Privacy Notice

1. My commitment to your privacy

I recognise that counselling involves sharing personal, sensitive and sometimes deeply private information. I believe that feeling safe, respected and able to trust your counsellor is fundamental to the therapeutic relationship.

As an independent counsellor and member of the British Association for Counselling and Psychotherapy (BACP), I am committed to protecting your privacy and handling your personal information with care, respect and confidentiality.

I work in accordance with the BACP Ethical Framework for the Counselling Professions and applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This privacy notice explains what information I collect, how I use it, how it is stored, who may have access to it and your rights in relation to your personal information.

2. Who is responsible for your personal information?

I am an independent sole practitioner and act as the Data Controller for the personal information you provide to me.

This means I am responsible for deciding how your personal information is collected, used, stored and protected.

Contact details:

ICO registration reference: C1469970

3. What information do I collect?

I may collect and hold the following information:

Personal information

• Your name and contact details.
• Date of birth, where relevant.
• Emergency contact details, where appropriate.
• Information provided when making an enquiry or arranging appointments.

Personal and sensitive information

• Information you share during counselling sessions.
• Relevant personal and family history.
• Information about your physical and emotional wellbeing.
• Information relating to your mental health.
• Relevant medical information and medication.
• Information relating to risk, safeguarding and personal circumstances.

Administrative information

• Appointment dates and attendance records.
• Emails, text messages and other correspondence.
• Payment and invoicing records.
• Initial assessment information and counselling notes.

Some of this information is classified as special category personal data under data protection legislation and receives additional protection.

Website enquiries and contact forms

When you use the contact form on my website, I collect your name, email address, optional telephone number and the type of enquiry associated with the contact option you have chosen.

I use this information to respond to your enquiry, discuss availability and, where appropriate, arrange an initial conversation.

The website form is intended only for initial contact. It does not provide a facility for submitting detailed personal, medical or counselling information. Please do not include sensitive information about your health, circumstances or reasons for seeking counselling in any of the form fields.

Limited technical information, such as your IP address and browser information, may also be processed to operate and protect the website, prevent spam and verify legitimate form submissions.

4. Why do I collect your information?

I collect and process personal information for the purposes of:

• Responding to enquiries and arranging appointments.
• Assessing whether counselling is appropriate for your needs.
• Providing counselling and therapeutic support.
• Maintaining appropriate professional records.
• Monitoring attendance and managing appointments.
• Processing payments and maintaining financial records.
• Meeting my professional and ethical responsibilities.
• Discussing my work in professional supervision.
• Managing safeguarding concerns and situations involving potential risk of harm.

I aim to collect only information that is relevant and necessary for providing my counselling service.

5. My lawful basis for processing your information

Under the UK GDPR, I must identify a lawful basis for each purpose for which I use your personal information. Different purposes may have different lawful bases.

• Initial counselling enquiries and requested arrangements — Article 6(1)(b), steps before entering into a contract. When you ask me about counselling, availability or an initial conversation, I use the contact details you provide to take the steps you have requested before deciding whether to enter into a counselling agreement. This basis also covers information necessary to provide counselling under an agreed contract.
• Routine practice administration and website security — Article 6(1)(f), legitimate interests. Where necessary, I use limited information to run and protect my website, prevent spam or misuse, manage routine correspondence and maintain appropriate administrative records. My legitimate interests are operating a safe, reliable and professionally managed counselling practice. I consider your privacy rights and minimise the information used for these purposes.
• Legal requirements — Article 6(1)(c), legal obligation. I process information where required to comply with applicable legal obligations, such as relevant accounting or record-keeping requirements.
• Emergencies — Article 6(1)(d), vital interests. In exceptional circumstances, processing may be necessary to protect someone's life when this lawful basis applies.

I do not rely on consent as the Article 6 lawful basis simply because you choose to submit a contact form. Submitting the form is a request for me to contact you about possible counselling.

Information about health, counselling and other sensitive matters may also be special category personal data. Where it is necessary for providing counselling or therapeutic care, I apply the additional health or social care condition under Article 9(2)(h) of the UK GDPR, together with the relevant Data Protection Act 2018 safeguards and professional confidentiality requirements. Where another purpose requires a different condition, that condition must be identified and documented before the information is processed.

My use of these lawful bases and any applicable special category conditions is documented as part of my data protection arrangements.

6. Confidentiality and its limitations

Confidentiality is central to the counselling relationship. I will treat the information you share with me respectfully and will not routinely disclose it to other people without your knowledge and consent.

However, confidentiality is not absolute.

There may be circumstances in which I need to consider sharing information, including:

• Where I believe there is a serious risk of harm to you or another person.
• Where there are significant safeguarding concerns involving a child or an adult at risk.
• Where disclosure is required by law or a court order.
• Where there is another legally recognised justification for disclosure in the public interest.

Wherever possible and appropriate, I will discuss any concerns with you before sharing information.

If disclosure is necessary, I will aim to share only the information that is relevant and proportionate to the circumstances.

7. Professional supervision

As part of my commitment to safe, ethical and effective counselling practice, I attend regular professional supervision.

Supervision provides an opportunity to reflect on my work, consider ethical issues and ensure that I am working in the best interests of my clients.

I will endeavour to anonymise information discussed in supervision wherever possible. Where identifiable information is necessary, it will be handled in accordance with my confidentiality and data protection responsibilities.

My supervisor is also expected to maintain appropriate professional confidentiality.

8. Face-to-face, telephone and online counselling

I offer counselling through face-to-face appointments, telephone sessions and online sessions.

I take reasonable steps to protect your privacy regardless of the method of counselling.

Face-to-face counselling

Sessions take place in a private setting where reasonable steps are taken to ensure conversations cannot be overheard by others.

Telephone counselling

Telephone conversations are treated as confidential. Please be mindful of your surroundings and whether others may be able to hear your conversation.

Online counselling

Online sessions are conducted using WhatsApp video call, Zoom and/or Microsoft Teams.

I take reasonable steps to use appropriate privacy and security settings. You are encouraged to join sessions from a private space where you will not be overheard or interrupted.

Online communications may carry some privacy and security risks, which cannot be entirely eliminated.

Counselling sessions are not routinely recorded. Any exceptional proposal to record a session would be discussed and agreed in advance, with appropriate safeguards.

9. Communication outside counselling sessions

I may communicate with you by telephone, email or text message for practical purposes, such as arranging appointments, confirming sessions or discussing administrative matters.

Please be aware that electronic communications may not always be completely secure.

I recommend that sensitive personal information is not shared through ordinary text messages or unsecured email wherever possible.

Please let me know if you have a preferred or more secure way of communicating.

Website communications and confidentiality

Messages submitted through my website are processed using third-party website hosting and email delivery services. The information is transmitted securely using HTTPS, but notification emails are not end-to-end encrypted.

For this reason, I ask that you use the website form only to request contact and avoid providing confidential counselling or medical information.

Where sensitive information needs to be discussed, we can agree on an appropriate method of communication.

10. How is your information stored?

I take appropriate steps to protect your personal information against loss, misuse, unauthorised access or disclosure.

These include:

• Secure, password-protected electronic devices.
• Appropriate password and account security.
• Secure storage of electronic counselling records.
• Locked storage for paper records.
• Maintaining confidentiality when communicating with clients.
• Limiting access to personal information.
• Secure deletion and disposal of information when it is no longer required.

As a sole practitioner, I am personally responsible for ensuring that appropriate arrangements are in place to protect the information I hold.

11. How long will I keep your information?

I retain personal information only for as long as it is necessary for the purposes for which it was collected, taking account of my professional responsibilities, legal obligations and insurance requirements.

My retention arrangements are:

• Counselling records: Retained and stored for 7 years
• Initial enquiries where counselling does not proceed: 3 months.
• Financial and invoicing records: 7 years

When information is no longer required, it will be securely destroyed or permanently deleted.

Retention of website enquiries

Where an initial enquiry does not result in counselling, I normally retain the enquiry and related correspondence for 3 months after our last communication, unless there is a legitimate professional or legal reason to retain it for longer.

Website enquiry notifications are also temporarily retained by the email delivery provider, Resend, in accordance with its own data retention arrangements. Resend's current standard retention period for email content and delivery logs on its free plan is 30 days.

Once information is no longer required, I take reasonable steps to ensure it is securely deleted in accordance with my retention policy.

12. Sharing your personal information

I will not sell your personal information or share it for marketing purposes.

Information may be shared where necessary and appropriate with:

• My professional supervisor.
• Emergency services in situations involving serious or immediate risk.
• Relevant healthcare or safeguarding professionals where there is a lawful and justified reason.
• Legal or regulatory authorities where disclosure is required or legally justified.
• Secure service providers supporting the administration of my practice, such as email, online counselling, appointment booking and payment services.

Any sharing of information will be limited to what is necessary and appropriate.

Website hosting and email service providers

I use the following service providers to operate my website and respond to enquiries:

• Cloudflare: Provides website hosting, security, spam protection and processing of contact form submissions. Cloudflare's Turnstile service helps distinguish legitimate visitors from automated submissions.
• Resend: Processes and delivers website enquiry notifications to my email address. These notifications contain the contact details and enquiry type provided through the form.
• Microsoft Outlook: Provides the email service I use to receive, manage and respond to enquiries.

These services process information for the purposes described above, subject to their applicable privacy and data processing arrangements. I do not use website enquiry information for marketing purposes.

International processing of personal information

Some of the service providers supporting my website and email communications may process or store personal information outside the United Kingdom, including in the United States.

For example, Resend stores email content and associated delivery information in the United States.

Where personal information is transferred outside the UK, I take steps to ensure that appropriate safeguards are in place in accordance with UK data protection legislation. These may include contractual data protection arrangements, the UK Addendum to standard contractual clauses, or applicable UK adequacy arrangements.

You may contact me if you would like further information about the international transfer safeguards applicable to your information.

13. Your rights under data protection legislation

You have various rights concerning the personal information I hold about you.

These include:

• The right to know how your information is being used.
• The right to request access to your personal information.
• The right to request correction of inaccurate information.
• The right to request deletion of information in certain circumstances.
• The right to request restriction of processing in certain circumstances.
• The right to object to certain types of processing.
• The right to data portability in certain circumstances.

These rights are subject to certain legal limitations. For example, I may need to retain some information to fulfil professional or legal obligations.

If you would like to exercise any of these rights, please contact me using the details provided above.

14. Data breaches

I take appropriate precautions to prevent personal information from being lost, accessed or disclosed without authorisation.

If a personal data breach occurs, I will take appropriate steps to investigate, manage and mitigate its effects.

Where required, I will notify the Information Commissioner's Office (ICO) and affected individuals in accordance with applicable data protection legislation.

15. Complaints

If you have concerns about how I have handled your personal information, I would encourage you to contact me in the first instance.

You also have the right to complain to the Information Commissioner's Office.

16. Reviewing this privacy notice

This notice may be updated periodically to reflect changes in legislation, professional guidance or the way my practice operates.

The latest version will be made available to clients.

17. A final reassurance

I appreciate that sharing personal information within counselling requires trust.

I am committed to respecting your privacy, protecting your personal information and maintaining appropriate professional boundaries.

My intention is to provide a counselling environment where you feel able to speak openly, knowing that your information is treated with care, sensitivity and respect.

If you have any questions about this notice or how your information is handled, please feel welcome to discuss them with me.