Privacy Policy

Your privacy is very important to me and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This privacy notice tells you what I will do with your personal information from initial point of contact through to after your counselling has ended, including:

• Why I am able to process your information and what purpose I am processing it for

• Whether you have to provide it to me

• How long I store it for

• Whether there are other recipients of your personal information

• Whether I intend to transfer it to another country, 

• Whether I do automated decision-making or profiling, and

• Your data protection rights.

I am happy to chat through any questions you might have about my data protection policy and you can contact me via email at kirsty@free2be.org.uk or on my mobile 07757 775551

‘Data controller’ is the term used to describe the person/organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me. 

I am registered with the Information Commissioner’s Office (ICO) Registration. The GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately.  This type of information is called ‘special category personal information’. The lawful basis for me processing any special categories of personal information is consent initially. I will then retain any counselling records in case of the need to reference them in the future (the official legal basis is to defend against potential legal claims). 

The ICO registration reference is ZB669572

To ensure the smooth running of counselling services I collect the following :

• Names and contact details

• Date of birth

• Health information if relevant (including dietary requirements, allergies and health conditions)

• Website user journey information such as and not exclusively IP address, internet service provider 

• Records of consent, where appropriate

• Racial or ethnic origin if relevant 

The GDPR states that I must have a lawful basis for processing you or your child's personal data.  There are different lawful bases depending on the stage at which I am processing your data.  These are explained below:

• Contract

If you or your child are having counselling with me, or have contacted me to find out about counselling, I will process your personal data and or that of your child's where it is necessary for the performance of our contract.

• Legitimate interest

If you or your child have had counselling with me and it is now ended, I will use legitimate interest as my lawful basis for holding and using your personal information. 

• Consent

The GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called ‘special category personal information’. The lawful basis for me processing any special categories of personal information is consent initially. 

• Legal

I will then retain any counselling records in case of the need to reference them in the future (the official legal basis is to defend against potential legal claims).

Everything the client discusses with me is confidential except in the following circumstances:

• There are safeguarding concerns regarding child protection and protection of vulnerable adults
• Risk of suicide or serious self-harm or harm to others. 

I am also required by law to break confidentiality if it is in the public interest to do in cases such as:

• Acts of terrorism
• Drug trafficking and money laundering
• Court orders or subpoenas

I will always try to speak to the client about any disclosures first unless there are safeguarding concerns that prevent this. 

As per good practice and as stipulated by the BACP I have regular supervision with a qualified supervisor.  This supports me in my work with clients, to provide the best possible outcome for them.  In supervision I discuss clients but these are always anonymised and no identifying information is shared. 

I never sell your personal information to any third party. 

When you contact me with an enquiry about my counselling  services I will collect information to help me satisfy your enquiry. 

This will include names, contact details, date of birth, GP or health professional information and consent from a parent or guardian if under the age of 18.  Alternatively a parent or trusted individual may give me your details when making an enquiry on your behalf.

If you decide not to proceed I will ensure all your personal data is deleted within 1 year. If you would like me to delete this information sooner, just let me know.

While you are accessing counselling, confidentiality is maintained according to the confidentiality clause above.  I will keep written process notes of each session for my supervision which I keep pseudonymised locked in a cabinet and are never removed from my office.  I keep an electronic file of the pseudonyms used to represent each client alongside name, address and referral information if appropriate.   These are stored in a password protected and encrypted file. 

For reference purposes any creative content that is produced during a session is stored in a file which is locked in a cabinet.  The client has full autonomy to destroy their own creative content at the end of each session or at anytime during all of the sessions.  Ultimately the ownership of the creative content of all sessions remains with the client.  However, the client is requested  to leave this creative content with the counsellor during the run of their sessions so that they can be used to see the progress/lifecycle made over the time we meet.  

Some of the creative content may be shown to my clinical supervisor as a reference point during my supervision sessions. 

At the end of the therapy sessions, the client can take the content home or leave it to be destroyed by shredding.   

For security reasons I do not retain text messages for more than the duration of sessions.  If there is relevant information contained in a text message I will record the information in the appropriate electronic file. Likewise any email correspondence will be archived to """""""""" once the agreed number of sessions have been completed. 

Once counselling has ended your records will be kept for 7 years as stipulated by my insurance policy. 

I never sell your personal information to any third party. 

I sometimes share personal data with my cloud service provider Microsoft Office 365 One Drive. I save the pseudonyms (a client number) used in the physical files that correspond to the client names in a Microsoft Excel spreadsheet. 

Microsoft are not contracted to use this data in anyway. Excel is simply used to record the client number data with the corresponding client name.