POLICY ON RETENTION OF PERSONAL DATA (UK GDPR and ICO compliant)

As a therapist in private practice I keep records of our work together for various reasons. The law requires me to keep certain records for specific periods including financial records and tax purposes. I maintain records in accordance with the professional standards expected of therapists in private practice and my BACP Ethical Framework (2018, currently being updated). My indemnity insurance requires me to retain records in case a claim is made after therapy ends. If you return to therapy, having access to previous records helps me provide appropriate support. All records may be needed if questions arise about the therapy work we undertook together. Details kept include contact details, session notes, assessment information, emails/letters between us, consent form/counselling contract, financial records and any referral information.

PERSONAL DATA

I collect and process the following types of personal data: Name, telephone number, email address, Emergency contact details, GP details and information offered via website contact form.

HEALTH & THERAPY INFORMATION

Your presenting issues and reason for seeking therapy, relevant medical and mental health history, information of current medication or treatment, session notes documenting our therapeutic work together and assessment and progress information.

IMPORTANT - Your health and therapy related information is classified as “special category data” under article 9 (1) of the UK GDPR meaning it receives enhanced legal protection, and I can only process it under certain conditions set out in law

HOW I COLLECT YOUR DATA

When you first contact me to enquire about therapy (phone, email or via website document), during our initial assessment intake session and throughout ongoing therapy sessions (including any questionnaires you complete as part of your therapy). I do not collect information about you from third parties without your knowledge, except if you have been referred through an Employee Assistance Programme (EAP) in which case I may receive limited referral information as part of that arrangement. This information is stored on encrypted, password protected devices or in paper records stored in a locked filing cabinet, in a secure room with limited access.

WHY I PROCESS YOUR DATA - LAWFUL BASIS

Under UK GDPR, I need a lawful basis to process your information AS therapy involves special category health data I need to satisfy two legal requirements -

ARTICLE 6 basis (General Personal Data) - processing is necessary for the performance of the therapeutic contract between us. We enter into a formal contract between us for therapy to take place, and your personal data is essential for me to fulfil that contract.

ARTICLE 9 basis (special category health data) - I rely on Article 9 (2) (h) UK GDPR - processing is necessary for the provision of health or social care treatment by a health professional. As a qualified therapist bound by professional confidentiality obligations, I am permitted to process your health information for the purpose of providing you therapy. The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes).

PROFESSIONAL OBLIGATIONS & SUPERVISION

I am required by my membership body BACP to attend regular clinical supervision (essential to practice). This helps me reflect on my work and ensures I provide you with the best care possible. In supervision, I DO NOT SHARE any personal identify8ing information. Anonymised material only is discussed. My supervisor is a qualified professional bound by the same confidentiality obligations as I am, and theory own professional body’s ethical framework. Supervision discussions are focused on the therapeutic process and my professional development, not identifying individual clients.

CLINICAL WILL

Should I be suddenly unable to practice due to serious illness, incapacity or death mu clinical supervisor will make contact with you as soon as possible. My supervisor is nominated as they are bound by professional confidentiality and can securely manage (or destroy records when appropriate), and contact clients to offer support or a referral.

WHO I SHARE YOUR DATA WITH

All information is treated as confidential, however the following parties may have access in limited circumstances -

Clinical Supervisor (as above)

EAP or REFERRAL PLATFORM - if you have been referred this way, I may share limited information with the organisation as part of their arrangement. This is usually limited to confirming your attendance, not personal identifying information from the sessions. This can be discussed and explained with you at the outset of our sessions.

Third-party Service Providers - this website runs on WordPress which may process certain technical data (basic analytics etc). Zoom/Microsoft Teams which is used for video sessions where agreed. Each of the above services are bound by a data processing agreement. Links to their privacy policies can be available on request.

I NEVER SELL YOUR PERSONAL DATA

KEEPING DATA

I only keep your personal information for as long as necessary. My professional insurance policy states I must keep adult client therapy records for 7 years after our last session (in line with the Limitation Act 1980). For clients under the age of 18, I must retain records until the client reaches the age of 25, this is extended retention to allow time for any claims after reaching adulthood. Financial records are kept for 6 years as an HMRC legal requirement and Website enquiries for 12 months. After the applicable retention period paper records are shredded and electronically stored records are permanently deleted using secure deletion software.

YOUR RIGHTS UNDER UK GDPR

You have the right to know how I use your personal data. This privacy policy fulfils that right. You can request a copy of the personal information I hold about you using a Subject Access Request (SAR) under the Data (use and Access) Act 2025. I will conduct a reasonable and proportionate search to locate your information and respond within one month. If any information I hold about you is inaccurate or incomplete, you can ask me to correct it. In certain circumstances you can ask me to delete your personal data. However this does not apply where I must keep your records to comply with professional guidelines and insurance requirements, or to defend potential legal claims. You can ask me to limit how I use your personal data in certain circumstances (eg while a complaint is being investigated).Where feasible, you can ask me to transfer you data in electronic format. You can object to certain types of processing however this is unlikely to apply to therapy records processed under the lawful bases I use. I do not use automated decision making or profiling in my practice.

YOUR RIGHTS UNDER DATA (USE AND ACCESS) ACT 2025

You have the right to make a data protection complaint directly to me. All complaints are taken seriously and I will respond promptly. To make a complaint please contact me at my email address, or discuss with me directly. If you are not satisfied with my response, you can escalate your complaint to the Information Commissioners Office (ICO): ico.org.uk

Telephone: 03031231113 Address: ICO, Wycliffe House, Water Lane Wilmslow SK9 5AF

CONFIDENTIALITY EXCEPTIONS

Everything shared in therapy is treated as confidential, however some circumstances I may need to share information without your consent -

Serious Risk Of Harm - If I believe you or someone else is at risk of serious harm

Safeguarding Concern - If I become aware of concerns about the safety or welfare of a child or vulnerable adult

Legal Requirement - If I receive a court order requiring disclosure, or in other limited circumstances required by law

In most cases, I will try to discuss any disclosure with your first, unless doing so would itself put you/someone at risk

This policy will be reviewed annually and if y practice changes significantly. If important changes are made that affect how I use your data, I will inform you directly.

If you have any questions about this privacy policy or your personal data, please email me to discuss.