Code of Practice, Ethics and Privacy

What is GDPR?

• A law that protects personal data for people in the EU and EEA.
• Came into effect on 25 May 2018.
• Applies to any company worldwide that collects data from people in the EU.
• The UK Government enforces a similar version called the UK GDPR.

The Human Rights Act 1998

The Act sets out fundamental rights and freedoms everyone in the UK is entitled to. It incorporates the European Convention on Human Rights (ECHR) into domestic British law and came into force in October 2000.

In trauma work, knowing your rights can help your nervous system feel safer — these are not abstract legal concepts but real, objective protections.

What personal information I collect

I try to limit what I collect to what is genuinely necessary. That is usually your name and contact details. You can also provide your GP details or relevant health information if you wish — this is entirely your choice. I keep session notes for my own clinical supervision; these are held in line with BACP records guidance. Your sessions are confidential and you have a right to privacy. I do not contact your family, partner, or anyone else in your life. All communication is carefully guarded and kept confidential.

How I collect your information

I collect your personal information directly from you: when you first contact me to enquire about therapy; during our initial consultation and intake process; throughout our therapy sessions together; via email, telephone, or the contact form on my website; and when you provide updates or additional information relevant to your therapy. I do not collect personal information about you from third parties without your knowledge and consent.

Why I hold your information — lawful basis

UK GDPR requires me to have a valid legal reason for holding your personal information. Article 6 basis (general personal information): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. Article 9 basis (special category health information): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required by UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2. Processing is carried out by a qualified counsellor/psychotherapist bound by the BACP Ethical Framework.

Professional obligations and CPD

I am required by BACP to attend regular clinical supervision. I may discuss our therapeutic work with my supervisor using anonymised or pseudonymised case material only. My supervisor is a qualified professional bound by the same confidentiality obligations and their own professional body's ethical framework. Supervision discussions focus on the therapeutic process and my professional development, not on identifying you personally.

Who I share your information with

I use the following third-party services which may handle your information: this website and its hosting provider; the contact-form service used to receive enquiries; and Zoom, if you choose to have sessions remotely. Each provider is required to protect your information appropriately. The only person who may have access to information about our work is my clinical supervisor, who receives anonymised or pseudonymised case material only. I never sell your personal information or share your identifiable records with third parties for marketing purposes.

International transfers and using Zoom worldwide

Some of the services I use may handle personal information outside the United Kingdom. Where this happens, I take reasonable steps to ensure appropriate safeguards are in place, such as contractual protections or other measures recognised under UK data-protection law. You can contact me if you would like more information about the safeguards that apply. There may be international issues concerning GDPR in other countries perhaps.

How long I keep your records

Therapy records are retained for normally 7 years after our last session, in line with the Limitation Act 1980 and professional indemnity insurance requirements. BACP also recommend this requirement. Some clients have requested information about their sessions for reasons relating to divorce proceedings and legal processes, so i keep notes accordingly. I will always check with you first and i believe you have rights around confidentiality and privacy and I always protect you unreservedly. I always work in your best interests.

Your rights under UK GDPR

You have the following rights: Right to be informed — this privacy policy fulfils that right. Right of access — you can request a copy of the personal information I hold about you; I will respond within one month under the Data (Use and Access) Act 2025. Right to rectification — you can ask me to correct inaccurate information. Right to erasure — in some circumstances, subject to professional and legal obligations. Right to restrict processing — you can ask me to limit how I use your information. Right to portability — where technically feasible. Right to object — to certain types of processing. Rights relating to automated decision-making — I do not use automated decision-making. To exercise any of these rights, contact me at [email protected]

Privacy concerns

You have the right to raise a privacy concern directly with me. Please contact me at [email protected] and I will take your concern seriously and respond as promptly as possible. If you are not satisfied with my response, you may complain to the Information Commissioner's Office (ICO), the UK's independent authority. Their website is ico.org.uk and their telephone number is 0303 123 1113.

Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent: if I believe you or someone else is at serious risk of harm; safeguarding concerns relating to a child or vulnerable adult; a court order requiring disclosure; or where the law specifically requires it. I will always try to discuss this with you first, unless doing so would itself put someone at risk.

Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how your personal information is handled, I will inform you directly. The last updated date at the top of this policy shows when it was most recently revised.