top of page

privacy statement ...
 

I am registered with the ICO (Information Commissioners Office) and adhere to the General Data Protection Regulation (GDPR) which means I need to tell you what data I am collecting from you and what I intend to do with it.

Collection and usage of your personal data
 

  • I collect personal and sensitive information about clients (including name, address, email address, telephone numbers, GP/emergency details, date of birth, gender, ethnicity, religion, sexual orientation, medical and mental health information).

  • I use the information to provide an effective counselling service, to contact clients regarding sessions and to send receipts and/or invoices.

  • I keep short factual notes of sessions and a record of attendance.
     

Sharing of client data

​

  • I might share data if required by law, or if ordered to by a court or if a client tells me about risk of serious harm to themselves or someone else.

  • I have clinical supervision where I talk about my work, but I only use a client's first name. Supervision is also confidential.

  • All payments are recorded in my accounts system (Quickbooks) with your name and will be shared confidentially with my accountant and also might be shared with HMRC if I am audited.

  • If an Employee Assistance Programme (EAP) or insurance company has referred you, factual notes and attendance details might be provided to the EAP or insurance company.
     

Storage and disposal of data

​

  • My records are handwritten and stored securely in a locked cabinet.  My financial accounts, email, mobile phone and diary system are all electronic and password protected.

  • When working with children and young people (under 18 years) my insurer requires me to keep counselling session notes and client personal information for a period of five years after the minor's 18th birthday (until their 23rd birthday).  This specific retention timeline overrides the standard five-year adult rule to protect practitioners against delayed liability claims. Under the UK Limitation Act 1980, the standard time limit for a minor to bring a personal injury claim does not begin until they reach the age of majority (18).

  • When working with adults (over 18) records must be retained for exactly 5 years from the date of the last consultation or treatment.

  • After this time data will be securely destroyed.

  • I will delete any data related to clients from my business mobile phone and email no later than one month after our contract ending.
     

Access to or change of client data

​

  • A client can make a subject access request in respect of their personal information held by me by making a request in writing. Once I receive the written request, I will respond within 14 days. If a client were referred by an EAP or insurers, they might need to address the request directly to them.

  • If during counselling, information is provided by more than one individual (couples or family counselling) I will only release information if consent has been given by all individuals involved.

  • A client may also request that inaccurate personal data is amended.
     

Data Protection Complaints or Concerns

​

As a sole trader counselling practice, I take your privacy and data protections rights seriously. If you have any questions, concerns, or complaints about how I handle, store, or retain your personal data or treatment notes, please contact me directly in writing using the details below:
 

How to Make a Data Complaint

​

In accordance with UK data protection regulations, I will:

  • handle all data-related complaints through a formal, structured framework

  • Acknowledge your complaint in writing within 30 days of receiving it

  • I will thoroughly investigate your concerns without undue delay. If my investigation requires more time due to complexity, I will keep you updated on my progress

  • I will clearly communicate the outcome and any decisions made regarding your complaint directly to you
     

Please note: If your complaint involves a request to delete your treatment records ("Right to Erasure"), I am legally required by my professional liability insurer (Holistic Insurance Services) to retain client consultation notes as above under ‘Storage and Disposal of Data’. In such cases, your data will be securely locked down but cannot be deleted until this mandatory retention period has passed.
 

Escalating Your Complaint

​

Please note that under current data protection laws you are required to resolve any data protection grievances directly with me first. If you remain unsatisfied with how I handle your complaint or data dispute, you have the right to lodge a formal complaint with the UK supervisory authority:
 

  • Information Commissioner’s Office (ICO)

  • Website: www.ico.org.uk

  • Helpline: 0303 123 1113

bottom of page