; safeguarding information where necessary; complaints or incident information; and invoicing/payment administration.
DDMT may also hold photographs, audio or video where appropriate permission has been given for the particular purpose.
For children or adults receiving support from other people or organisations, DDMT may receive relevant information from a parent or person with parental responsibility, authorised family member, school, care home, commissioner, healthcare/social-care professional or another appropriate source.
3. Why does DDMT use personal information?
DDMT uses personal information to respond to enquiries; assess, arrange and provide music therapy; communicate with clients, families and relevant professionals or organisations; keep appropriate professional and clinical records; protect clients and others from harm; deal with safeguarding concerns; manage consent and permissions; administer invoices, payments, contracts and the business; respond to complaints or incidents; meet professional, legal, insurance and regulatory responsibilities; and, where separately authorised, use photographs or recordings for agreed professional or publicity purposes.
4. What is DDMT's lawful basis?
DDMT only uses personal information where there is an appropriate lawful basis under data protection law.
Depending on the purpose, this may include performance of a contract, compliance with a legal obligation, legitimate interests, consent where appropriate, or another lawful basis available under UK data protection law.
Music therapy may involve health information and other special category information. Where DDMT uses this type of information, an additional lawful condition is also required. Depending on the circumstances, this may include the provision or management of health or social care, safeguarding/substantial public interest provisions, explicit consent for a particular optional use, or another applicable condition.
Where DDMT relies on legitimate interests, those interests may include providing and administering a safe, effective and professionally accountable music therapy service, maintaining appropriate business records, and protecting DDMT's legitimate legal and professional interests. DDMT considers the impact on the individual before relying on this basis.
Consent used for an optional activity – for example, publicity photographs or video – can be withdrawn for future use. Withdrawal does not make earlier lawful use unlawful.
5. Do you have to provide information?
DDMT needs some personal information in order to arrange and safely provide music therapy and to meet professional or legal responsibilities. If essential information is not provided, DDMT may be unable to offer or continue the relevant service.
Optional permissions, such as consent for publicity use of photographs or video, are separate and are not a condition of receiving music therapy unless the particular activity genuinely requires that permission.
6. Who might DDMT share information with?
DDMT keeps information confidential and does not share it simply because someone asks.
Where necessary and lawful, appropriate information may be shared with relevant schools or care homes; parents or people with parental responsibility; authorised representatives or family members; healthcare, social-care or other professionals; safeguarding authorities; emergency services; insurers, professional advisers or regulators; service providers acting on DDMT's behalf; or other recipients where there is a legitimate legal, safeguarding or professional reason.
For an adult client, being a relative does not automatically give someone access to confidential information. DDMT considers the client's wishes, authority, capacity, safeguarding responsibilities and the circumstances.
DDMT may need to share information without consent where there is a safeguarding concern, serious risk, legal requirement or another lawful reason.
7. How is information kept secure?
DDMT uses proportionate security measures for electronic and paper information. These include password/passkey protection, FileVault encryption on the DDMT Mac, encrypted DDMT external storage, restricted access, secure physical storage where appropriate and pseudonymisation of clinical files where practicable.
Clinical files are normally identified using pseudonyms or other limited identifiers rather than a client's full name. Pseudonymised information is still treated as personal information where DDMT can identify the individual.
8. Photographs, audio and video
DDMT may make audio or video recordings for legitimate professional purposes such as clinical review, supervision or professional development only where appropriate specific permission has been obtained.
Separate appropriate permission is required before identifiable client photographs, audio or video are used for the DDMT website, social media, flyers or other publicity. Permission for a professional/clinical recording does not automatically give permission for publicity.
Where permission for future publicity use is withdrawn, DDMT will stop future use and review retained copies, subject to any legal or practical limitations affecting material already lawfully published.
9. How long does DDMT keep information?
DDMT keeps information only for as long as there is a justified professional, safeguarding, legal or business reason. Different records have different retention periods.
Examples include adult clinical/music therapy records normally being retained for 8 years after DDMT's involvement ends; children's clinical records normally being retained until age 25 (or 26 in the circumstances set out in DDMT's retention schedule); complaints normally for 6 years after final resolution; and financial/tax records for the period required by HMRC.
Full retention periods and disposal arrangements are set out in the DDMT Records Retention & Disposal Policy and Schedule. Records may be retained longer where required for safeguarding, an investigation, legal proceedings, insurance or another justified reason.
10. Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have rights to ask for access to your personal information, correction of inaccurate information, deletion, restriction of use, data portability, or to object to particular processing.
These rights are not absolute in every situation. For example, DDMT may sometimes need to retain information despite a request for deletion because of professional record-keeping, safeguarding, legal or regulatory responsibilities.
If DDMT is relying on consent for a particular use, you can withdraw that consent at any time for future processing.
11. Your right to object
You have the right to object to processing based on legitimate interests in certain circumstances. If you wish to object, please contact Debbie using the details in this notice. DDMT will consider the objection in accordance with data protection law.
12. Automated decision-making
DDMT does not use solely automated decision-making or profiling to make decisions about clients that have legal or similarly significant effects.
13. Information processed outside the UK
Some technology or service providers used by DDMT may process or store information outside the UK.
Where this happens, DDMT will use providers and arrangements that offer appropriate data-protection safeguards as required by UK law. Further information about relevant safeguards can be requested from DDMT.
14. Questions, requests or concerns
If you have a question about how DDMT uses your information, want to exercise a data-protection right, or have a concern, please contact Debbie Dyer:
Email: debbiedyermusictherapy@gmail.com
Telephone: 07880 699088
DDMT will respond to data-protection requests in accordance with applicable legal requirements.
15. Complaining to the ICO
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Information about making a complaint and current ICO contact details are available at the ICO website: ico.org.uk.
DDMT would welcome the opportunity to address your concern first, but contacting DDMT does not remove your right to contact the ICO.
16. Changes to this notice
DDMT reviews this Privacy Notice regularly and will update it where necessary.
If DDMT plans a materially new use of personal information, affected individuals will be given appropriate privacy information before that new processing begins.