Privacy Policy

1. Data you give me and why I collect it
2. Third parties
3. How I store your data
4. How long I keep confidential information for
5. When I share data
6. Data breaches
7. Your rights regarding your data
8. How to make a complaint

As a counsellor/psychotherapist in private practice, I hold some personal information about my clients. The information I hold is relevant to the counselling/psychotherapy service I provide and is used to help me carry out my work, which can be justified as legitimate interests for holding personal and sensitive data. I care about your privacy and am committed to protecting it, and I hope the following information helps you to trust that I hold your personal information securely.

I am registered with the Information Commissioner’s Office (ICO), complying with their guidelines and the 2018 GDPR legislation. A copy of my registration is available via the ICO website – search by my name.

Data you give to me and why I collect it

If you contact me to discuss an initial session you give me contact details such as your name, email address and/or phone number, so that I can reply to your enquiry.

If you continue with counselling/psychotherapy sessions I will ask you for your address and date of birth, and some personal information including brief details of any physical and/or mental health issues and relevant medication, as this may inform our work together.

I will request the name and phone number of an emergency contact so I can get in touch with someone if you are taken ill during a session - it is up to you whether you wish to provide these details.

I will request your GP’s contact details, and explain in your initial session that your decision to attend counselling sessions will not usually be disclosed to your GP, however if I believe that you or another person is at risk of serious harm it may be appropriate to contact them, and I would usually seek your permission before doing so.

I will use your email address to send you confirmation of ongoing appointments, payments received, and any other information relevant to your session bookings. As email is not guaranteed as secure, what you have disclosed in your sessions will not be directly referred to in emails. Any invoices and receipts requested will be sent to you by email.

I will contact you by phone if you have not arrived for a scheduled session, to reply to a text or missed call from you, or if I need to contact you urgently to cancel a session due to my illness or other emergency.

The information you disclose in your sessions will be logged in anonymised session notes - as required by my professional body (BACP) and my insurer.

Third parties

Most of the time I will keep your information confidential and not share your data with third parties without your signed permission, unless legally required to by a court subpoena.

If you have consented to somebody else arranging or paying for your sessions, I will need their contact details in order to send confirmation of appointments, and/or invoices, and/or receipts of payment as appropriate. What you disclose in your sessions will not be shared with these third parties.

Occasionally other people may wish to share information with me about you, I would inform you of this and it would usually only be with your permission.

How I store your data

I take reasonable security measures to protect your personal data storage. Your name, email address and phone number are stored on a pin-protected computer with regularly updated anti-virus software which runs frequent scans and protects sensitive documents from unauthorised access. The device encryption option is enabled which helps protect files against unauthorised access if the computer is lost or stolen.

Whenever possible I use a code rather than your full name, for example in my appointments diary, session and supervision notes, and to identify your phone number in a pin-protected smartphone for work use only.

The personal information on the forms you complete when commencing counselling are securely stored in a locked filing cabinet.

Any drawings, diagrams, or other material generated during F2F sessions may be taken with you, securely stored in a locked filing cabinet, or destroyed with your consent.

The notes I write about what you discuss in your sessions use a code to refer to you. They are anonymised without using names or other identifying details, and stored on an external hard drive which is stored in a locked filing cabinet. The electronic files are regularly scanned with anti-virus software which protects sensitive documents from unauthorised access.

Data processing software used

The security of your data is important and I have taken reasonable measures to choose software which support and implement this as a priority. Microsoft Office uses advanced encryption to secure data both at rest and in transit. For online sessions I use Zoom as it provides industry standard encryption of customer data in transit during meetings. Dropbox advertises itself as designed by default to keep data secure and offer secure file transfers.

For more information regarding the security of data processed by third party software I use to carry out my work, please refer to the following links:

Microsoft Office: https://microsoft.com/en-gb/trust-center/privacy/

Zoom: https://www.zoom.com/en/trust/security/

Dropbox: https://www.dropbox.com/en_GB/business/trust/

How long I keep confidential information for

Forms, session notes, and contact details, will be stored for seven years after you end your counselling sessions as this is a requirement of my insurance provider (and in case you wish to return) and then destroyed. Electronically stored sensitive information will be deleted, and paper copies of personal information will be shredded.

When I share data

As a precaution in case of my serious illness or sudden death I share your first name, email address, and telephone number with a trusted colleague so that she can contact you if I am unable to. Her name is Anneli Nilsson, she is a UKCP accredited psychotherapist. Your contact details are shared with her via a password-protected pdf on a secure file-sharing site (dropbox.com), the password is shared in a separate direct communication to her.

If she needs help in contacting multiple clients urgently, she may contact my clinical supervisor for assistance - his name is Richard Carroll, he is a BACP accredited counsellor and supervisor. Both Anneli Nilsson and Richard Carroll follow the same professional and ethical guidelines as myself regarding your privacy and confidentiality.

If you or someone close to you could be at serious risk of harm I may need to break confidentiality by sharing a minimal amount of information with another appropriate professional, such as your GP. I would usually discuss this with you first and seek your permission to do so. It would be rare to share information with another professional without informing you first, and I would only do so if I believed it to be in your best interests - or those of someone you have talked about.

I am legally required to share information disclosed to me relating to terrorist activity, money laundering, or drug trafficking.

Occasionally I might seek explicit consent to record sessions and/or share a case history in an anonymised form with peers, for the purpose of professional development or advanced training. Anyone agreeing would be asked to sign a consent form after hearing a more detailed explanation of what the process involves.

Data breaches

If there is a data breach affecting the confidentiality or privacy of someone's personal data which I hold, I am committed to reporting this to the Information Commissioner's Office (ICO) and directly notifying those affected within 72 hours of the breach.

Your rights regarding your data

You have many rights regarding your personal data, including knowing what information I hold about you, and the right to access that data. For further information please visit the Information Commissioner’s Office (ICO) website: https://ico.org.uk/your-data-matters/

If you wish to see, amend, delete or have a copy of your data please make a request in writing using my email address if you have it, or via the email contact form on this website: https://elizabethbutlercounselling.com/contact-me/

I will respond to you within one month of your request, and will undertake reasonable and proportionate searches in response to your request.

If you are transferring to another counsellor or psychotherapist a brief summary of your notes may be provided on request. This may take up to four weeks.

How to make a complaint

If you have a complaint regarding the use of your personal data please contact me directly - using my email address if you have it or via the email contact form on this website: https://elizabethbutlercounselling.com/contact-me/

I am committed to acknowledging receipt of your complaint within 30 days. I will do my best to help resolve the complaint, keep you informed about the progress of your complaint and let you know the outcome, as soon as I reasonably can, and without undue delay.

If the matter is not resolved to your satisfaction you may wish to make a formal complaint to the Information Commissioner’s Office (ICO). Their contact details may be found at https://ico.org.uk/

This Privacy Notice was last updated in Aug 2026