Data and Privacy Notice
Introduction
Your privacy matters to me. Counselling involves sharing some of the most personal parts of your life, so I take the security and confidentiality of your information seriously. This notice explains what information I collect, why I need it, how I protect it, how long I keep it, and what rights you have over it. You can be confident that your personal information will be kept secure and used only for specified and legitimate purposes connected with providing and managing your counselling, meeting my legal and professional obligations, and protecting your safety and the safety of others. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended. I am happy to answer any questions you might have about my data protection policy, and you can contact me via sal@sallydonaldsoncounselling.com.
N.B.: ‘Data controller’ is the term used to describe the person/organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me. I am registered with the Information Commissioner’s Office [Insert registration number], [Company registration details if appropriate].
My lawful basis for holding and using your personal information
GDPR demands a lawful basis for processing your personal data, which differs depending on your stage of therapy. GDPR also demands that I look after any sensitive personal information (‘special category personal information’) that you may disclose to me appropriately. Specifically:
| Processing | Article 6 basis - Personal data | Article 9 condition (if applicable) Special Category data |
|---|---|---|
| Initial enquiry / contact | Article 6(1)(f) (Legitimate interests) and/or Article 6(1)(b) (Pre-contract steps) | N/A |
| Delivering counselling | Article 6(1)(b) (Contract) and/or Article 6(1)(a) (Consent) | Article 9(2)(a) (Consent) and/or Article 9(2)(h) (Health/Social Care) |
| Record keeping / retention | Article 6(1)(f) (Legitimate interests) and/or Article 6(1)(a) (Consent) and/or Article 6(1)(c) (Legal Obligation) | Article 9(2)(h) (Health/Social Care) and/or Article 9(2)(f) (Legal Obligation) |
| Emergency / safeguarding disclosure | Article 6(1)(c) (Legal Obligation) and/or Article 6(1)(d) (Vital Interests) and/or Article 6(1)(e) (Public Interest) | N/A |
| Payment / accounting | Article 6(1)(b) (Contract) and/or Article 6(1)(c) (Legal Obligation) | N/A |
| Doorbell footage | Article 6(1)(f) (Legitimate interests) | N/A |
Information I will hold about you
The records I keep will be minimal at all times and retained and destroyed in accordance with British Association for Counselling and Psychotherapy guidance, i.e. minimal data will be held securely for 7 years after our last session then destroyed.
Paper records
Anonymised handwritten notes from our discussions, and any diagrams and hypotheses discussed. Therapy notes may contain sensitive information about you, including information about your physical or mental health and, where relevant to our work, information concerning your identity, beliefs, relationships or other aspects of your life that you choose to discuss.
Paper records will be held in a pseudonymized folder in a locked metal cabinet, then delivered to the client or destroyed upon completion of therapy.
Electronic records
- Email and text message records of referral and assessment arrangements, contract documentation, and payment information.
- Calendar appointments (pseudonymized, minimal information).
- Payment details (pseudonymised, minimal information).
- Contract records including signed client consents.
- Client records containing some special category data - name, address, phone number, email address, emergency contact and their phone number, General Practitioner contact details, any relevant medical history.
- Digital screenshots of online whiteboard versions of the above-noted paper records/notes. These may include sensitive information about you, including information about your physical or mental health and, where relevant to our work, information concerning your identity, beliefs, relationships or other aspects of your life that you choose to discuss. These screenshots will be emailed to the client or deleted upon completing sessions with SDC.
- Electronic questionnaire (Outcome Measures) responses regarding client mental welfare, e.g. CORE-34, CORE-10, GAD-7, PHQ-9.
Additionally, in-person counselling is provided at my home, which has a doorbell camera. Footage is not accessed without a valid reason, e.g. damage to the property – however, all visitors are briefly recorded at the doorstep, and the footage is automatically retained for up to 3 months before being overwritten. I can delete this footage immediately on request.
Data retention summary
How long I will retain your data is mentioned as it is discussed, however for clarity I have summarised it here.
| Data | Retention period |
|---|---|
| Initial enquiry made, but not progressed | Deleted within 4 weeks |
| Therapy records | Deleted 7 years after final session |
| Paper notes, diagrams, timelines, artwork, etc. | Offered to client or destroyed during last session |
| In an unplanned ending - paper notes, diagrams, timelines, artwork, etc. | Deleted after 8 weeks |
| Financial / Accounting records, including attendance | Deleted 7 years after final session |
| Doorbell footage | Automatically deleted after 3 months, or can be deleted immediately on request |
How I will use your data
Initial contact
When you contact me with an enquiry about my counselling services, I will collect information to help me satisfy your enquiry. This may include your name, phone number, and any preferences for our contact, e.g. method, time of day. Alternatively, another trusted individual may give me your details when making an enquiry on your behalf. If you decide not to proceed, I will ensure all your personal data is deleted within 4 weeks. If you would like me to delete this information sooner, just let me know.
While you are accessing counselling
Everything you discuss with me is confidential. That confidentiality will only be broken if I have concern there is serious risk to yourself or others, or under very specific legal requirements such as the welfare of the public. I will always try to speak to you about this first, unless there are safeguarding issues that prevent this.
I will keep a record of your personal details to help the counselling services run smoothly. This data may be collected by email, by text message, and in online apps provided by Microsoft, e.g. outlook/calendar, whiteboards, forms and word. Your data will be used for collaborative therapeutic purposes, as well as my administrative records. All electronic data will be pseudonymised (using a reference) wherever possible and securely stored. Any paper artefacts produced during counselling sessions will always be anonymous and clients will have the choice to take them away or keep them in a pseudonymised file in a locked metal cabinet in the counselling room. Any artefacts produced during online sessions (e.g. work on whiteboards) will be added to client electronic records as a screenshot, with the online data deleted following the session.
Additionally, in-person counselling is provided at my home, which has a doorbell camera. Footage is not accessed without a valid reason, e.g. damage to the property – however, all visitors are briefly recorded at the doorstep, and the footage is automatically retained for up to 3 months before being overwritten. I can delete this footage immediately on request.
After counselling has ended
Any paper artefacts will be offered to you or shredded during our final session.
Electronic records will be minimal and will be destroyed in accordance with British Association for Counselling and Psychotherapy guidance, i.e. after 7 years.
In the event of an unplanned ending, any paper artefacts or ongoing notes will be destroyed after 8 weeks, and minimal electronic records will be held until 7 years after that date.
Third party recipients of your data
I am the only person within my practice who routinely accesses your counselling records. Some personal information is necessarily processed or stored by trusted service providers that I use to operate my practice, including both personal data and special category data:
- Microsoft – in Microsoft 365 apps including Outlook, Word, Excel, Teams, Forms.
- EE – my phone service provider, holding any text messages between us.
I also have a Clinical Will, which means that in the event of my unexpected death or incapacitation, another qualified counsellor will be granted access to your first name and email address, so they can inform you. Your data would then be retained per this policy.
Your Rights
You have rights to ask me to correct or delete your personal information, limit how I use it, stop processing it, ask for a copy of it, and object to the use of it in some circumstances. You can read more about your specific rights at ico.org.uk/for-the-public. If you make a request (by email to: sal@sallydonaldsoncounselling.com), I will:
- Respond within one calendar month of receiving your request and any information needed to verify your identity. In some circumstances, the applicable data-protection rules allow this period to be extended (see ico.org.uk/for-the-public for those circumstances).
- Give you a description of the data, where it came from, why I am holding it, how long I will store it, and how I made those decisions
- Tell you who it could be disclosed to
- Let you have a copy of the information in an intelligible form.
If you have any complaint about how I handle your personal data, please do not hesitate to get in touch with me by email (sal@sallydonaldsoncounselling.com). I welcome any suggestions for improving my data protection procedures. If you want to make a formal complaint about the way I have processed your personal information you can contact the ICO, which is the statutory body that oversees data protection law in the UK. For more information go to ico.org.uk/make-a-complaint.
Data security
I take the security of the data I hold about you very seriously and take every effort to make sure it is kept secure. All identifying personal data is held separately from any notes on what we discuss. All electronic data is protected by secure authentication processes, and is only held in my business IT accounts, never my personal ones. I use the minimum of devices and never download client data unnecessarily. My laptop and phone are both secured by fingerprint and all applications and data are password-protected. Paper notes and artefacts created during our sessions will never contain client-identifying labels, only pseudonymised references, and are stored in a locked metal filing cabinet in the counselling room. These are offered to you when you complete your counselling or shredded during our last session.