1. Introduction

As part of my legal and ethical responsibilities as a therapist, I need to process and protect your personal data. Your privacy is highly important to me. You can be confident that your personal information will be kept safe and secure, and will only be used for the explicit purposes detailed below. I strictly adhere to current data protection legislation, including the General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act. This privacy notice explains my practices from your initial point of contact through to the period after your therapy has ended.

If you have any questions about this policy, please contact me directly at: laurenacharles49@gmail.com

2. Data Controller

A 'Data Controller' is the person or organisation responsible for collecting, storing, and managing personal data safely. In this instance, the Data Controller is me, Laurena Charles. 
• Registration Number: ZC162191 (Registered with the Information Commission)
• Contact Email: laurenacharles49@gmail.com

3. Lawful Basis for Holding and Using Your Personal Information

Under data protection law, I must establish a valid lawful basis to process your personal data:

Enquiries and Active Therapy: Processing your data is necessary for the performance of our contract (or taking steps to enter into a contract) to provide counselling services.

Sensitive 'Special Category' Data: Any sensitive health data or clinical notes shared are explicitly processed under the lawful basis of the provision of health or social care treatment, necessary for a contract with a regulated health professional.

Concluded Therapy & Website Visitors: Once therapy has concluded, or when you browse my website, I process data under the basis of Legitimate Interests. This includes statutory recognized legitimate interests such as keeping essential business records, administrative transparency, or safeguarding.

4. How I Collect and Use Your Information

Initial Contact & Enquiries:
When making an enquiry, I collect your name, address, email, telephone number, next of kin, and any optional contextual info you share. This info may also come from your GP or a family member on your behalf. If you decide not to proceed with therapy, all data associated with your inquiry will be securely deleted within three months (or sooner upon request).

During Active Therapy:

Everything discussed remains strictly confidential. This confidentiality is only breached if I believe you or someone else is in danger, or if a child is at risk of serious harm. I will always endeavour to discuss this step with you first unless prevented by immediate safeguarding risks.

To ensure services run smoothly, your personal file and brief written session notes are stored on Writeupp, an encrypted online clinical database. Text messages are not kept for longer than the duration of our contract; relevant information from texts or emails will be copied into your central file notes for security.

After Counselling Ends:
Your clinical file and notes are legally retained for 7 years following our final point of contact, after which they are securely destroyed. If you request an expedited deletion, I will provide a Data Request Form. Once completed, your data will be permanently deleted within 1 month.

5. Third-Party Recipients and Data Security

I do not sell or lease your personal data. I partner with essential, rigorously audited third-party service providers to execute required tasks. Contractual frameworks ensure these providers process data strictly inside their specified operations:

Writeupp: Secure, encrypted clinician database for all digital client paperwork and notes. Physical session papers are shredded immediately upon same-day upload.

HMRC: For lawful, mandatory end-of-year tax submissions.

Square & Starling Bank: For handling financial processing and the secure receipt of your payments.

Microsoft Teams: For executing encrypted, private remote video therapy calls.

Google Analytics & Wix: Google Analytics tracks aggregated, anonymous internet log data and site interactions to improve user experience. Wix acts as my website's content management system.

6. Your Data Rights

You possess significant legal rights over your personal data. You may request a full copy of your data in an intelligible form, ask me to fix existing factual errors, restrict how your information is handled, or object to specific processing contexts. You can explore comprehensive guidelines regarding these privileges via the Information Commission website.

7. Internal Complaints Procedure & Regulatory Reporting

In accordance with modern UK statutory obligations under the Data (Use and Access) Act, you have a formal right to lodge data protection complaints directly with me. Under this statutory framework, you are expected to utilize this internal complaints process to resolve disputes before seeking regulatory escalation.
To file a formal data protection complaint, please email me at laurenacharles49@gmail.com.

 

Upon receipt, I will adhere to the following strict timelines:

• Acknowledge your complaint in writing within 30 days of submission.

• Investigate the issue thoroughly and without undue delay.

• Provide a formal statement detailing the resolution, findings, and any remedies enacted.

​

If you remain unsatisfied with my internal investigation or final response, you retain the legal right to escalate your complaint to the UK supervisory authority, the Information Commission, online via ico.org.uk/make-a-complaint.