Our Policy

Purpose
This document explains how the Practice collects, uses, stores, and protects personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Notice is provided as a standalone document to ensure compliance with data protection requirements and to provide clients with clear, accessible information about how their personal data is handled.
Information Collected
The Practice may collect and process the following personal information:
• Name and contact details;
• Date of birth;
• Emergency contact details;
• GP details (where appropriate);
• Information shared during assessment and therapy;
• Appointment records;
• Clinical notes;
• Correspondence relating to therapy;
• Payment and invoicing information where applicable.

How Information Is Used
Personal information is used to:
• Provide counselling and psychotherapy services;
• Maintain accurate clinical records;
• Communicate with clients regarding appointments and services;
• Meet legal, ethical, and professional obligations;
• Ensure the safe and effective delivery of services.

Lawful Basis for Processing
Personal data is processed under the lawful bases of:
• Legitimate interests;
• Performance of a contract.

Special category data (health information) is processed under Article 9(2)(h) for the provision of health or social care.
Sharing Information
Information will not normally be shared without consent unless:
• There is a safeguarding concern;
• There is a serious risk of harm;
• Disclosure is required by law or court order;
• Disclosure is necessary for legal or regulatory purposes.
Only the minimum necessary information will be shared.

Storage and Security
Personal information is stored securely using:
• Password-protected devices;
• Secure storage systems;
• Encrypted platforms where appropriate.
Access is restricted to the Practitioner unless disclosure is required.

Retention
Records are retained in line with professional guidance:
• Adult records: minimum of 7 years after therapy ends;
• Children’s records: until age 25 or longer, where appropriate.
Records are securely destroyed when no longer required.

Your Rights

Clients have the right to:
• Access their personal data;
• Request correction of inaccurate data;
• Request restriction or erasure where applicable;
• Object to certain processing;
• Lodge a complaint with the Information Commissioner’s Office (ICO).

Clients will receive a Privacy Notice explaining:
• What information is collected;
• Why it is collected;
• How it is used;
• Who it may be shared with;
• How long it is retained;
• The rights available under UK GDPR.

The Privacy Notice will be provided at the outset of services and made available upon request.
Contact for any queries or requests regarding personal data, clients should contact the practitioner directly by email at: Identifi5counselling@gmail.com