Privacy Policy
Your personal data – What is it?
Personal data is any information relating to a living person who can be identified directly or indirectly from that information, either on its own or together with other information.
As part of my counselling, coaching and related services, I may also process information that is considered particularly sensitive under data protection law. This is known as special category data and may include information about your physical or mental health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation or other aspects of your personal circumstances.
I handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
How I use your information
I collect and process personal data where necessary to provide my counselling, psychotherapy, coaching, supervision and related wellbeing services, including workshops, retreats and nature-based activities.
I use your information to communicate with you, respond to enquiries, arrange and manage bookings, provide the services you have requested, maintain appropriate professional records, process payments where applicable, and meet my legal, ethical and professional obligations.
The personal data I may collect includes:
Personal and contact information: such as your name, address, date of birth, telephone number and email address.
Information relevant to the service I provide: such as personal and family history and information about your physical or mental health and wellbeing.
Special category data: where relevant, this may include information about health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation or other sensitive personal information that you choose to share with me.
Booking and service information: such as appointments, attendance and information relating to the services you have booked or enquired about.
Technical information: such as IP addresses and information generated when you use my website or communicate with me electronically.
I only collect and use information that is relevant and necessary for the particular service, enquiry or interaction you have with me.
Why and how I lawfully use your personal data
I collect and use personal data only where I have a lawful basis to do so. Depending on the circumstances and the service you receive, this may include:
Contract: where the information is necessary to respond to your request, arrange or provide a service, or fulfil my agreement with you.
Legal obligation: where I am required to process information to comply with the law.
Legitimate interests: where processing is necessary for the appropriate administration and operation of my practice, provided that my interests do not override your rights and interests.
Vital interests: in exceptional circumstances where processing is necessary to protect your life or the life of another person.
Special category data Because of the nature of counselling, psychotherapy, coaching and related wellbeing services, you may choose to share sensitive personal information with me. This may include information about your physical or mental health, racial or ethnic origin, religious or philosophical beliefs, or sexual orientation.
This information is known as special category data and receives additional protection under data protection law. I will only process special category data where it is necessary and where an appropriate condition under UK data protection law applies.
I take particular care to ensure that sensitive information is collected only where relevant, kept securely, treated confidentially and not retained for longer than necessary.
How I share your information
I treat your personal information as confidential and will only share or disclose it where there is an appropriate reason and lawful basis for doing so.
Your information may be shared or processed in the following circumstances:
Professional supervision: I may discuss aspects of my counselling, psychotherapy or coaching work in professional supervision. Wherever possible, identifying information is minimised, and supervisors are bound by professional confidentiality.
Legal or regulatory requirements: I may disclose information where I am required to do so by law, for example in response to a court order or other statutory obligation.
Risk of serious harm: In exceptional circumstances, I may need to disclose relevant information where this is necessary to protect you or another person from serious harm.
Third-party funded or contracted services: Where I provide services on behalf of an organisation, such as an Employee Assistance Programme (EAP), referral organisation or other contracted service, I may be required to collect, access or record information using that organisation’s systems or platform. The information processed and shared in these circumstances will depend on the particular service and contractual arrangements. Where appropriate, you will also be subject to the privacy information provided by the organisation that referred or commissioned the service.
Service providers used by my practice: I use third-party services to support the operation of my private practice, which may include appointment and booking systems, payment processing, email and communication services, online sessions, website services and secure cloud storage. These services may process limited personal data as necessary to provide their functions.
I only share or make personal information available where it is necessary and appropriate. I take reasonable steps to use services and systems with appropriate data protection and security arrangements.
I do not sell your personal information or share it with third parties for their own marketing purposes.
Cookies and online tracking
My website may use cookies and similar technologies to enable the website to function, remember preferences and, where applicable, understand how visitors use the website.
Some cookies are necessary for the website to operate and do not require consent. Where cookies or similar technologies are not strictly necessary, they will only be used where the appropriate consent has been obtained.
You can manage your cookie preferences through the cookie settings available on the website. You can also control cookies through your browser settings.
Third-party services used on or linked to from the website may also use cookies or similar technologies in accordance with their own privacy information.
Data retention
I retain personal information only for as long as it is necessary for the purpose for which it was collected and to meet my legal, professional, ethical, contractual and insurance obligations.
The length of time information is retained will depend on the type of record and the purpose for which it is held. In determining appropriate retention periods, I take account of applicable data protection requirements, professional guidance, contractual requirements, my professional indemnity insurance requirements and any relevant periods during which a complaint or legal claim may be made.
Different types of information may therefore be retained for different periods. I periodically review the information I hold and, when it is no longer necessary to retain it, it is securely deleted, destroyed or anonymised as appropriate.
Personal information is stored securely and appropriate measures are taken to protect it against unauthorised access, loss, misuse, alteration or disclosure. Electronic information is held using password-protected and appropriately secured systems. Where paper records are required, these are kept in secure physical storage.
Where I use third-party systems or provide services through another organisation, relevant information may also be held within those systems in accordance with the data protection and security arrangements applicable to that service.
How do I protect your data
I take the security, confidentiality and privacy of personal information seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration or disclosure.
These measures include appropriate password protection and access controls, secure storage of electronic and paper records, keeping devices and systems appropriately protected and up to date, and limiting access to personal information to those who have a legitimate need to access it.
I take additional care when handling sensitive and special category information because of the nature of the services I provide.
Where I use third-party systems or service providers to process personal information, I take reasonable steps to ensure that appropriate data protection, confidentiality and security safeguards are in place.
I review my data protection and security arrangements periodically and make changes where necessary to maintain an appropriate level of protection.
Data breaches
I take any actual or suspected personal data breach seriously and will respond in accordance with UK data protection law, Information Commissioner’s Office (ICO) requirements and my professional and ethical responsibilities, including those set out by the British Association for Counselling and Psychotherapy (BACP).
If I become aware of a personal data breach, I will take appropriate steps to contain and investigate it, assess the potential risk to those affected and take action to minimise any possible harm.
I maintain a record of personal data breaches in accordance with data protection requirements.
Where a breach is likely to result in a risk to an individual’s rights and freedoms, I will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to an individual’s rights and freedoms, I will also inform the affected individual without undue delay and provide appropriate information about the breach and any steps they may need to take.
Your data protection rights
Under UK data protection law, you have rights in relation to your personal information. Depending on the circumstances and the lawful basis on which your information is processed, these may include:
The right to be informed about how your personal information is collected and used.
The right of access to your personal information and to request a copy of the information I hold about you.
The right to rectification if information I hold about you is inaccurate or incomplete.
The right to erasure of your personal information in certain circumstances.
The right to restrict processing of your personal information in certain circumstances.
The right to data portability, where applicable.
The right to object to certain types of processing.
Where processing is based on your consent, you may also have the right to withdraw that consent. Withdrawing consent does not affect the lawfulness of processing that took place before consent was withdrawn.
These rights are not absolute and may be subject to legal, professional or other applicable requirements. For example, I may need to retain certain records where there is a lawful or professional reason for doing so.
If you wish to exercise any of your data protection rights, please contact me using the contact details provided in this privacy notice. I will respond in accordance with the timescales required by data protection law.
International transfers of personal data
Some of the third-party systems and service providers I use may process, store or make personal information accessible outside the UK.
Where personal information is transferred outside the UK, I take reasonable steps to ensure that the transfer is made in accordance with UK data protection law and that appropriate protection is in place.
Depending on the circumstances, this may include transferring information to a country covered by UK adequacy regulations or using appropriate safeguards recognised under UK data protection law.
Where I provide services through a third-party or contracting organisation, personal information processed through that organisation’s systems may also be subject to its international data transfer arrangements and privacy information.
Further information about the safeguards applicable to your personal information can be requested using the contact details provided in this privacy notice.
Data protection complaints
If you have a concern or complaint about how I have collected, used, stored, shared or protected your personal information, you can raise a data protection complaint directly with me using the contact details provided in this privacy notice.
Please make it clear that your concern relates to data protection and provide enough information for me to understand and investigate the matter. Where necessary, I may ask you for further information or appropriate proof of identity. If you are making a complaint on behalf of another person, I may also need appropriate evidence that you have authority to act on their behalf.
I will acknowledge receipt of your complaint within 30 days. I will investigate your complaint fairly and without undue delay, taking appropriate steps to establish what has happened and whether your personal information has been handled in accordance with data protection requirements.
I will keep you informed of the progress of the investigation and, where the investigation takes longer, provide appropriate updates.
Once the investigation is complete, I will communicate the outcome to you without undue delay and explain my findings and any action taken or proposed, where appropriate.
I will keep an appropriate record of the complaint, my acknowledgement, relevant correspondence and information, the outcome and any action taken. These records will be kept only for as long as necessary in accordance with my data retention responsibilities.
If you remain dissatisfied with how I have handled your data protection complaint, you have the right to raise your concern with the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
If you remain dissatisfied after raising a data protection complaint with me, you have the right to raise your concern with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Last updated: 8 September 2026