Privacy notice

How your information is handled

Last updated: [date]

Who is responsible for your information

[Practice name] is the data controller for the information described here. You can contact me at [email] or [postal address]. [If registered with the ICO, give the registration number. Use the ICO's self-assessment tool to check whether the data protection fee applies.]

What I collect, and why

If you make an enquiry

• Your name and the contact details you give me
• Any times or preferences you mention
• Anything else you choose to write to me

I use this only to reply and to arrange an introductory call. If you decide not to go ahead, I delete the enquiry after [period].

If you become a client

• Contact details, and your GP's details if you choose to give them
• An emergency contact, if you choose to give one
• Brief session notes, kept so that I can work responsibly between sessions
• A record of appointments and payments

Session notes are kept to the minimum needed. They are factual and brief rather than a transcript. You may ask to see them at any time.

The legal basis

Counselling records include health information, which is treated as a special category of personal data. I process it on the basis of [Article 9(2)(h) UK GDPR — the provision of health or social care treatment — together with the Data Protection Act 2018. Confirm the correct basis for your practice; your professional body publishes guidance on this.] Contact and payment details are processed to perform our agreement and to meet legal obligations such as tax records.

How it is stored

[Describe honestly and specifically: paper notes in a locked cabinet; electronic records on an encrypted, password-protected device; which practice-management or video tool you use; where that supplier stores data. Name the actual tools.]

Email is not a secure medium. Please don't send anything sensitive by email that you would not want read by someone else.

Who else sees it

• My clinical supervisor. All therapists are required to discuss their work in supervision. You are referred to by first name only and identifying details are left out.
• Nobody else, ordinarily. I will not confirm to anyone that you are a client without your permission.
• The limits to that. I may need to break confidentiality where there is a serious and immediate risk to your life or someone else's, where a court orders disclosure, or where the law requires it — for example in relation to the safeguarding of a child or vulnerable adult, or certain terrorism and money-laundering legislation. Wherever possible I will discuss this with you first. [Check the wording against your professional body's current ethical framework.]
• Service providers. [Booking tool, video platform, email provider, accountant — name them. Each should have a data processing agreement in place.]

How long it is kept

Client records are kept for [period — commonly a number of years after the last session; your insurer and professional body will both have a view, and they may differ. Record the reason for whatever period you choose], then securely destroyed. Enquiries that don't become appointments are deleted after [period].

Your rights

You have the right to:

• ask for a copy of the information I hold about you
• ask me to correct anything inaccurate
• ask me to delete it, where there is no overriding reason to keep it
• object to or restrict how it is used
• complain to the Information Commissioner's Office

To exercise any of these, write to me at [email]. I will respond within one month. If you are unhappy with my response you can contact the ICO at ico.org.uk or on 0303 123 1113.

This website

[If the site sets no analytics or advertising cookies, say so plainly — it is a genuine selling point and removes the need for a cookie banner. If a booking widget is embedded, say that the provider may set its own cookies and link to their privacy notice. Only add a consent banner if non-essential cookies are actually being set.]