Privacy Notice - updated 8th September 2023
I take the privacy of clients and potential clients seriously. I adhere to current UK data protection legislation, including the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR). I am a registered member of the British Association of Counselling and Psychotherapy (BACP) and am bound by their Ethical Framework for the Counselling Professions. This privacy statement explains what I do with your personal information. I am happy to discuss any questions you might have in relation to your data, and you can find my contact details at the bottom of this statement.
How I use your information
If you contact me, I may collect some information so that I can satisfy your enquiry including, if appropriate, to prepare for entering into a counselling agreement. Information collected at this stage may include: name, address, telephone number(s), email address(es), date of birth, your reasons for seeking counselling, emergency contact details, GP details. If I collect this information and then we do not agree to start counselling, I will delete the information from my records within 3 months of our last contact (in case you change your mind in this time), or earlier if you request this. In general I will keep copies of our correspondence by email, text message, written letters or in other forms, for up to 3 months after receiving or sending the communication (so that I can satisfy your enquiry and any follow-up communications), or possibly longer if the correspondence relates to ongoing counselling in which case I will retain this with my session notes and it will subject to a counselling agreement between you and I, as described below.
Whilst undertaking counselling
I will keep a record of your personal contact details to help the counselling services run smoothly. These details are kept in a secure and encrypted database, and are not shared with any third party, apart from in the event of my death or inability to work, when my clinical executor can gain access to contact details of my current clients in order to notify them and support them in finding alternative counselling where appropriate. My clinical executor will never have access to session notes or any information other than contact details (email address, telephone number, postal address) of my current clients.
I will keep written notes of each session together with any relevant and important correspondence, these are kept in a secure and encrypted database, separately from contact information. I will keep everything you discuss with me in sessions confidential and not share it with others, apart from in the following situations. I may break confidentiality if I have reasonable grounds to believe there is a risk of imminent and serious harm to yourself or others, in which case I will discuss this with you first wherever possible before disclosure. Also, I may break confidentiality where I am legally obliged to do so (e.g., disclosure of information relating to acts of terrorism). Practicing members of the BACP are required to undertake professional supervision, and I may discuss our counselling with my supervisor to ensure or enhance the quality of my work with you. All discussion in supervision is anonymised and your identity is never revealed. My supervisor is also bound by the BACP’s Ethical Framework.
I accept payment by cash or bank transfer as well as debit and credit card payments. If you choose to pay by card, either in-person or online, your card details (including the name on the card) will be passed to my e-commerce provider Squareup International Ltd for the purpose of processing the payment. If you choose to pay by online card payment, I will also pass your name and email address to Squareup International Ltd for the purpose of generating and sending you an invoice with a payment link. For more details you can view the relevant Squareup privacy notice here.
After counselling has ended
Once counselling has ended my records of your contact details, session notes and any retained correspondence will be kept for up to two years from the date of our last session, and will then be securely destroyed. The reason for keeping these records for up to two years is in case you wish to resume counselling within this time period, which may relate to issues discussed in previous counselling. If you want me to delete your information sooner than this, please tell me.
I will keep copies of my invoices and financial transactions with you as required by taxation legislation.
My lawful basis for holding and using your personal information
UK GDPR states that I must have a lawful basis for processing your personal data. There are different lawful bases depending on the situation in which I am processing your data. I explain these below:
If you are currently having counselling or if you are in contact with me to consider counselling, I will process your personal data where it is necessary for the performance of our contract, or to take steps at your request prior to entering into a contract.
If you have had counselling with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information. The legitimate interest is that you may resume counselling with me and it may then be beneficial for me to refer to information processed previously.
The GDPR also requires that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called ‘special category personal information,’ and can include for example information about your health, political opinions, religious or philosophical beliefs, racial or ethnic origin, gender, sexual orientation, sex life, amongst other things. The lawful basis for me processing any special categories of personal information is that it is for provision of health treatment (in this case counselling) and necessary for a contract with a health professional (a contract between me and you).
For any enquiries and correspondence not relating to a counselling contract or steps prior to entering into a contract, I will use legitimate interest as my lawful basis for processing your information. The legitimate interest is the proper administration of my business and communications with you.
You have a right to ask me to delete your personal information, to limit how I use your personal information, or to stop processing your personal information. You also have a right to ask for a copy of any information that I hold about you and to object to the use of your personal data in some circumstances. You can read more about your rights at https://ico.org.uk/your-data-matters. If you ask about what information I hold about you, and if I do hold information about you, I will:
- give you a description of it and where it came from;
- tell you why I am holding it, tell you how long I will store your data and how I made this decision;
- tell you who it could be disclosed to;
- let you have a copy of the information in an intelligible form (the first copy will be provided free of charge, additional copies may be subject to a reasonable fee).
You can also ask me at any time to correct any mistakes there may be in the personal information I hold about you. To make a request for any personal information I may hold about you, please put the request in writing addressing it to email@example.com. If you have any complaint about how I handle your personal data please do not hesitate to get in touch with me by writing or emailing to the contact details given below. I would welcome any suggestions for improving my data protection procedures. If you want to make a formal complaint about the way I have processed your personal information you can contact the ICO which is the statutory body that oversees data protection law in the UK. For more information go to https://ico.org.uk/make-a-complaint.
My contact details and ICO registration
I am registered with the UK Information Commissioner’s Office (reference ZB182987) as the data controller in relation to my counselling practice. My email address is: firstname.lastname@example.org and my phone number is 07586 050 423.
--End of Privacy Statement--
© 2023 Richard Doyle.