Privacy Notice

In my work as a psychotherapeutic counsellor at Graceful Counselling, I act as a data controller. I am responsible for collecting and processing the information that you have provided to me. Processing includes the organisation, retrieval, consultation, use, storing and destruction of information and its disclosure to other parties.  The main reason that your data is used by me is so that a counselling service can be provided to you.

Data Controller

The Data Controller responsible for your personal information is Grace Dalley.  Email grace@gracefulcounselling.co.uk

If you have any questions about this Privacy Notice or about how your information is managed, please contact me using the details above.

What information I collect, use, and why

I may process the following information about you:

  • Name, address and contact details
  • Gender
  • Date of birth
  • Emergency contact details
  • Information about your health, wellbeing and counselling needs
  • Correspondence relating to counselling services
  • Session notes and counselling records
  • Test results (including psychological evaluations)
  • Payment details (including card or bank information for transfers and direct debits)

I may also collect the following special category information:

  • Physical or mental health information
  • Racial or ethnic origin
  • Religious or philosophical beliefs
  • Sexual orientation information
  • Information relating to relationships and personal history

Your information is collected so that I can:

  • Assess your suitability for counselling
  • Provide safe and effective counselling services
  • Maintain counselling records
  • Communicate with you regarding appointments
  • Respond to enquiries
  • Manage payments
  • Maintain professional and ethical standards
  • Meet legal and regulatory obligations
  • Protect clients and others where safeguarding concerns arise
  • Respond to complaints or professional enquiries
  • Meet insurance requirements

The information that you provide is used by me for the purposes of assessing your needs and for providing a counselling service to you.  In exceptional circumstances, I may need to request further information from your GP or from another medical professional.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you believe that the information I hold about you is incorrect, or if you have concerns about how I am handling this information, please let me know.  If you wish to have your personal information deleted, please let me know and I will take reasonable steps to remove it unless I need to keep it for legal, insurance, auditing, internal risk management or archiving purposes.

If you make a request, we must respond to you without undue delay, and in any event, within one month.  To make a data protection rights request, please contact me at grace@gracefulcounselling.co.uk

Our lawful bases for the collection and use of your data

Our lawful bases for processing your data are:

  • Contract – the counselling service will be managed through a contract that we each sign. The legal basis I use for processing your data is that it is a necessary part of the contract. All of your data protection rights may apply except the right to object.
  • Legitimate interests – Certain processing activities are necessary for the safe and effective operation of the practice. These include
    • Professional supervision.
    • Record keeping.
    • Risk assessment and risk management.
    • Safeguarding responsibilities.
    • Responding to complaints.
    • Defending potential legal claims.
    • Maintaining professional standards.

These activities are carried out only where they are necessary and proportionate and do not override your rights and freedoms.

  • Special category data – Counselling involves the processing of sensitive personal information relating to health, wellbeing and other highly personal matters. This information is processed because it is necessary for the provision of counselling and healthcare-related services and for the management of those services in accordance with professional, ethical and legal obligations.

Your information may be used to provide counselling services, maintain appropriate client records, arrange and confirm appointments, assess risk and safeguarding concerns, engage in professional supervision, comply with legal an professional obligation, respond to complaints or requests for information and support safe and ethical practice.

How long we keep information 

Your information will be kept for a minimum of seven years following the end of counselling. Records may be kept for longer where required by:

  • Professional obligations.
  • Insurance requirements.
  • Safeguarding considerations.
  • Legal obligations.
  • Ongoing complaints, investigations or legal proceedings.

Any written information generated will be kept either in a locked filing cabinet and/or a password-protected laptop. Individual documents will also be password-protected.  At the end of the retention period, records will be securely destroyed or permanently deleted.

Storage and Security of Information

I take reasonable steps to protect your information from loss, misuse, unauthorised access or disclosure.

Information may be stored:

  • In secure paper records.
  • On password-protected devices.
  • Within encrypted digital systems.
  • Within secure professional practice systems.

Appropriate technical and organisational measures are used to protect personal information. Access to client information is restricted to those who have a legitimate and lawful reason to access it.

Who we share your information with

Some non-identifiable information may be shared with my supervisor who will provide professional advice and feedback to me. This will be done anonymously so you will not be identified from this process.

In rare instances, it may be necessary for me to share the information that you have disclosed to me with other individuals or organisations. Reasons for doing this include, but are not limited to:

  • as part of my duty to protect a child, a vulnerable adult, yourself or the public
  • for the prevention and detection of a crime
  • if I am required to do so by a court of law

I may also use some of this information for other reasons, such as to:

  • maintain records
  • respond to any enquiries you make about the services I have provided
  • investigate complaints
  • meet my statutory obligations
  • ensure the accuracy of my records

I will keep information about you strictly confidential. This means that I will store it securely and control who has access to it. I never use or share it for marketing purposes.  I will only share such information as necessary, and where I am satisfied that the other individual or organisation is entitled to receive it.

Clinical Will

I have a Clinical Will in place to ensure the appropriate management of client records and communications in accordance with professional requirements. If required, a nominated person who is bound by confidentiality obligations may access relevant information for this purpose.

Use of Digital Systems and Artificial Intelligence

Technology may be used to support certain aspects of the counselling service, including communication, record keeping and administration.  Any digital systems used within the practice are selected with consideration for security, confidentiality and data protection requirements.  Where Artificial Intelligence (AI) or digital tools are used, they will be subject to appropriate risk assessment. Personal client information will not be entered into AI systems without your informed consent.  Clients will be provided with clear information regarding the purpose, benefits and foreseeable risks of any AI-assisted systems used within the practice.  Responsibility for all professional decisions, safeguarding assessments and clinical judgements remains with me and will never be delegated to AI systems or automated tools.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to me: grace@gracefulcounselling.co.uk.  If you remain unhappy with how your data has been used after raising a complaint with me, you can also complain to the ICO:

The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113,  Website: https://www.ico.org.uk/make-a-complaint

You can also refer to the Information Commissioner’s Office website at https://ico.org.uk/. Their website explains your rights in relation to the information I hold.