Privacy Notice (v28.06.26)

This Privacy Notice explains how I collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

I am committed to protecting your privacy and handling your personal information in a confidential, secure and transparent manner.

Who is responsible for your information?

I am the Data Controller for the personal information that you provide to me in connection with counselling services. This means I decide how and why your personal information is processed.

I am registered with the ICO (Information Commissioners Office) Ref. ZA487636.

In some circumstances I may also act as a Data Processor where I process personal information on behalf of another organisation, such as an Employee Assistance Programme (EAP) or other referring organisation.

What information do I collect?

The information I collect may include:

• Your name, address, telephone number and email address.

• Your date of birth.

• Emergency contact details.

• Your GP details.

• Relevant medical history and current health information.

• Information relating to your mental health and wellbeing.

• Information about your family and personal circumstances where relevant to your therapy.

• Details of any children or dependants where relevant.

• Information about your lifestyle and the issues that have brought you to counselling.

• Information relating to any referral to counselling.

• Brief factual session notes made during or after our appointments.

• Appointment records and correspondence.

I will only collect information that is relevant to providing you with safe and effective counselling.

Special Category Data

As part of providing counselling, I will process information relating to your physical and mental health. This is known as "Special Category Data" under UK GDPR and receives additional legal protection.

Why do I collect your information?

Your information is collected in order to:

• Provide counselling safely and effectively.

• Assess whether counselling is appropriate for your needs.

• Plan and review your therapy.

• Contact you regarding appointments.

• Maintain appropriate clinical records.

• Respond appropriately if there are concerns about your safety or the safety of others.

• Meet my legal, professional and insurance obligations.

My lawful basis for processing your information

Under UK GDPR, my lawful basis for processing your personal information is:

• Article 6(1)(b) – Processing is necessary for the performance of our counselling contract.

• Article 6(1)(f) – Legitimate interests, where appropriate, such as maintaining accurate records and managing my practice.

• Article 9(2)(h) – Processing of Special Category Data is necessary for the provision of health or therapeutic care.

Where another lawful basis applies, I will explain this to you.

Who may receive your information?

Your information is treated as confidential.

However, there are circumstances where I may need to share information, including:

• With your GP or another healthcare professional, where necessary for your safety or with your consent where appropriate.

• During professional clinical supervision. Wherever possible, information is anonymised and only the minimum necessary information is discussed.

• With my professional indemnity insurer if required in relation to a complaint or legal claim.

• With my accountant or HM Revenue & Customs in relation to financial records (not clinical notes).

• Where required by law, including court orders.

• Where there is a safeguarding concern involving a child or vulnerable adult.

• Where there is a serious risk of harm to yourself or another person.

• Where disclosure is otherwise required by law.

Where possible, I will discuss any disclosure with you before sharing information unless doing so would increase the risk of harm or is prohibited by law.

How your information is stored

Paper records are stored in a locked filing cabinet.

Electronic records are stored on password-protected devices with appropriate security measures in place, including up-to-date antivirus protection and restricted access.

Mobile phone information, including appointment messages, is stored on a password-protected device.

Where electronic services or cloud storage are used, these are chosen to meet UK GDPR security requirements.

I take reasonable technical and organisational measures to keep your information secure.

How long will I keep your information?

Counselling records are normally retained for a minimum of seven years after counselling has ended.

For clients who are under the age of 18, records will normally be retained until the client's 25th birthday (or longer where required by law or professional guidance).

After the relevant retention period has expired, records will be securely destroyed or permanently deleted.

Financial records may be retained separately where required by tax legislation.

Your rights

Under UK GDPR you have the right to:

• Request access to the personal information I hold about you.

• Request that inaccurate or incomplete information is corrected.

• Request that processing of your information is restricted in certain circumstances.

• Object to processing where the lawful basis is legitimate interests.

• Request a copy of your personal data where the right to data portability applies.

• Request erasure of your personal information in certain circumstances.

Please note that the right to erasure is not absolute. I may be legally or professionally required to retain counselling records for insurance, safeguarding, legal or regulatory purposes.

Requests relating to your personal information should be made in writing by email or post. I will normally respond within one calendar month, although this period may be extended where permitted by law.

You are not required to explain why you wish to access your records, although I am happy to discuss any concerns you may have.

Confidentiality

Everything discussed in counselling is confidential, subject to the legal and ethical limits of confidentiality explained in our Counselling Agreement. These include situations where there is a serious risk of harm, safeguarding concerns or where disclosure is required by law.

Complaints

If you have any questions about how your information is handled, please contact me in the first instance.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information about making a complaint can be found at www.ico.org.uk or by telephoning 0303 123 1113.

Changes to this Privacy Notice

This Privacy Notice may be updated from time to time to reflect changes in legal requirements or professional practice. The most recent version will always be available on request.

Acknowledgement

By signing the Therapy Agreement, you acknowledge that you acknowledge this Privacy Notice and understand how your personal information will be processed in accordance with UK GDPR and the Data Protection Act 2018.