Privacy Policy

I understand how important your privacy and confidentiality are, particularly when sharing personal information in therapy. I take care to protect your personal information and handle it in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) act 2025.

I also follow the ethical guidelines and professional standards of the National Counselling and Psychotherapy Society (NCPS), including its guidance on confidentiality and the secure handling of client records. 

To provide counselling and psychotherapy, I need to collect and hold certain personal information, including your contact details and records relating to our work together. This policy explains what information I collect, why I collect it, how it is stored and used, and your rights in relation to your personal information.

Your personal information

I collect and store personal information that is necessary to arrange and provide counselling and psychotherapy.

Your contact details, booking information and email correspondence are stored in Google Workspace. This also includes the contact details of your GP and your nominated emergency contact, which I request as part of my duty of care.

Access to my Google Workspace account is protected by a password and two-factor authentication.

Your therapy notes and other clinical records are stored separately on an encrypted external hard drive, which is kept in a secure safe. Keeping  clinical records separately from your identifying and contact information helps to protect your privacy and confidentiality. 

I only collect information that is relevant and necessary for providing my service and maintaining appropriate records of our work together.

I do not sell your personal information or use it for marketing or research purposes.

Online Bookings

When you make an online booking, your booking information is processed through Google Workspace. I receive a booking notification by email so that I can manage your appointment. 

I keep a limited record of payments received for accounting and tax purposes. These records use your initials and unique client reference number rather than your full name wherever possible. As this information can be still linked to an individual, it is treated as personal data and stored securely.

As a self-employed practitioner, I am required to retain business and financial records for at least five years after the 31 January submission deadline for the relevant tax year. This period may be longer in certain circumstances such as a late tax return or an ongoing HMRC enquiry.

Website hosting and Cookies

My website is hosted by Namecheap through its EasyWP service. Namecheap processes website information on my behalf to provide the hosting service. Depending on the service and its infrastructure, information may be processed or transferred outside the UK. Namecheap describes the safeguards it uses for international data transfers in its data processing arrangements.

The website also uses cookies. Please refer to the Cookie Policy for information about the cookies used anyhow you can manage your preferences.

Your payment details

When you make an online booking, your booking information is processed through Google Workspace. I receive a booking notification by email so that I can manage your appointment.

I accept payment by bank transfer and through Stripe. When payment is made by bank transfer, I receive the payer’s name as part of the transaction information. If you choose to pay through Stripe, your payment information is processed by Stripe in accordance with its own privacy policy. 

I keep financial records of payments received for accounting and tax purposes. Wherever possible, these records use your initials and unique client reference number rather than your full name. This information is treated as personal data and stored securely.

I retain business and financial records in accordance with HMRC requirements.

Your therapy sessions and confidentiality

Confidentiality is an essential part of the therapeutic relationship. I aim to provide a safe and confidential space where you can talk openly about your experiences, thoughts and feelings.

What you share in therapy will be treated as confidential. I will not share identifiable information about you or the content of our sessions without your consent, except in circumstances where disclosure may be necessary or legally required.

There are some circumstances in which confidentiality may need to be limited. These include:

1. Risk of serious harm: Where I have serious concerns that you, another person or I may be at risk of significant harm, including concerns relating to suicide, serious self-harm, violence or abuse.

2. Safeguarding: Where there are concerns about the safety or welfare of a child or an adult at risk, information may need to be shared with appropriate safeguarding services or authorities.

3. Legal requirements: Where disclosure is required by law, for example through a valid court order or specific statutory reporting obligation.

4. Serious crime and public interest: In certain circumstances, information may need to be disclosed to the relevant authorities where there is a legal obligation or a sufficiently strong public interest justification, such as in relation to terrorism or serious criminal activity.

Where possible and appropriate, I will discuss any concerns with you before sharing information and explain what may need to be disclosed and why. However, there may be circumstances where the urgency or nature of the situation means I need to act without informing you beforehand.

Any disclosure will be limited to the information necessary for the purpose of protecting someone or meeting the relevant legal obligation.

I also discuss my clinical work in professional supervision, where information is anonymised wherever possible and confidentiality is maintained in accordance with professional and ethical requirements.

Your communications with me

If you contact me by email, your correspondence will be processed and stored through Google Workspace, which I use to manage communications with clients.

Access to my email account is protected by a password and two-factor authentication.

Google Workspace is a third-party service provider that processes information on my behalf. Google may store or process information in different locations, including outside the UK, in accordance with its data protection and international data transfer arrangements.

I treat email correspondence as confidential and only use it for purposes connected with providing and administering my counselling and psychotherapy service.

You can contact me directly at eefje@evolvingsensetherapy.com.

Data Usage

I use your email address to communicate with you about appointments and other matters relating to your therapy. This may include sharing information or resources that are relevant to your therapeutic process.

I use your telephone number to contact you where necessary, for example in an emergency or if there is an urgent matter relating to an appointment.

I will only use your contact details for purposes connected with providing and administering my counselling and psychotherapy service.

Your rights

Under data protection legislation, you have rights in relation to the personal information I hold about you. These rights include:

1. The right of access

You can ask for a copy of the personal information I hold about you, including your contact details, appointment records and therapy records. You can make this request by contacting me directly.

There may be circumstances where I cannot provide certain information, or where information needs to be redacted, in accordance with applicable legal exemptions.

2. The right to rectification

You can ask me to correct personal information that is inaccurate or incomplete, such as your contact details.

If you believe something in your therapy records is inaccurate, you can raise this with me. I will consider your request in line with my data protection obligations. Where a clinical record accurately reflects a professional observation or opinion, it may not be appropriate to alter the original entry, but I may be able to add a note recording your perspective or disagreement.

3. The right to erasure

You can ask me to delete personal information that I hold about you. This is sometimes called the ‘right to be forgotten’.

This right is not absolute. There may be circumstances where I need to retain some information, for example where it is necessary to meet professional or legal obligations, or to establish, exercise or defend legal claims. If I cannot comply with a request in full, I will explain why.

4. Other rights

Depending on the circumstances, you may also have the right to ask me to restrict how I use your personal information, or to object to certain types of processing.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO) if you believe your personal information has not been handled appropriately.

To exercise any of these rights, please contact me at eefje@evolvingsensetherapy.com.

Consent and your personal information

When you begin therapy, I will ask you to sign an agreement confirming that you understand and accept the arrangements for counselling or psychotherapy, including how your personal information is collected, stored and used as explained in this Privacy Policy.

This agreement is separate from the legal basis I rely on under data protection legislation to process your personal information.

If you have questions about how your information is handled, or wish to raise a concern about its use, you can contact me at eefje@evolvingsensetherapy.com.

Where I rely on your consent for a particular use of your personal information, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal. It also does not necessarily mean that I must delete information I am required or otherwise entitled to retain for another lawful purpose.

Breaches of data protection

I take appropriate steps to protect the personal information I hold. However, if a personal data breach occurs, I will investigate it promptly, take steps to contain and address it, and keep an appropriate record of the incident.

Where a breach is likely to pose a risk to people’s rights and freedoms, I will notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it.

If a breach is likely to result in a high risk to your rights and freedoms, I will also inform you without undue delay, explaining what has happened, the likely consequences and any steps you may need to take.

Raising concerns

If you have any concerns about how I collect, use, store or protect your personal information, please raise them with me in the first instance.

You can contact me at eefje@evolvingsensetherapy.com. I will take your concerns seriously and aim to respond promptly.

If you are unhappy with how I have handled your personal information or your concern, you also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

You can find further information or make a complaint at https://ico.org.uk/make-a-complaint/.

Data protection complaints procedure

If you have a concern or complaint about how I collect, use, store or protect your personal information, I encourage you to raise it with me in the first instance so that I have an opportunity to address it.

You can do this by speaking to me directly or by emailing eefje@evolvingsensetherapy.com.

I will acknowledge receipt of your complaint within 30 days. I will then investigate the matter, make any necessary enquiries and keep you informed of progress.

Once my investigation is complete, I will let you know the outcome and explain any action I have taken.

If you remain unhappy with how I have handled your personal information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

I am registered with the ICO under registration number 00011253264. You can find information about making a complaint at https://ico.org.uk/make-a-complaint/.