Privacy Notice

I am registered with the Information Commissioner's Office (ICO) as a Data Controller. This Privacy Notice explains what personal information I collect, why I collect it, how I use it, how long I keep it, and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What information do I collect and why?

I collect the following information to provide counselling

services safely and professionally:

Your full name and date of birth

• To identify you accurately.
• To verify your identity where necessary.
• To identify you if I need to contact your GP.
• 
  

Address, email address and telephone number(s)

• To contact you regarding appointments and the counselling service.
• To identify you if I need to communicate with your GP.
• 
  

GP details

• If I have serious concerns about your welfare or safety, I may need to contact your GP. Wherever possible, I will discuss this with you beforehand unless doing so would increase the risk of harm.
• 
  

Next of kin details

• To be used only in an emergency, for example if you become seriously unwell during a session and I need to provide information to emergency medical professionals.
• 
  

My lawful basis for processing your information

I process your personal information because it is necessary to provide counselling services and to fulfil our counselling agreement.

As counselling involves processing information about your health and wellbeing (special category data), I also process this information where it is necessary for the provision of health or social care, or where another lawful condition under UK data protection law applies.

Will I share your information?

I will treat your information as confidential and will never sell your personal data. There are limited circumstances in which I may share your

information:

• Your first name may be discussed with my clinical supervisor as part of professional supervision.
• If I am legally required to do so, including in response to a court order.
• Where I have safeguarding concerns or believe there is a serious risk of harm to you or another person, including a child or vulnerable adult, I may share relevant information with appropriate authorities or professionals.
• If I need to contact emergency services on your behalf.
• In the event that I become unable to continue my practice due to death or incapacity, my appointed Clinical Executor may access your contact details and relevant records solely to manage the safe closure or transfer of my practice and to contact you where appropriate.
• Information will only be shared where necessary and only with those who have a legitimate need to know.

How is your information stored?

Paper records are stored in a locked filing cabinet.

If your telephone number is stored on my mobile phone, it will be saved using a unique identifier rather than your full name where practical. My phone is password protected and accessible only by me.

Electronic records are stored on password-protected devices and, where appropriate, encrypted. My laptop is locked when unattended and protected by secure passwords.

I take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss or misuse.

How long do I keep your information?

I retain your session notes, your name and your unique client code for five years after our work together ends, in accordance with the requirements of my professional insurance.

All other documents containing your personal information will normally be securely destroyed one month after our work together ends unless I have a legal, regulatory or legitimate reason to retain them for longer.

If your telephone number is stored on my mobile phone, it will normally be deleted one month after our work together ends.

Emails will be deleted when they are no longer required and normally within one month of our work ending, unless there is a legitimate reason to retain them.

When records are no longer required, they will be securely destroyed or permanently deleted.

Your rights

Under UK data protection law, you have a number of rights regarding your personal information. These include the right to:

• Request access to the personal information I hold about you.
• Request that inaccurate or incomplete information is corrected.
• Request erasure of your information in certain circumstances.
• Request that processing of your information is restricted in certain circumstances.
• Object to certain types of processing where applicable.
• Request a copy of your personal information in a portable format where applicable.
• 
  

These rights are not absolute and may be limited where I have legal, ethical or regulatory obligations to retain information.

If you wish to exercise any of your rights, please contact me verbally or in writing. I will respond within the timescales required by UK data protection law.

Complaints

If you are unhappy with how I handle your personal information, please raise your concerns with me in the first instance.

You also have the right to complain to the Information Commissioner's Office (ICO):

Website: www.ico.org.uk

Telephone: 0303 123 1113