Privacy Policy

Privacy, Data Protection & Digital Working Statement

My Mindful Counsellor

I take your privacy and confidentiality seriously. This statement explains what personal information I collect, why I need it, how I use and protect it, how long I keep it, and your rights.

It also explains how I use email, telephone, messaging, online counselling, supervision and AI-assisted tools in my practice. I am the Data Controller for the personal information I hold about my counselling clients and prospective clients. I process information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information do I collect?

If you enquire about counselling or become a client, I may collect information including:

your name, address, date of birth and contact details;
your preferred method of contact and pronouns;
GP and, where provided, emergency-contact details;
relevant physical and mental-health information and medication;
information about alcohol or drug use where relevant to safe and appropriate counselling;
information concerning self-harm, suicidal thoughts or other risks;
information you provide during counselling;
appointment and attendance information;
relevant correspondence; and
brief counselling records, risk assessments and other documents where appropriate.

I only collect information that is relevant to providing counselling safely, effectively and professionally, meeting my professional obligations and running my practice.

GP and emergency information

I normally ask clients to provide details of their current GP. This enables reliable identification and appropriate professional liaison if a significant health or safety concern arises.

Providing GP details will normally be a condition of my accepting a client where there are concerns involving suicide, self-harm or other significant risk. In very low-risk circumstances I may, at my professional discretion, agree to work without GP details.

I may contact a GP or another appropriate professional where I believe this is necessary in relation to significant risk, safeguarding or another serious concern. Where appropriate and safe, I will normally try to discuss this with you first, but there may be circumstances in which this is not possible or appropriate.

Providing an emergency contact/next of kin is optional. If you choose not to give permission for me to contact that person, this will not prevent you from receiving counselling from me. In a medical emergency I may contact the emergency services whether or not an emergency contact has been provided.

Confidentiality

What you tell me in counselling is confidential, subject to the limits explained in our Counselling Agreement.

There are circumstances in which I may need or be legally required to share information, including serious concerns about your safety or somebody else's safety, safeguarding concerns, prevention or detection of serious crime, a legal requirement or court order, or another situation in which disclosure is permitted or required by law or my professional obligations.

Where it is appropriate and safe to do so, I will normally try to discuss a disclosure with you first.

I will only disclose information that I consider necessary and proportionate in the circumstances.

Counselling notes and records

During counselling I may make brief handwritten working or process notes and keep other relevant working material.

At the end of counselling I normally prepare a brief closing summary recording matters such as the dates we worked together, the broad areas of work and any significant safety or accountability information that needs to form part of the retained record.

Routine handwritten process notes and separate working supervision notes are then securely destroyed.

The retained record may include the closing summary, contact details, Counselling Agreement and important documents such as a risk assessment where relevant.

I do not routinely print emails or retain unnecessary duplicate records.

How long do I keep information?

For adult clients, the retained counselling record is normally kept for seven years after counselling ends.

Records relating to clients who were under 18 are normally retained until the client reaches age 25.

Some information may be destroyed earlier where it is no longer required. For example, routine process notes are normally destroyed when counselling ends.

Information may occasionally need to be retained for longer where there is a continuing complaint, legal claim, insurance matter, legal obligation or other justified professional reason.

Records are securely destroyed or deleted when their retention period ends.

Where are my records kept?

Current paper client records are kept together in locked confidential storage within my private counselling room when not in use.

Closed paper records and archived appointment diaries are kept in locked archive storage within my private home until their destruction date.

Electronic client records are stored locally on my password-protected personal computer. I do not use a cloud-based client-record system.

These electronic client records are not currently backed up.

I also maintain a limited attendance record for professional/accreditation purposes. This records a client code and session dates rather than counselling content.

Email, telephone and messaging

I may use email, telephone, SMS/iMessage or WhatsApp for practical communication such as arranging appointments, sending forms, directions, payment information or relevant resources.

WhatsApp messages and calls use WhatsApp's end-to-end encryption, but WhatsApp/Meta may process account, device and usage information in accordance with its own privacy arrangements.

I do not use WhatsApp cloud backup for client conversations.

At the end of counselling I delete client contact details and client-related messages from my phone.

Email and ordinary SMS should not be regarded as completely confidential communication systems. Please consider this when deciding what information to send electronically.

Online and telephone counselling

Where appropriate, counselling may take place by Microsoft Teams, WhatsApp, FaceTime or telephone.

I take reasonable steps to conduct remote sessions privately at my end.

I do not record counselling sessions.

You are responsible for choosing a sufficiently private and safe place for your remote session and for telling me if somebody else may be able to hear or observe the session.

Neither of us should record a counselling session without the other's prior written agreement.

Digital platforms involve some unavoidable privacy and technical risks. Different providers process technical information about calls and use of their services in accordance with their own privacy arrangements.

Supervision

Professional supervision is an important part of safe and ethical counselling practice.

I discuss my work with a professional supervisor. Cases are discussed anonymously wherever practicable, and identifying information is minimised. I do not ordinarily provide surnames, addresses or contact details, although a first name may occasionally be used naturally in discussion.

My supervisor is also bound by professional confidentiality.

Use of AI-assisted tools

I may use AI-assisted tools for limited professional purposes such as general research, reflection, drafting or developing ideas and session materials.

I do not intentionally enter directly identifying client information into AI systems. I do not provide client names, contact details, copies of client records or detailed session notes.

Where client-related context is useful, I minimise and de-identify the information and may use a placeholder rather than a name.

AI does not replace professional supervision, therapeutic judgement or decision-making. I remain responsible for my professional decisions and for the counselling I provide.

Website, Wix, forms and cookies

My website is hosted using Wix.

If you submit an enquiry through the website, the information you enter is sent to me and is also stored within the Wix Forms and Submissions system.

The website uses essential cookies which are necessary for the website to function. These cannot be disabled.

You can choose whether to allow non-essential cookies, including analytics, functional and marketing cookies, through the website's cookie settings.

Where analytics cookies are accepted, Wix may provide information such as general location, device information, traffic source and how visitors interact with the website.

The website enquiry form also contains a separate optional choice allowing you to request information about other events and offers. You do not have to select this in order to contact me about counselling.

I will not use your counselling enquiry details for unrelated electronic marketing simply because you have contacted me.

Social media

If you initially contact me through social media or Messenger, I may ask you to continue the enquiry by telephone, email or through my website.

Once you become a client, I do not use social-media messaging as a counselling record and will normally delete the original social-media enquiry.

Please remember that social-media platforms process information according to their own privacy arrangements.

CCTV

I do not currently record counselling sessions or use CCTV within the counselling room.

If security CCTV is introduced elsewhere at my home in a way that may capture clients arriving or leaving, clients will be informed and appropriate privacy information will be provided.

What is my lawful basis for processing your information?

Different parts of UK data-protection law apply to different types of information and circumstances.

For ordinary personal information that is genuinely necessary for providing the counselling service you have requested, my principal lawful basis is normally that processing is necessary to take steps at your request before entering into our counselling agreement and to perform that agreement.

In some circumstances I may also process information because it is necessary for a legitimate interest, legal obligation, protection of vital interests, safeguarding, establishing or defending legal claims, or another lawful purpose.

Counselling necessarily involves particularly sensitive information, which may include health and mental-health information. This is known as special-category data.

Where appropriate, I ask for your explicit consent to process special-category information that is genuinely necessary to provide counselling safely and effectively. This is recorded in the Counselling Agreement.

There are also limited circumstances in which data-protection law permits or requires sensitive information to be processed without relying upon your consent, including certain circumstances involving vital interests, legal claims, safeguarding and confidential counselling.

Where consent is the applicable legal basis, you may withdraw that consent. This does not make processing which has already lawfully taken place invalid. If information is genuinely necessary for me to provide counselling safely, withdrawing consent may mean that I am unable to continue providing the service.

Who might receive information?

I do not sell client information.

Depending upon the circumstances, limited information may be processed by or disclosed to:

my professional supervisor;
my GP or another healthcare professional where appropriate;
emergency services or safeguarding services where necessary;
professional, legal or insurance advisers where necessary;
regulators, courts or other bodies where disclosure is required or lawfully justified;
my nominated clinical-will counsellor in the event of serious illness, incapacity or death; and
technology providers that I use to operate my practice, such as Wix, Google/Gmail, Microsoft, Apple and WhatsApp/Meta.

Only information that is relevant and necessary for the particular purpose should be shared.

Technology and processing outside the UK

Some of the technology providers I use are international organisations and information may therefore be processed or stored outside the UK.

Where UK data-protection law requires safeguards for an international transfer, the relevant provider is responsible for using an appropriate lawful transfer mechanism or other applicable safeguard.

No internet-based communication system can be guaranteed to be entirely risk-free.

Your data-protection rights

Depending upon the circumstances and the legal basis being used, you may have rights including:

to be informed about how your information is used;
to request access to personal information I hold about you;
to have inaccurate information corrected;
to request deletion of information in certain circumstances;
to request restriction of processing in certain circumstances;
to object to certain processing;
to data portability where applicable; and
to withdraw consent where processing relies upon consent.

These rights are not absolute in every situation. For example, I may need to retain information where there is a lawful reason or professional requirement to do so.

A normal request for access to your personal information is free of charge. A reasonable fee may only be charged where the law permits it, for example in certain cases involving manifestly unfounded or excessive requests or additional copies.

I may ask for reasonable information to confirm your identity before releasing personal information.

I will normally respond to a valid data-protection request within one month, subject to the extensions permitted by law in appropriate circumstances.

Data breaches

If a personal-data breach occurs, I will assess the nature and level of risk.

Where the law requires it, I will report a qualifying breach to the Information Commissioner's Office within the applicable statutory timescale.

Where a breach is likely to result in a high risk to your rights and freedoms, I will also inform you without undue delay unless an applicable legal exception applies.

If I become seriously ill, incapacitated or die

I have arrangements in place for a nominated counsellor to act under my clinical will if I become seriously ill, incapacitated or die.

They may be given appropriate access to my records in order to secure confidential information, make appropriate arrangements for active clients and manage retained records.

Existing records would continue to be protected and retained only for their existing appropriate retention period, unless a legal, insurance or professional reason required otherwise.

Questions, concerns and complaints

If you have a question about how I use your information or want to exercise a data-protection right, please contact me in the first instance.

If you are unhappy with how I have dealt with your personal information, you also have the right to complain to the Information Commissioner's Office (ICO).

Your informed choice

My Counselling Agreement provides a short summary of the important practical and confidentiality arrangements and links to this fuller statement.

Signing the Counselling Agreement confirms that you have been given this statement, or access to it, and have had the opportunity to read it and ask questions before agreeing to counselling.

Agreeing to counselling does not remove any of your data-protection rights and does not mean that every use of your information is based upon consent.

Where I specifically rely upon your explicit consent to process special-category information, that consent is recorded separately and clearly in the Counselling Agreement.

Last updated

October 2025