Privacy Policy

Data Controller

I, Christine King, am the Data Controller for the personal information you provide. I handle your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

The Information I Collect

Depending on the service provided, I may collect:

• Your name, address, telephone number and email address.
• Your date of birth.
• Emergency contact details, where appropriate.
• Information about your physical and mental health that you choose to share.
• GP or referrer details, where appropriate and with your knowledge.
• Session notes, appointment history, payment and invoicing records.
• Information you send by email, text, telephone or through my website contact form.

Some of this information is special category personal data because it relates to your health.

Why I Collect Your Information

I use your information to:

• Provide counselling services.
• Arrange appointments and manage communication.
• Keep appropriate clinical records.
• Process payments and issue invoices.
• Meet professional, ethical and legal obligations.
• Protect clients or other people where safeguarding concerns arise.

Your information is not sold or used for marketing without your consent. I do not use automated decision-making or profiling.

Lawful Basis for Processing

I process personal information where necessary to provide counselling, manage appointments, respond to enquiries, keep records, comply with legal obligations, protect vital interests and, where needed, establish, exercise or defend legal claims.

Where I process special category health information, I do so under the lawful bases set out in UK GDPR and the Data Protection Act 2018, usually for health or social care purposes.

If I rely on consent, you may withdraw it at any time. If you do not provide certain information, I may not be able to offer counselling or respond fully to your enquiry.

Sharing Your Information

I only share information where necessary and appropriate. This may include:

• My clinical supervisor.
• Your GP or another health professional, with your consent or where needed for safety.
• Emergency services or safeguarding authorities where there is a serious risk of harm.
• Service providers such as my website host, email provider, booking system, payment processor, cloud storage provider or accountant.
• Professional advisers such as my insurer, legal adviser or accountant.

These third parties must keep your information secure and only use it for the purposes I instruct. If data is stored outside the UK, I will ensure appropriate safeguards are in place.

Confidentiality

Everything discussed in counselling is confidential, except where confidentiality must be broken, for example:

• Where there is a serious risk of harm to you or another person.
• Where there are safeguarding concerns involving a child or vulnerable adult.
• Where disclosure is required by law or a court order.

Where possible, I will discuss any necessary disclosure with you first.

Please note that email, text and other electronic communication may not be fully secure.

Clinical Supervision

I undertake regular clinical supervision as part of my professional practice. Client work may be discussed in supervision to support safe and effective work. Identifying details are removed where possible, and my supervisor is also bound by confidentiality.

How Long I Keep Your Information

I keep records in line with BACP guidance and my insurance requirements.

• Adult client records are normally kept for seven years after therapy ends.
• Records for children and young people are normally kept until the client reaches the age of 25, or 26 if they were 17 when therapy ended.
• Enquiries from people who do not become clients are normally kept for up to 12 months.
• Financial records are kept for the period required by tax law, usually six years.

Records may be kept longer if there is an ongoing complaint, safeguarding concern or legal claim.

Your Rights

You have the right to:

• Access your personal information.
• Correct inaccurate information.
• Request erasure where applicable.
• Request restriction of processing in certain circumstances.
• Object to certain processing.
• Request a copy of your personal information where applicable.
• Withdraw consent where consent is the basis for processing.

Some rights may be limited where professional or legal obligations apply. To exercise your rights, please contact me in writing using the details below. I may need to verify your identity before responding.

Data Security

I use appropriate technical and organisational measures to protect your information from unauthorised access, loss, misuse or disclosure. This may include password protection, secure storage, restricted access and encryption where available.

Data Protection Complaints

Under the Data (Use and Access) Act 2025, with relevant complaints provisions in force from 19 June 2026, you have the right to raise concerns about how I have handled your personal data.

If you have a complaint, please contact me in writing using the details below. I will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and provide a written response.

If you remain dissatisfied, you may complain to the Information Commissioner’s Office (ICO):

Cookies

My website may use essential cookies to function properly. If non-essential cookies or analytics are used, you will be asked for consent where required. Please see the cookie notice on my website for more information.

Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact me using the details above.