Client privacy notice

I use contact and appointment details to communicate with you, administer bookings and payments, and provide counselling. Assessment information and brief session records help me understand your needs, review our work and support safe practice. They may include health, disability, ethnic origin, beliefs, sexual orientation or other sensitive information you choose to discuss. I record only what is relevant.

Most information comes from you. With agreed liaison, it may also come from a referring professional or someone involved in your care. I will explain information received from others where lawful. I do not routinely request criminal records or detailed information about other people.

Grounds are Article 6(1)(b), steps at your request before a contract and performance of our counselling contract, for assessment, care and administration; Article 6(1)(c) for legally required financial records; and Article 6(1)(f), legitimate interests, where necessary for proportionate practice protection or legal claims. These interests are balanced against your rights.

For sensitive information used in assessment, counselling and associated clinical supervision and records, this proposes your explicit consent under Article 9(2)(a), recorded separately on the counselling contract. You can withdraw it by contacting me. Withdrawal does not make earlier lawful processing unlawful. We will discuss what can continue safely without that processing and any alternatives, including ending counselling if necessary.

For exceptional safeguarding or emergency disclosures I must identify an applicable Article 6 basis and, where needed, an Article 9 condition and Data Protection Act condition. Vital interests is not a general exception: the special category condition applies only if you are physically or legally unable to consent. Legal claims may justify necessary sensitive data processing under Article 9(2)(f). I do not switch grounds simply to defeat a withdrawal of consent.

Paper records are kept in a locked cabinet. Electronic records are stored in Microsoft SharePoint within a dedicated MC Counselling Microsoft 365 business account, with access restricted to authorised users.

I use Microsoft Teams on this account for online counselling sessions. Sessions are not recorded or transcribed, and I do not use AI note-taking tools.

Relevant information may be shared with my clinical supervisor, professional executor or others in the circumstances explained in the confidentiality section. Only information necessary for the particular purpose will be shared. My bank processes payment information but does not receive counselling notes.

Microsoft processes information to provide these services. Some processing may take place outside the UK under the international-transfer protections described in Microsoft’s Data Protection Addendum, including standard contractual clauses adapted for UK requirements where applicable. A copy of these protections is available on request.

I do not sell your information, use it for marketing or make automated decisions about your counselling.

Enquiries that do not lead to counselling: 3 months from last contact. Assessment, agreement and clinical records: 6 years from the final session or assessment. Invoices and financial records are retained for at least 6 years after the 31 January submission deadline for the relevant tax year, and longer where legally required. Routine messages: 6 years from the final session.

These periods must be justified by purpose, applicable law and professional requirements; UK GDPR does not set one universal counselling retention period. Records are reviewed and securely deleted or destroyed when no longer needed, including through a defined backup deletion cycle. Any necessary extension for a specific complaint or legal claim is documented and kept under review.

You can request access, correction, deletion or restriction, object where legitimate interests apply, and request portability where its conditions apply. Rights depend on the lawful basis and circumstances. Contact the privacy address above. I will usually respond within one month, explaining any lawful extension or restriction. I may need to verify your identity and protect other people’s information.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You need not give every detail requested; if missing information prevents safe or workable counselling, I will explain why. Signing the agreement does not waive your rights or authorise unrelated uses. Training, case studies, research or recordings require a separate discussion and appropriate permission.