Last updated: November 2026
Caroline Allan Counselling is committed to protecting your privacy and handling your personal information responsibly and in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).
This Privacy Policy explains what information I collect, how I use it, how it is stored, and your rights regarding your personal data.
DATA CONTROLLER
The data controller is: Caroline Allan
WHAT INFORMATION I COLLECT
Website Enquiries
If you contact me through my website, email, or telephone, I may collect:
- Your name
- Email address
- Telephone number
- Any information you choose to provide in your enquiry
Therapy Clients
If we decide to work together, I may collect:
- Personal contact details and emergency contact information
- GP details (where appropriate)
- Assessment information, clinical session notes, and relevant health histories
- Payment, invoicing, and transaction records
Special Category Data
As a counsellor, I process special category personal data relating to your physical or mental health. This information is collected only where strictly necessary to provide counselling services safely, ethically, and professionally.
LAWFUL BASIS FOR PROCESSING
Under data protection law, I must have a lawful basis to process your information. I rely on the following:
- Contract: Where processing is necessary to fulfil the therapeutic agreement or take pre-contractual steps (e.g., a free initial consultation).
- Legitimate Interests: For the effective, safe administration of my private counselling practice.
- Legal Obligation: Where I am required to comply with legal, statutory, or regulatory requirements.
- Special Category Data: Health-related data is processed under Article 9(2)(h) of the UK GDPR (provision of health or social care treatment) and Schedule 1, Part 1 of the Data Protection Act 2018.
YOUR RIGHTS
Under the GDPR your rights are as follows:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- the right not to be subject to automated decision-making including profiling.
CONFIDENTIALITY AND INFORMATION SHARING
Everything discussed in counselling is treated with strict confidentiality. However, there are limited legal and ethical circumstances where confidentiality may need to be broken, including:
- Where there is a serious, immediate risk of harm to yourself or others.
- Where safeguarding concerns arise involving a child or vulnerable adult.
- Where disclosure is mandated by law, statutory obligation, or a court order (e.g., drug trafficking, money laundering, or acts of terrorism).
Wherever ethically possible, I will discuss any necessary disclosure with you before sharing information.
Clinical Supervision
In accordance with professional body requirements (BACP), I attend regular clinical supervision. Client cases are discussed anonymously to protect your identity. No personally identifying information is shared with my supervisor unless a legal or safeguarding emergency arises.
DATA RETENTION
- Website and General Enquiries: Enquiries that do not result in a ongoing therapeutic relationship are securely deleted within 12 months.
- Client Records: In accordance with professional, ethical, and insurance frameworks, formal client records and clinical notes are retained securely for five years following the conclusion of therapy. After this period, records are permanently and securely destroyed.
Third-Party Service Providers
I use trusted third-party providers to support the operation of my website and counselling practice. These may include, but are not limited to:
- GoDaddy (website hosting)
- Google Analytics (website performance monitoring)
- Google Mail / Google Workspace (email communications)
- Zoom
- Clinical Will App
HOW YOUR INFORMATION IS STORED
I implement robust technical and organisational measures to safeguard your personal data against unauthorised access, loss, or misuse. This includes password-protected and encrypted devices, secure cloud-based practitioner storage systems, secure email accounts, and locked filing systems for any physical data.
COOKIES AND WEBSITE PERFORMANCE
This website uses cookies and anonymous website analytics to help improve performance and user experience. These analytics do not personally identify visitors.
YOUR RIGHTS
Under UK data protection law, you hold significant rights regarding your data, including the right to access your personal information, request corrections to inaccurate records, or object to certain processing. Please note that some rights may be legally limited where I am obligated to retain clinical records for professional, insurance, or legal purposes.
DATA PROTECTION COMPLAINTS PROCEDURE (DUAA COMPLIANT)
If you have concerns about how your personal data is handled, please contact me in the first instance so that I can try to resolve the matter.
To submit a complaint, please contact me via email at info@carolineallancounselling.co.ukor by post to my registered practice address.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). at www.ico.org.uk.
