Privacy Policy

Counselling Privacy Notice

Your privacy is extremely important to me. This notice explains how I collect, use, store, and protect your personal information in line with current UK data protection law, including:

• UK GDPR
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR) 2003
• Data (Use and Practice) Act 2025 (DUPA)

I am always happy to discuss any concerns you may have about how your data is handled.

1. What information I collect and why

At the outset

I collect only the information necessary to respond to your enquiry and provide counselling services. This includes:

• your name
• contact number
• email address
• emergency contact details

This information is collected directly from you. Under DUPA, this constitutes declared data provenance.

If you choose not to continue after the first session, all information will be securely deleted after 90 days.

During counselling

I keep minimal session notes to support the safe and effective running of therapy. These notes:

• do not contain identifiable personal details
• are stored separately from your contact information
• are available for you to view in session upon written request
• cannot be copied or removed from the premises

I do not use automated decision‑making or AI‑based systems to process your information. All decisions relating to your therapy are made by me personally

2. Lawful basis for processing

Under UK GDPR and DUPA, I rely on the following lawful bases:

During therapy

• Contract – I need to contact you and maintain basic records to provide counselling services.

During and after therapy

• Legitimate Interest – I retain essential records (including emails and texts) for 3 years, as required by my insurance provider for potential claims or professional queries. After this period, all records are securely destroyed.

If you wish your records to be deleted sooner, you may request this in writing. Please note that early deletion means I cannot provide evidence of our work if required by an authority.

In the event of my death, all notes and contact details are destroyed immediately by my appointed professional executor.

Special category data

Sensitive information shared in therapy is processed under:

• Provision of health treatment (counselling)
• Contractual necessity
• Professional practice obligations

3. How your data is stored

I take data security very seriously.

• Electronic records are stored on password‑protected devices with an additional password protecting each document.
• Identifying information and session notes are stored separately using a pseudo‑numeric system known only to me.
• Paper notes contain no personal details and are kept in a locked cabinet.

I do not share your data with third parties unless legally required (e.g., safeguarding concerns or court orders).

4. Your rights

You have the following rights under UK GDPR and DUPA:

• Right to access – You may view the information I hold about you.
• Right to rectification – You may request corrections to inaccurate data.
• Right to erasure – You may request deletion of your data (subject to insurance obligations).
• Right to restrict processing – You may request limits on how your data is used.
• Right to data provenance – You may ask how and from whom your data was obtained.
• Right to object – You may object to non‑essential processing.
• Right to know how decisions are made about you – I confirm that no automated decision‑making is used.

Requests should be made in writing to: dannifindlaycounsellor@outlook.com

You may also contact the Information Commissioner’s Office (ICO), with whom I am registered, if you have concerns about how your data is handled.

5. Fair‑use boundaries (DUPA requirement)

Your data is used only for:

• contacting you
• providing counselling
• maintaining essential professional records
• meeting legal or safeguarding obligations

Your data is never used for marketing, profiling, automated decision‑making, or any purpose unrelated to therapy.

Any questions?

Please feel free to ask me about any aspect of this notice or how your data is handled.