Enquiry data is stored securely in email for a limited period and deleted when no longer required.

Booking and appointment data is processed via Acuity Scheduling. Website form data is processed via Squarespace, Contract form data is processed via DocuSign. Appropriate technical and organisational measures are in place to protect your data from unauthorised access, loss or misuse, including access controls and the separation of identifying information from counselling notes where applicable.

Data Sharing and Third Parties

I do not sell or rent your personal data.

Your data may be processed by trusted third-party service providers, including:

• Squarespace (website hosting and contact forms)

• Acuity Scheduling (appointment booking and administration)

• DocuSign (used for electronically signing contracts and consent forms) processes personal data on my behalf. DocuSign is a trusted third-party processor and complies with UK GDPR. You can view their privacy policy at https://www.docusign.com/company/privacy-policy

These providers process data on my behalf and are required to comply with UK GDPR.

 International Data Transfers

Some of the third-party service providers I use are based outside the United Kingdom. Where personal data is transferred outside the UK, appropriate safeguards are in place to ensure that your data is protected in accordance with UK GDPR requirements, such as the use of approved international data transfer agreements or adequacy regulations.

Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected, or to meet legal, regulatory or professional requirements. Enquiry data that does not result in a therapeutic relationship is deleted within a reasonable timeframe.

I keep brief summary counselling notes as part of the therapeutic record. These records are retained for seven years following the end of the counselling relationship, in line with professional and insurance requirements. This retention period applies unless a longer period is required for legal, regulatory, safeguarding, or insurance purposes.

In some circumstances, records may be retained for longer where this is necessary for legal, regulatory, safeguarding, or insurance purposes, including where there has been a court process, safeguarding concern, or other requirement to retain records beyond the standard period.

All paper records are stored in a locked filing cabinet. Client notes are identified using a unique reference code and are stored separately from identifying information in order to enhance security and confidentiality.

Your Rights

You have the right to:

• Access your personal data

• Request correction of inaccurate data

• Request erasure of your data, where appropriate

• Restrict or object to processing

• Request data portability

• Withdraw consent at any time where processing is based on consent

You may exercise these rights by contacting me using the details above. I will respond to valid requests without undue delay and within one month, in accordance with UK GDPR requirements.