Privacy Policy

Newtones Music Therapy

Last updated: 24/08/26

​

1. About this Privacy Policy

Newtones Music Therapy is a sole-trader business operated by Nathan Lee, trading as Newtones Music Therapy (“I”, “me”, “my”).

​

This Privacy Policy explains how I collect, use, store and protect personal information when you:

• visit www.newtonesmusictherapy.co.uk;

• contact me;

• make an enquiry or referral;

• arrange or receive music therapy;

• are assessed for music therapy;

• provide information on behalf of a client;

• are involved in arranging, funding or coordinating a client's care; or

• otherwise communicate or interact with Newtones Music Therapy.

​

I take privacy and confidentiality seriously, particularly because music therapy can involve the processing of sensitive health and wellbeing information.

​

I process personal information in accordance with applicable UK data-protection and privacy law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and applicable electronic-privacy legislation.

​

2. Who is responsible for your personal information?

The data controller responsible for your personal information is:

Nathan L33 trading as Newtones Music Therapy

Privacy email: nathan@newtonesmusictherapy.co.uk

Website: www.newtonesmusictherapy.co.uk

​

As Newtones Music Therapy is operated as a sole trader, the business is not a separate legal entity from me.

If you have any questions about how I collect or use your personal information, please contact me using the details above.

 

3. Who does this Privacy Policy apply to?

This Privacy Policy applies to personal information relating to:

• adults receiving music therapy;

• children and young people receiving music therapy;

• parents, guardians and carers;

• people making enquiries or referrals;

• clients whose therapy is arranged, funded or coordinated by a case manager;

• clients whose therapy is funded or commissioned by another organisation;

• healthcare and allied health professionals involved in a client's care;

• other professionals involved in arranging or supporting therapy; and

• people who contact me in connection with my services.

​​

4. What personal information may I collect?

Depending on your relationship with Newtones Music Therapy, I may collect:

Basic and contact information

This may include:

• name;

• preferred name;

• address;

• telephone number;

• email address;

• date of birth or age, where relevant;

• emergency contact details;

• details of a parent, guardian, carer or other authorised person; and

• communication preferences.

​

Referral and professional information

Where relevant, I may receive or record:

• referral information;

• information provided by a case manager;

• information provided by healthcare professionals;

• information from schools or educational organisations;

• information from care providers;

• information from commissioners or funding organisations;

• professional reports;

• assessments;

• therapy goals;

• information about support needs; and

• relevant correspondence.

​

Therapy and health information

Because I provide music therapy, I may process information concerning your physical or mental health.

This may include:

• medical conditions;

• neurological conditions;

• disabilities;

• mental health and emotional wellbeing;

• communication needs;

• cognitive or physical functioning;

• relevant medical history;

• treatment and support;

• therapy needs and goals;

• progress and outcomes;

• information relevant to risk or safeguarding; and

• information contained in clinical or professional reports.

​

Health information is special category personal data under UK GDPR and is subject to additional legal protections.

I will only collect and use health information where it is relevant and necessary for the purposes described in this Privacy Policy.

​

Payment and administrative information

Where relevant, I may collect:

• billing information;

• invoices;

• payment records;

• funding or commissioning information; and

• information required for accounting and tax purposes.

​

I will not normally need to collect or store your full bank-card details myself where payments are processed by a third-party payment provider.

​

5. Where does personal information come from?

I may collect information:

• directly from you;

• from a parent, guardian or carer;

• from a person authorised to act on your behalf;

• from a case manager;

• from a healthcare professional;

• from an allied health professional;

• from a school, college or other educational organisation;

• from a care provider;

• from a commissioner or funding organisation;

• from an insurer;

• from another professional involved in your care; or

• from information you provide through my website or other communication channels.

​

Where I receive information about you from another person or organisation, I will provide appropriate privacy information where required by law.

​

6. How do I use your personal information?

I may use your personal information to:

• respond to enquiries;

• process referrals;

• determine whether music therapy may be appropriate;

• arrange and manage appointments;

• provide music therapy;

• maintain therapy and administrative records;

• assess therapy needs;

• agree and review therapy goals;

• monitor progress and outcomes;

• prepare appropriate reports;

• communicate with you;

• communicate with people you have authorised to be involved in your care;

• communicate with case managers and relevant professionals;

• provide appropriate information to organisations funding or commissioning therapy;

• manage invoices and payments;

• comply with legal, professional and regulatory obligations;

• meet safeguarding responsibilities;

• manage complaints;

• maintain the security of my business and information systems;

• establish, exercise or defend legal claims;

• maintain appropriate business records; and

• send information about my services where this is permitted by law.

• ​

I will not use your personal information for purposes that are incompatible with the purposes described in this Privacy Policy unless I have a lawful basis to do so.

​

7. What is my lawful basis for processing your information?

UK GDPR requires me to have a lawful basis for processing personal information.

​

Depending on the circumstances, I may rely on one or more of the following:

Contract

I may process information where this is necessary to enter into or perform an agreement with you, including providing agreed services and managing payments.

​

Legal obligation

I may process information where necessary to comply with a legal obligation, including accounting, tax, professional, regulatory or other legal requirements.

​

Legitimate interests

I may process information where this is necessary for my legitimate interests, provided that those interests are not overridden by your rights and interests.

This may include managing my business, maintaining appropriate records, managing enquiries, maintaining security and establishing or defending legal claims.

​

Consent

Where appropriate, I may rely on your consent.

Where I rely on consent, you can withdraw it at any time. Withdrawal of consent does not affect processing that took place lawfully before consent was withdrawn.

Consent will not be used as a default where another lawful basis is more appropriate.

​

8. Health information and other special-category information

Health information is special-category personal data under UK GDPR.

Where I process health information, I will ensure that I have:

1. an appropriate lawful basis under Article 6 UK GDPR; and

2. an appropriate condition under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018.

​

Depending on the circumstances, processing may be necessary for the provision or management of health or social care or treatment.

​

In other circumstances, I may rely on explicit consent or another applicable Article 9 condition.

​

I will only process special-category information where the relevant legal requirements are satisfied.

​

I will also take appropriate steps to minimise the amount of sensitive information collected and retained and to protect it appropriately.

​

9. Confidentiality

I understand that information shared during music therapy may be personal, sensitive and private.

I will treat information relating to clients and therapy as confidential.

I will normally only share information with another person or organisation where:

• you have authorised the sharing;

• it is necessary to provide or coordinate your care;

• there is another appropriate lawful basis;

• I am required to do so by law;

• it is necessary for safeguarding;

• it is necessary to protect someone's vital interests; or

• another lawful and appropriate reason applies.

I will aim to share only information that is relevant and necessary for the particular purpose.

​

10. Case-managed and commissioned clients

Some clients may receive music therapy that is arranged, funded or coordinated by a case manager, commissioner, insurer, healthcare professional or other organisation.

​

In these circumstances, I may receive information about you from the organisation or professional arranging your therapy.

I may also provide appropriate information about your therapy to the relevant case manager or organisation where there is an appropriate lawful basis.

​

Depending on the circumstances, this may include:

• confirmation of attendance;

• assessment information;

• agreed therapy goals;

• relevant progress information;

• therapy outcomes;

• recommendations; and

• appropriate reports.

​

The fact that another organisation arranges or funds your therapy does not automatically give that organisation unrestricted access to your therapy records.

​

I will consider confidentiality, the purpose of the information sharing, your rights and the applicable legal requirements when deciding what information can appropriately be shared.

​

Where consent is the appropriate lawful basis, I will seek consent before sharing the relevant information.

​

11. Adults

Where an adult receives music therapy, I will normally communicate directly with that person about their therapy and personal information.

​

I will not normally share information with family members, carers, case managers or other professionals simply because they are involved in the person's life or care.

​

Information may be shared where the client has authorised this, where the recipient has appropriate legal authority, where another lawful basis applies, or where disclosure is necessary or required in circumstances such as safeguarding or an emergency.

​

12. Children and young people

Music therapy may also be provided to children and young people.

When processing information relating to a child or young person, I will take particular care to ensure that the processing is fair, lawful and appropriate to their age, understanding and circumstances.

Depending on the circumstances, I may communicate with:

• a parent;

• a person with parental responsibility;

• a guardian;

• a carer;

• a case manager;

• a healthcare professional; or

• another appropriately authorised person.

​

Where appropriate, I will take the child's or young person's wishes and understanding into account.

​

Where consent is relied upon, I will consider the specific legal requirements applicable to children and young people's consent.

​

13. Safeguarding and emergencies

There may be circumstances where I need to share personal information without consent.

This may include situations where disclosure is:

• necessary to protect someone's vital interests;

• necessary to prevent serious harm;

• necessary for safeguarding;

• required or authorised by law; or

• necessary to establish, exercise or defend legal claims.

​

Where legally and practically possible, I will consider the individual's rights and interests before making such a disclosure.

​

14. Website information

When you visit www.newtonesmusictherapy.co.uk, the website may collect technical information such as:

• IP address;

• browser type;

• device information;

• operating system;

• pages visited;

• date and time of visits; and

• information about how the website is used.

The information actually collected will depend on the website's hosting, analytics and cookie configuration.

I use information necessary to operate, maintain and secure the website and, where applicable, to understand how visitors use it.

​