Privacy Notice
Effective August 2026
Review August 2027
How I look after your personal information
Counselling involves trust, including trust in how your information is handled. I collect only what I need, protect it carefully and explain openly what happens to it.
This notice explains what I collect, why I use it, who it may be shared with, how long I keep it and the choices and rights you have under UK data-protection law.
Who I am
Katie Smith MBACP, trading as Awaken Counselling & Therapy, is the Data Controller responsible for your personal information.
Contact details
Email: katie@awakencounsellingtherapy.co.uk
Telephone: 07356 295963
Website: www.awakencounsellingtherapy.co.uk
The information I collect
Depending on your contact with me and the service you receive, I may collect:
• Your name, date of birth, address and contact details.
• Emergency-contact and GP details.
• Registration, referral and appointment information.
• Relevant health, wellbeing and personal information you choose to share.
• Brief factual counselling notes and risk or safeguarding information where necessary.
• Emails, texts and telephone correspondence about our work.
• Payment and transaction records.
• Technical or usage information created by the secure services used to communicate with you, where applicable.
Counselling information may include special category data, such as information about health, disability, racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation. This receives additional legal protection.
Where information comes from
Most information comes directly from you. With your knowledge, I may also receive information from a referrer, GP or other professional, an emergency contact, or safeguarding and emergency services.
If information comes from elsewhere, I will provide this notice within the timescales required by law unless an exemption applies.
If you do not provide information
You choose what to share in counselling. However, I need some contact, identity, payment and safety information to arrange and provide the service. Without essential information, I may be unable to offer or continue counselling safely.
Why I collect your information
I use personal information only where it is necessary and proportionate to:
• Respond to enquiries and arrange, deliver and review counselling.
• Communicate about appointments, payments and practical matters.
• Keep appropriate and accurate professional records.
• Manage risk, safeguarding concerns and emergencies.
• Meet legal, tax, insurance and professional obligations.
• Establish, exercise or defend legal claims and respond to complaints.
• Keep the practice and its digital systems secure.
Lawful bases
Under Article 6 of the UK GDPR, the lawful bases I may rely on are:
Contract — where processing is necessary to take steps at your request or provide the counselling service we have agreed.
Legal obligation — where the law requires me to keep, use or disclose information.
Legitimate interests — where necessary to run a safe and ethical practice, maintain security, manage risk or protect legal rights, after considering your interests and rights.
Vital interests — in a rare emergency where processing is necessary to protect someone’s life.
Consent — for an optional use where consent is the appropriate basis and can be withdrawn.
Sensitive information
For special category data, I also need an Article 9 condition. I normally rely on your explicit consent where this is appropriate and the information is necessary for the counselling you have requested.
In limited circumstances, I may rely on vital interests or on processing necessary for the establishment, exercise or defence of legal claims.
Where I rely on consent, you may withdraw it at any time by contacting me. Withdrawal does not make earlier lawful processing unlawful. Some information may still need to be retained under another lawful basis.
No automated decisions
I do not use solely automated decision-making or profiling that produces legal or similarly significant effects for you.
Confidentiality and sharing
Counselling is confidential. I do not sell personal information or share it for other organisations’ marketing.
Information is shared only when there is an appropriate legal and ethical basis and only to the extent necessary.
Depending on the circumstances, information may be shared with:
• My clinical supervisor, normally without information that identifies you.
• A GP, healthcare professional, emergency service or safeguarding authority when agreed, legally required or necessary to address serious risk.
• BACP, my insurer, and legal or professional advisers where needed for a complaint, legal claim or professional obligation.
• A confidential clinical-will executor if I become unable to contact clients.
• Trusted technology providers supporting email, secure video, cloud storage, administration or payments, acting under appropriate data-protection arrangements.
• A court, law-enforcement body or other authority where disclosure is required or permitted by law.
Wherever possible, I will discuss a disclosure with you first unless doing so would increase risk, prejudice a legal process or prevent me from meeting a legal duty.
International transfers
Some technology providers may process information outside the UK. Where this happens, I use providers that rely on a UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum.
Information about relevant safeguards is available on request.
How information is protected
I use reasonable technical and organisational safeguards to protect your information.
Electronic records are protected by passwords and appropriate access controls. Cloud storage is encrypted where available, paper records are kept in locked storage, and access is limited to those who genuinely need it.
Online counselling
Online sessions use a secure platform. No internet service is completely risk-free, so you should join from a private space and protect your own device and internet connection.
I assess digital platforms before use and review confidentiality and security risks.
How long I keep information
Counselling records are normally kept for seven years after counselling ends, unless a different period is required by law, my insurer or professional guidance.
Financial records may be retained for the period required by tax law.
Enquiries that do not lead to counselling are kept only for as long as reasonably necessary for administration and are then securely deleted.
At the end of the relevant period, information is securely destroyed or permanently deleted. Retention periods may be extended where information is needed for an active complaint, safeguarding matter or legal claim.
Your information is processed under the UK GDPR because:
It is necessary for the performance of a contract (providing counselling).
It is necessary for compliance with legal obligations.
It is necessary for the provision of health-related support.
How your information is stored
Your personal information is stored securely using password-protected devices and secure systems. Any paper records are kept in locked storage.
I take reasonable steps to ensure your information remains confidential and secure.
Confidentiality
Everything discussed during counselling is treated as confidential.
There are rare exceptions where confidentiality may need to be broken, including:
Where there is a serious risk of harm to yourself or another person.
Where required by law.
Where safeguarding concerns arise.
Where possible, confidentiality will be discussed with you before any disclosure is made.
How long I keep your information
Client records are retained in accordance with current professional guidance from the British Association for Counselling and Psychotherapy (BACP), after which they are securely destroyed.
Clinical supervision
I attend regular clinical supervision. I protect your identity and share only what is necessary for safe and ethical reflection.
Identifying information is used only where there is a clear legal or ethical reason.
Artificial intelligence and digital tools
I may use secure digital tools, including AI, for limited administrative purposes such as improving general document wording or organising my practice.
Before using a tool, I assess its purpose, risks and data handling, consider any international transfers and take steps to protect confidentiality.
AI does not deliver counselling, analyse therapy sessions, make clinical decisions or replace my professional judgement.
I do not input your personal data into an AI tool without first explaining the purpose, benefits, limitations and risks, and obtaining your informed consent.
I critically evaluate any output and remain responsible for every professional decision.
Keeping this notice current
I review this notice regularly. If I plan a new use of personal information, I will update this notice and bring the change to your attention before the new processing begins.
Your data-protection rights
Your rights depend on the information involved and the lawful basis being used. Subject to legal limitations, you may ask me to:
• Give you access to your personal information.
• Correct inaccurate or incomplete information.
• Delete information where the right to erasure applies.
• Restrict how information is used in certain circumstances.
• Provide eligible information in a portable format.
• Stop processing based on consent after you withdraw that consent.
You also have the right to object to processing based on legitimate interests. Tell me why you object and I will stop unless I can demonstrate compelling legitimate grounds that override your interests and rights, or the processing is required for legal claims.
To exercise a right, contact me using the details below. I may need to confirm your identity.
I will normally respond within one month and will explain if a legal exemption or extension applies.
Your rights
You have the right to:
Request access to your personal information.
Request correction of inaccurate information.
Request deletion where appropriate.
Restrict how your information is used.
Object to certain types of processing.
Lodge a complaint with the Information Commissioner’s Office (ICO).
Questions or complaints
Please contact me first if you have a question or concern about how your information is handled. I will listen, investigate and try to resolve it.
You also have the right to complain to the Information Commissioner’s Office:
Website: www.ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
You may also seek independent legal advice. Raising a concern will not affect the care and respect you receive.
Contact me.
Katie Smith MBACP
Awaken Counselling & Therapy
Email: katie@awakencounsellingtherapy.co.uk
Telephone: 07356 295963
Website: www.awakencounsellingtherapy.co.uk
Helping you heal, grow and awaken to new possibilities.