1. Introduction & Contact Details

• Contact details:

  • Email: eleanorwhytecounselling@gmail.com

  • Address: 55 St Pauls Square, Birmingham, B3 1QS

• ICO registration number: ZB872845

As a professional integrative counsellor, I take your privacy seriously. This notice explains how I collect, use, store, and share your personal information, in compliance with UK data protection law (UK GDPR and Data Protection Act 2018).

2. What Personal Data I Collect & Use

When you engage with my counselling services, I may collect and process the following types of personal data:

1. Identity and contact data:

   • Name

   • Date of birth

   • Address

   • Telephone number

   • Email address

2. Therapy-related data:

   • Personal background, history, and life circumstances

   • Mental health and well-being information

   • Session notes (clinical/case notes)

   • Risk assessments, if applicable

   • Treatment plans, goals, and progress

   • Any correspondence (email, text) relating to therapy

3. Financial/payment data:

   • Billing information (e.g., bank details, invoicing)

   • Payment history

4. Administrative data:

   • Appointments (dates and times)

   • Records of cancellations or missed sessions

   • Consent forms

3. Why I Collect & Use Your Data

I use your personal data for the following purposes:

• To provide counselling services to you (assessment, treatment, monitoring progress)

• To manage appointments (scheduling, changes, cancellations)

• To manage payments and invoicing

• To fulfil legal, professional, and ethical obligations (for example, record-keeping under BACP guidelines)

• To maintain high quality of service (supervision, self-audit)

• To comply with any safeguarding or risk-management duties

4. Lawful Basis for Processing

I rely on the following lawful bases under UK GDPR:

• Legal obligation: I have a professional duty as a BACP member to keep case notes, and in some cases to report risk.

• Legitimate interests: It is in my legitimate interest to process your data in order to deliver effective counselling services, manage sessions, and maintain professional standards.

• Consent: For particular processing (e.g., recording of sessions), I may rely on your consent.

If I ask for your consent, you have the right to withdraw it at any time.

5. Where I Get the Data From

Primarily, I collect your data directly from you (during intake, in sessions, or via electronic forms). In some cases:

• I may get referral information from a third party (e.g., GP, another professional) — only if you have agreed to this referral.

• I may receive limited information from a funding body, if relevant.

6. Who I Share Your Data With

I will not share your personal therapy data with others without your explicit consent, except in the following circumstances:

• Supervision / professional oversight: I may share anonymised, de-identified case information with my supervisor, in line with my ethical obligations to ensure good practice.

• Legal or safeguarding obligations: If there is a risk of harm to you or others, or if required by law, I may need to share relevant data with appropriate authorities (e.g., social services, emergency services).

• Third-party service providers: I may use trusted data processors to help me (for example, an online booking system, secure client management software (“Splose”), and I ensure they GDPR compliant.

I will not sell your personal data.

7. Data Retention (How Long I Keep Your Data)

• I will keep session notes and personal data for a minimum of seven years, in line with BACP guidance and professional standards.

• When data is no longer needed, I will securely delete or anonymise it.

8. Your Rights

Under UK data protection law, you have the following rights:

• Right of access: You can request a copy of the personal data I hold about you.

• Right to rectification: If you think your data is inaccurate or incomplete, you can ask me to correct it.

• Right to erasure (“right to be forgotten”): In some cases, you can ask me to delete your data (subject to professional record-keeping obligations).

• Right to restriction of processing: You can ask me to restrict how I use your data in certain situations.

• Right to object: You can object to my processing of your data where I rely on legitimate interests.

• Right to data portability: If applicable, you can ask me to transfer your data to another data controller.

• Right to withdraw consent: If I rely on your consent for any processing, you can withdraw that consent.

To exercise any of these rights, please contact me at eleanorwhytecounselling@gmail.com.

If you remain dissatisfied after contacting me, you have the right to lodge a complaint with the ICO:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk (ICO)

9. Security Measures

I take the security of your data seriously:

• I use secure systems (e.g., encrypted devices, password-protected software) for storing electronic records.

• I regularly review my practices to ensure data is processed securely and in accordance with UK GDPR.

10. Changes to This Privacy Notice

I may update this privacy notice periodically. When I make changes, I will revise the “Last updated” date at the top and, where appropriate, notify you (e.g., via email or on my website).