Privacy notice for psychotherapy and career counselling clients

What information we collect, use, and why 

We collect or use the following information for safeguarding or public protection reasons: 

• Name, address and contact details 

• Emergency contact details 

• Health information (including medical conditions, allergies, medical requirements and medical history) 

• Records of session content, in which information about racial or ethnic origin, religious or philosophical beliefs, sexual orientation might be captured if relevant to the client’s situation.  Key health information will also be recorded.

 

We collect or use the following personal information to comply with legal requirements, i.e. our ethical responsibilities as practitioners: 

• Name 

• Contact information 

• Safeguarding information 

• Basic details of each session, covering an outline of the subjects discussed, any risk of harm to the client or others, or any other disclosures which would require reporting by law. 

• Health information 

 

We collect or use the following personal information for dealing with queries, complaints or claims: 

• Names and contact details 

• Address 

• Purchase or service history 

• Correspondence 

• Health information 

• Basic details of each session, covering an outline of the subjects discussed, any risk of harm to the client or others, or any other disclosures which would require reporting by law. 

• Assessment information relating to career development assessments, to include the results of psychometric tests, current work situation and educational background, in order to evidence the guidance provided. 

 

Lawful bases and data protection rights 

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

​

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website: https://ico.org.uk/for-organisations/advice-for-small-organisations/create-your-own-privacy-notice/your-data-protection-rights/#rte

 

If you make a request, we must respond to you without undue delay and in any event within one month. 

​

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice. 

 

Our lawful bases for the collection and use of your data 

Our lawful bases for collecting or using personal information for safeguarding or public protection reasons are: 

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. 

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object. 

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability. 

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: 

• Brief notes need to be recorded from each counselling session in order to build up an assessment of the client and their needs, a formulation of their difficulties, and to chart their progress - this is in the client's best interests as it supports the therapeutic process. Client contact details, their GP and emergency contact details are held in case this is needed for safeguarding purposes or in the event of the client falling ill during the session. The client's dynamic risk of harm to themselves or others also needs to be captured for the purposes of safeguarding. 

• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability. 

 

Our lawful bases for collecting or using personal information to comply with legal requirements are: 

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. 

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object. 

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability. 

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: 

• Clients are advised in advance that brief notes need to be recorded from each counselling session, this information is given verbally and in writing therefore clients provide informed consent to this. Client contact details as well as the details of their GP and an emergency contact are held in order the client or others they are associated with can be protected from harm, which is considered an ethical obligation of a psychologist's or counsellor's role according to the professional bodies I am registered with (HCPC, BPS). The client's dynamic risk of harm to themselves or others is also captured to meet this ethical obligation. 

• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability. 

 

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are: 

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. 

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object. 

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: 

• In the event that the client should perceive some serious disadvantage or injury as a result of the work, or that another person should bring a claim in relation to the client, it is necessary to record brief notes from each counselling session and their dynamic risk of harm to themselves or others in such a way that this can be associated with the client record. This is to provide a clear record of what was covered or not covered in the event of legal action being brought against the counsellor/psychologist, or by the client in relation to a claim by a third party.  

• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability. 

 

Where we get personal information from 

We get personal information directly from you rather than any third parties. 

 

How long we keep information 

We keep a client’s personal data as well as brief notes outlining the content of counselling sessions for a period of seven years following the final counselling session.  This duration of information retention is in line with the recommendations made for independent psychologists by the British Psychological Society (see https://explore.bps.org.uk/content/report-guideline/bpsrep.2017.inf115/chapter/bpsrep.2017.inf115.9) 

 

Who we share information with 

Others we share personal information with 

• Other health providers (e.g. GPs) 

• Organisations we need to share information with for safeguarding reasons, e.g. the emergency services 

• Organisations we’re legally obliged to share personal information with 

• As well as Microsoft, which provides both data storage and email services to our business.  

 

Duty of confidentiality 

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where: 

• you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses); 

• we have a legal requirement (including court orders) to collect, share or use the data; 

• on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime); 

• If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or 

• If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process. 

 

How we keep your data secure 

We keep sensitive information, i.e. the notes which summarise our psychotherapy or career counselling sessions, as well as the sensitive information about your perceived problems drawn from registration forms – separately from personal information which can identify you as a person.  Sensitive information is stored on OneNote on the Microsoft 365 platform, a system which is GDPR compliant.  Personal information is kept in a separate area of OneNote, and also in a password protected document on a secure computer’s hard drive.   

 

Sharing information outside the UK 

Where necessary, personal information may be transferred outside of the UK by our suppliers of IT programs and data storage: Microsoft. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. 

 

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above. 

- Organisation name: Microsoft 

- Category of recipient: Data storage and email provider 

- Country the personal information is sent to: United States 

- How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs). 

 

How to complain 

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. 

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

​

The ICO’s address:            

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

​

Helpline number: 0303 123 1113 

Website: https://www.ico.org.uk/make-a-complaint 

 

Last updated: 29 September 2024