1. Purpose of this Privacy Policy
Your privacy is very important to me, and I want you to feel confident that the personal information you share with me is kept safe and secure.  This privacy policy explains how I collect, use, store and protect your personal information whenever you make an enquiry, attend therapy, or otherwise communicate with me.  It is intended to help you understand your rights and how your information will be handled in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
​
2. Information I May Collect

• Your name, address, telephone number and email address.

• Date of birth

• GP and/or emergency contact details.

• Brief notes from initial consultation and therapy sessions

• Appointment records, and communications about appointments.

• Payment and invoicing information, where applicable.

• Information relating to risk, safeguarding, or legal and ethical duties where relevant

 
3. Lawful Basis for Processing
Under UK GDPR, I will only collect or use your information where I have a lawful basis or obligation to do so.  I will always respect your rights and gain consent where appropriate or contractually necessary.  My primary reason for collecting and keeping your information is to respond to enquiries, to arrange and provide your counselling and to support the therapeutic process.  If you would like to read more about the lawful basis for processing, please see ICO’s website for more information - https://ico.org.uk/for-the-public/does-an-organisation-need-my-consent/
​
4. How I Use Your Information
Initial contact. When you contact me, or I receive a referral from a third party on your behalf, I will use the information provided to respond to your enquiry and arrange an initial appointment if appropriate. If you do not go ahead, I will delete your information within 12months, unless you ask me to delete it sooner.

During counselling. I will keep basic contact details and brief session notes so I can communicate with you and provide a safe and consistent service.  Your information is kept securely on password protected devices and is not shared unless there is a clear legal, ethical or safeguarding reason to do so.  Personal information discussed in therapy is often classed as ‘special category data’ and as such will be handled with additional care.  For example, all session notes which may contain sensitive information are anonymised and stored separately from identifying information.

After counselling ends. I will keep your records for 7 years and then securely delete or destroy them.  If you would like your information deleted sooner, please let me know.
 
5. Confidentiality and It's Limits
Your privacy and confidentiality are central to the therapeutic relationship.  I will not share your personal information without your consent unless there is a clear legal, ethical or safeguarding reason to do so.  I will not sell or use your personal information for marketing purposes.  Exceptions to confidentiality may include:

• situations where there is a serious risk of harm to you or another person,

• safeguarding concerns involving a child or vulnerable adult,

• a legal requirement such as a court order

• where a disclosure is required to prevent or detect serious crime

Wherever possible and appropriate, I will discuss any disclosure with you before it is made.
 
6. Supervision
In addition to the above exceptions, and as part of my ethical practice, I discuss aspects of my work with my qualified clinical supervisor/s.  This is done to support safe and effective therapy.  I will only share information that is necessary for supervision.  Full names are not used within supervision to protect your identity, or I can use a pseudonym if preferred.
​
7. How Your Information Is Stored and Protected
I use robust security measures to ensure that your information is protected.  These include two-factor authentication, encryption, and restricted access. Your identifying personal details, such as contact information, will be stored separately from anonymised session notes.  The majority of your information will be stored electronically but in the case of paper records (e.g. any creative work we might produce in sessions), these are kept in a locked storage cabinet.
​
8. How Long Information Is Kept
Client records, including clinical notes and contact information will normally be kept for 7 years, and will then be securely destroyed.  Emails and text messages will be deleted as soon as they have served their purpose, and your contact details will be deleted from my devices once our work together has ended.  If you pay for my services via bank transfer this information becomes part of my business and banking records and will be kept for 7 years and then securely destroyed.
​
9. Incapacity or closure of practice
I will maintain arrangements for secure record management if I become incapacitated, retire or my practice closes. These arrangements cover access, client communication where appropriate, and the retention and secure disposal of your information.
​
10. Communication
Email, text and online communication can carry some security risks. I will take all reasonable steps to communicate securely, but I cannot guarantee the security of information sent over standard email, text or internet services.
​
11. Your Rights
Under data protection law you have rights regarding your personal information.  These include:

• the right to be informed about how your information is used

• the right to request access to your personal information (via a Subject Access Request – SAR)

• the right to ask for inaccurate information to be corrected

• The right to ask me to delete, limit how I use, or to stop processing your personal information.

• You also have the right to complain if you are unhappy with how your information is being handled.

Please note that some rights may be limited where information must be kept for legal, safeguarding, professional or insurance reasons.
​
12. Subject Access Requests (SARs)
You may request a copy of all the personal information I hold about you. I must respond to any Subject Access Request within one month. In some circumstances, information may be withheld or redacted, for example where disclosure would adversely affect another person’s rights, create serious risk of harm, or breach legal or professional duties.
​
13. Complaints
If you have concerns about how your information is being handled, please raise this with me first so I can try to resolve it.  If you are still unhappy you have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, quoting my registration number: ZC196902.
 
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113.
Website:
https://ico.org.uk/make-a-complaint/
You may also raise concerns with my professional body: [BACP Registered Member 411331].