Privacy Policy
Introduction
I understand how important your privacy is. As an independent counsellor, I am responsible for the personal information I collect and hold about you. I handle your information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, alongside the ethical requirements of the British Association for Counselling and Psychotherapy (BACP). This policy explains what information I collect, why I use it, who may have access to it, how long I keep it and the rights you have in relation to your information.
2. What personal information I collect
To provide counselling safely and effectively, I may collect and hold the following information:
Contact and identification information
• Your name.
• Your address, email address and telephone number.
• Your date of birth, where provided or required.
• Your GP's contact details.
• The name and contact details of your nominated emergency contact.
Information relating to your counselling
• Clinical session notes and records of our work together.
• Relevant information about risk, safeguarding and any safety plans.
• Appointment records and correspondence relating to your counselling.
This may include special category personal data, particularly information about your physical or mental health.
Administrative and financial information
• Appointment dates and attendance records.
• Payment records and payment references.
• Correspondence relating to bookings, cancellations, invoices and fees.
You may also provide additional information voluntarily during our work together.
3. How I use your information
I use your personal information only where it is necessary for the provision and administration of my counselling service. This includes:
• Arranging, managing and communicating about appointments.
• Providing counselling and maintaining an appropriate record of our work.
• Understanding your circumstances and supporting your safety and wellbeing.
• Contacting your GP or nominated emergency contact where there is a serious concern about your safety or someone else's safety, where appropriate and lawful.
• Meeting my professional, legal and ethical responsibilities.
• Managing payments, invoices and financial records.
• Responding to requests to access or amend your information.
• Managing complaints and addressing any legal claims or professional concerns.
I discuss my clinical work with my clinical supervisor as part of my professional responsibility to provide safe and effective counselling. These discussions are confidential and I will refer to you by your first name only.
I do not use artificial intelligence tools to write, summarise or process clinical notes.
4. Lawful basis for processing your information
Data protection law requires me to have a lawful basis for using your personal information. Depending on the information and purpose, I rely on the following lawful bases:
• Contract: where processing is necessary to provide the counselling service you have requested and manage our therapeutic agreement.
• Legitimate interests: where processing is necessary for the proper administration, security and management of my practice, provided these interests do not override your rights.
• Legal obligation: where I need to process or retain information to comply with legal requirements.
• Health and social care: where I process special category information, such as information about your mental health, as necessary for the provision of health or social care, subject to the relevant confidentiality requirements.
Where I rely on consent for a particular activity, you can withdraw that consent. This does not affect processing that is lawful on another basis or information I am legally or professionally required to retain.
5. Where your information is stored and who may access it
I use the following providers to support the secure administration and delivery of my counselling service:
Kiku – practice management and clinical records
Kiku (www.wearekiku.com) is my practice management platform. I use it to store your contact details, GP and emergency contact information, appointment records, clinical notes and relevant counselling documents. Kiku provides secure, encrypted and password-protected storage. You can find further information in Kiku's Privacy Policy.
Gmail – email correspondence
I use Gmail for communication about appointments and other relevant matters relating to your counselling. Emails may contain personal information that you have shared with me or that is necessary for the administration of our work.
Microsoft Teams – online counselling
Where counselling takes place online, I use Microsoft Teams to conduct sessions. I do not routinely record counselling sessions.
Microsoft and Google may process information in accordance with their own privacy policies and service arrangements. You can find further information in their respective privacy notices.
Clinical supervision - I discuss aspects of my clinical work with my supervisor to support safe and ethical practice. Information is shared confidentially and I will use your first name only.
Clinical Executor - I have appointed a Clinical Executor to support the safe management and closure of my practice in the event of my death or serious incapacity. If this arrangement needs to be activated, my Clinical Executor may be given access to relevant client information for the limited purposes of identifying current clients, contacting them, managing appointments and ensuring that records are appropriately safeguarded. My Clinical Executor is required to maintain confidentiality and only access information necessary to fulfil these responsibilities.
Other disclosures - I will not sell or share your personal information with third parties for marketing or commercial purposes.
Information may be shared where necessary and lawful, for example:
• Where there is a serious concern about your safety or someone else's safety.
• Where disclosure is required by a court or other legal obligation.
• Where necessary to establish, exercise or defend legal claims.
• Where you have provided your consent to share information with another professional or organisation.
Where possible and appropriate, I will discuss any proposed disclosure with you beforehand.
6. Confidentiality and your counselling sessions
Everything you discuss with me is treated as confidential. There may be circumstances in which confidentiality needs to be limited, including:
• Where I have serious concerns about your safety or the safety of someone else.
• Where I am legally required to disclose information, for example by a court order.
• Where disclosure is necessary to meet safeguarding responsibilities.
I will endeavour to discuss any proposed disclosure with you beforehand, wherever it is appropriate and safe to do so. If your counselling is paid for or arranged through a third party, such as an employer, family member or other organisation, I will not share the content of your sessions with them. Any other information will only be shared where you have given written consent or where another lawful basis for disclosure applies.
7. How long I keep your information
I only retain personal information for as long as it is necessary for the purposes for which it was collected, taking account of my professional and legal responsibilities. My retention arrangements are as follows:
• Clinical notes: retained securely for up to seven years after your therapy ends, after which they will be confidentially destroyed.
• Your name and client reference number: retained for seven years after your therapy ends so that I can respond to any future requests relating to your treatment or clinical records.
• Personal contact information: your address, telephone number, email address, GP details and emergency contact information are deleted from my Kiku database when your therapy ends.
• Appointment and payment records: retained for as long as necessary for practice administration and to meet applicable financial, accounting and legal requirements.
• Emails and other correspondence: retained only for as long as necessary. Correspondence relevant to your clinical work may form part of your clinical record and be retained in line with
the clinical record retention period.
Records held in Kiku may be archived rather than immediately deleted. Archived records remain subject to the relevant confidentiality and retention arrangements.
8. Your data protection rights
Under data protection law, you have a number of rights in relation to the personal information I hold about you. These include:
The right to access your information - You can ask me to confirm what personal information I hold about you and request a copy of it, including relevant clinical records.
The right to rectification - You can ask me to correct inaccurate or incomplete personal information. Clinical notes record my professional account of sessions, so a request to change a clinical opinion or historical record may be handled by adding a clarification or correction rather than altering the original entry.
The right to erasure - You can ask me to delete your personal information. This right is not absolute and there may be circumstances in which I need to retain information, including where:
• It is necessary to meet legal or professional record-keeping requirements.
• I need the information to establish, exercise or defend legal claims.
• Another lawful reason requires me to retain it.
The right to restrict processing - You can ask me to restrict how I use your information in certain circumstances, for example while the accuracy of information is being checked.
The right to object - You can object to certain types of processing, including processing based on legitimate interests. I will consider your request in accordance with data protection law.
The right to data portability - In certain circumstances, you can request a copy of personal information you have provided to me in a structured, commonly used and machine-readable format, or ask for it to be transferred to another organisation where this right applies.
The right to withdraw consent - Where I rely on your consent for a particular use of your information, you can withdraw that consent at any time. This will not affect processing that has already taken place lawfully or processing carried out under another lawful basis.
These rights are subject to certain legal exemptions and limitations, particularly where information relates to other people or needs to be retained for legal or professional reasons.
9. How to exercise your rights
To exercise any of your data protection rights, please contact me directly:
Email: alicerout.counselling@gmail.com
Telephone: 07500 887162
Please explain what information or action you are requesting. I may need to ask you for information to confirm your identity before responding. I will normally respond to a data protection rights request within one calendar month. In certain circumstances, this period may be extended in accordance with data protection law and I will let you know if this applies.
10. Data protection complaints
If you are unhappy about how I have collected, used, stored or shared your personal information, you have the right to raise a data protection complaint directly with me. As a sole practitioner, I am responsible for receiving, investigating and responding to data protection complaints.
You can make a complaint by:
• Emailing me at alicerout.counselling@gmail.com.
• Writing to me using the contact details provided to you.
• Raising your concern verbally with me, after which I can help ensure it is recorded appropriately.
Please provide as much detail as possible about your concern and what you would like me to look into.
When I receive a data protection complaint, I will:
• Acknowledge receipt within 30 days.
• Make appropriate enquiries and investigate the matter without undue delay.
• Keep you informed of progress, particularly if the investigation takes time.
• Explain the outcome of my investigation and any action taken, without undue delay.
I will keep an appropriate record of the complaint, my investigation, the outcome and any action taken.
If you remain dissatisfied after raising your concern with me, you can complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113
My ICO registration number: ZB951265.
You do not have to raise a complaint with me before contacting the ICO, although the ICO generally recommends giving the organisation an opportunity to address your concern first.
11. Data security and breaches
I take reasonable steps to protect your personal information from loss, misuse, unauthorised access, alteration or disclosure. These measures include using secure, password-protected systems, encrypted devices and appropriate security protections. If a personal data breach occurs, I will assess the circumstances and take appropriate steps to contain and address it. Where the breach is likely to result in a risk to people's rights and freedoms, I will notify the ICO within 72 hours of becoming aware of it, where required by law. Where a breach is likely to result in a high risk to your rights and freedoms, I will also inform you without undue delay, where required.
12. Changes to this policy
I may update this Privacy Policy from time to time to reflect changes in legislation, professional guidance, the systems I use or the way I manage my practice. The most recent version will be made available to clients.
Last updated: 1 November 2026
Data controller: Alice Rout
ICO registration number: ZB951265
Contact: alicerout.counselling@gmail.com | 07500 887162