top of page

Sarah Thomson Counselling  Privacy Notice  Information About Your Personal Data

 

Welcome to my practice. This privacy policy explains how I, Sarah Thomson, collect, use, store, and protect your personal data when you interact with my website, make an enquiry, or engage in counselling sessions with me.

​

As a registered member of the British Association for Counselling and Psychotherapy (BACP), I am deeply committed to protecting your privacy and managing your personal information with the highest standards of clinical confidentiality and legal compliance.

 

1. Data Controller and Contact Information

Under the UK General Data Protection Regulation (UK GDPR), I operate as a sole trader and am designated as the Data Controller for all personal data collected throughout my practice.

​

If you have any questions about this privacy notice, how your data is handled, or if you wish to exercise any of your data protection rights, please contact me directly using the details below:

 

 

General Information

I am a qualified Humanistic Counsellor and Supervisor, registered by the British Association for Counselling and Psychotherapy (BACP), and a member of the Hampshire Association for Counselling and Psychotherapy (HACP).

​

I provide counselling and supervision for individuals and groups, both face-to-face and online. I practice in accordance with the BACP professional standards and ethical codes. I am professionally insured to work face-to-face and online, and am registered as a data controller with the Information Commissioner’s Office (ICO).

​

Definitions

  • The UK General Data Protection Regulation (UK GDPR): Relates to the privacy and protection of personal data under UK law.

  • Information Commissioner’s Office (ICO): The independent UK regulatory authority that upholds information and data rights.

  • I / Me / My: Refers to Sarah Thomson. As a Data Controller, I decide how and why your personal data is processed, and I am legally responsible for ensuring its protection.

  • Processing: Refers to anything that I do with your personal information (collecting, storing, reviewing, or destroying it).

 

2. Personal Data: What Information Do I Collect

Personal data refers to any identifiable information that relates to a living person.

 

Examples of the data that I may process include the following, which includes information known as "Special Category" data (*)(highly sensitive health or personal data) as defined by the ICO:

  • Name and contact details (including home address, phone number, and email).

  • Emergency contact (Next of Kin) details.

  • Demographic information (including date of birth, nationality, gender, or ethnic origin *).

  • GP’s name, practice, and contact details.

  • Any relevant health and medical conditions *.

  • Your broader support network (including other professionals and health agencies who work with you).

  • Information about your physical, mental, emotional, and sexual health and wellbeing *.

  • Background clinical context (including family history, lifestyle, employment, and education).

  • Religious or philosophical beliefs *.

  • Political opinions *.

  • Financial information (including invoices, banking records, and payment transaction details).

​

3. The Purpose: How I Use Your Personal Information

I collect and use your personal data for the following explicit purposes:

  • To satisfy and respond to initial service enquiries (including enquiries made on your behalf by a professional or trusted third party).

  • To make informed clinical assessments and provide appropriate counselling or supervision.

  • To manage scheduling and contact you regarding your sessions.

  • To write and maintain brief, factual sessional clinical notes.

  • To safeguard your welfare in the event of an emergency.

  • To reflect anonymously on clinical themes during mandatory professional supervision.

  • To maintain practice financial records, process transactions, and issue invoices.

  • Where necessary and with your explicit consent, to liaise with external agencies or medical professionals.

  • With explicit consent, to use fully anonymised case information for the purposes of research, professional publication, or training.

 

If I wish to use your personal data for a new purpose not covered by this privacy notice, I will issue you a new notice explaining this prior to processing.

​

4. The Lawful Basis for Collecting Your Personal Data

I process your personal data in strict accordance with the lawful processing conditions set out under the UK GDPR:

  • Consent: You give clear consent for me to process your personal data for specific therapeutic services as described in this privacy notice.

  • Contract: We enter into a client/therapist agreement whereby I require your personal data to properly and professionally carry out my contractual obligations.

  • Legal Obligation: I am legally obliged to break confidentiality and inform appropriate authorities if you make disclosures concerning statutory crimes (such as acts of terrorism, drug trafficking, or money laundering), or if my files are legally subpoenaed by a court of law.

  • Vital Interests: If a situation arises where it is vital to share your data to protect your life. For example, if you become seriously physically unwell during a session, I may share emergency contact details or known medical criteria with paramedics.

  • Special Category Processing: My legal basis for handling your health and therapy data falls under Article 9 of the UK GDPR relating to the provision of health or social care treatment.

 

5. Storage: How I Store and Protect Your Personal Information

All personal data is handled under strict conditions of confidentiality.

  • Paper Records: Any physical documents are stored securely inside a locked filing cabinet to which only I hold access keys.

  • Digital Practice Records: Electronic client records, online booking schedules, and intake forms are managed via WriteUpp, a specialised, encrypted, ISO27001-certified practice management system utilizing two-factor authentication.

  • Hardware Security: My dedicated business laptop and mobile communication devices are strictly password/passcode protected, stored securely when not in use, and housed inside locked premises.

  • Data Retention: As advised by my professional insurance provider and clinical best practices, I keep your records for a standard period of seven years after our work together ends (or seven years from a client's 18th birthday if working with minors). Once this retention period expires, all physical files are cross-shredded and digital entries are permanently deleted.

 

6. Disclosure and Confidentiality: When I Might Share Data

I am committed to clinical confidentiality. However, there are specific legal, professional, and ethical exceptions where your information may be shared with a third party. Where legally permissible and safe, I will always endeavour to discuss this with you first.

​

These exceptions are limited to:

  • Clinical Supervision: In accordance with BACP requirements, I regularly review my casework with a qualified clinical supervisor to maintain safe standards. All client presentations are completely pseudonymised (your name and defining details are never disclosed).

  • Safeguarding: If I develop serious concerns that you, or a child/vulnerable adult you mention, are at imminent risk of serious physical or psychological harm, I am ethically required to notify the appropriate authorities (such as your GP or emergency services).

  • Statutory Legal Requirements: If disclosures are made regarding acts of terrorism, money laundering, or drug trafficking, I am legally obligated to report this information to authorities without prior notification.

  • Clinical Will / Professional Executor: In the event of my unexpected sudden illness, accident, or demise, my designated Professional Executor (an appointed, fully qualified therapist bound by the same ethical data rules) will be granted restricted access to my current client list solely to contact you, offer notification, and arrange alternative care support. In such circumstances, clinical records will continue to be safely stored under seal for the required seven-year period.

 

7. Third-Party Data Processors and Service Providers

To operate my hybrid online and face-to-face practice efficiently, securely, and in accordance with professional standards, I utilize several trusted third-party cloud services, communications platforms, and financial software. These companies act as Data Processors on my behalf. Each provider maintains strict security protocols and complies fully with UK data protection acts.

​

  • Website Hosting & Analytics (Wix): My online web presence is built and hosted using Wix. Any information you submit through my website's contact forms or cookie interactions is processed via the Wix Privacy Policy.

  • Practice Management & Clinical Records (WriteUpp): Your online bookings, intake forms, contact details, and brief clinical notes are securely stored on WriteUpp, an encrypted, ISO27001-certified system. Their security structures can be reviewed via the WriteUpp Privacy Policy.

  • Online Therapy Sessions (Zoom): Online video consultations are conducted via Zoom using secure, encrypted streams. I do not record any sessions. For details on how they process technical diagnostic metadata, please see the Zoom Privacy Statement.

  • Online Booking Pre-payments (Stripe): Pre-payment transactions made through my website's integrated booking tool are processed securely via Stripe. I do not see or store your payment card numbers. You can review their security measures via the Stripe UK Privacy Policy.

  • Contactless Card Payments (Square): In-person card or terminal-based transactions are processed securely by Square. Their transaction data safeguards are detailed in the Square UK General Privacy Policy.

  • Business Banking & Transfers (Santander): Direct bank transfers (BACS) are processed through my professional business bank account with Santander, governed by the Santander UK Legal and Privacy Information.

  • Business Email & Communications (Google Workspace): My professional email service (counselling@sarahthomsoncounselling.com) is hosted through Google Workspace. Your email messages, contact details, and attachments are handled securely using enterprise-grade encryption in line with the Google Cloud Privacy Notice.

  • Initial Messaging & Enquiries (WhatsApp): If you choose to contact me via mobile chat apps for scheduling or general enquiries, data processing is handled under the WhatsApp UK Privacy Policy.

 

8. Your Data Protection Rights

Under data protection law, you have rights including:

  • Your right of access: You have the right to ask me for copies of your personal information and clinical records.

  • Your right to rectification: You have the right to ask me to rectify personal information you think is inaccurate or incomplete.

  • Your right to erasure: You have the right to ask me to erase your personal information in certain circumstances, subject to legal and professional insurance record-keeping requirements.

  • Your right to restriction of processing: You have the right to ask me to restrict the processing of your personal information in certain circumstances.

  • Your right to object to processing: You have the right to object to the processing of your personal information in certain circumstances.

  • You are not required to pay any charge for exercising your rights. If you make a request, I have one month to respond to you. Please contact me at counselling@sarahthomsoncounselling.com if you wish to make a request.

​

How to Complain

If you have any concerns about my use of your personal information, you can make a complaint to me directly. You can also complain to the ICO if you are unhappy with how I have used your data:

 

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO Website: ico.org.uk

bottom of page