Privacy Policy & GDPR

Cookies

Cookies are used on this website to make the site easier to use and to track the traffic patterns of visitors. We are operating an ‘implied consent’ policy which means that we assume you are happy with this usage. If you are not happy with this, then you should adjust your web browser settings to disallow cookies.

Your Personal Information – UK General Data Protection Regulation (GDPR)

This Privacy Policy explains what personal information I collect, why I collect it, how I use and protect it, how long I keep it, and your rights in relation to your personal information. I am committed to respecting your privacy and maintaining the confidentiality of information you share with me as part of your counselling, supervision and holistic therapy. This policy outlines my responsibilities under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, alongside my professional responsibilities as a member of the British Association for Counselling and Psychotherapy (BACP).

By supplying your contact details on enquiry or request of my services , you are agreeing to me holding confidential data about you. Any contact info you provide (including the contact form on this site) is not used for any marketing purposes nor provided to any third party for use for marketing purposes.

1. Therapist & Data Controller Details

Therapist / Data Controller: Lorna Ashley
ICO Registration Number: 00012203240
Mobile: 07739465165
Email: lornaashley@hotmail.co.uk

Lawful Bases for Processing Data (Articles 6 & 9)

Article 6(1)(b) (Contract): I process your basic contact details, appointment histories, financial records, and administrative data under this basis. This processing is strictly necessary to perform and administer our therapeutic or supervisory working agreement, including managing bookings and enforcing my 48-hour cancellation policy.
Article 9(2)(h) (Provision of Health or Social Care): Your clinical notes, reflections, and health-related history are legally classified as Special Category Data. I process this data under the legal framework of providing healthcare and therapeutic treatment. This guarantees that your clinical records are securely maintained in full compliance with my professional indemnity insurance retention mandates, and cannot be deleted prematurely.

What Personal Information I Collect & Why

Depending on the nature of our therapeutic or supervisory work, I collect and hold:

Your name, contact details, and appointment/attendance records.
Information provided during initial enquiries or session bookings.
Contextual clinical data and relevant information you choose to share during sessions.
Financial, billing, and administrative transaction details.
Emergency Contact & GP Information: As requested at the start of your contract, I collect the name and contact details of a trusted emergency contact, alongside your GP's name, surgery, and address. This data is held securely within your profile and is only accessed or shared under exceptional safeguarding circumstances where I am seriously concerned about your immediate, acute safety, in line with my contract's confidentiality terms.

I do not use your personal information for marketing purposes and do not provide your contact details to third parties for their marketing purposes.

Digital Platforms, Invoices & Payment Privacy

Records & Storage: All digital records and clinical notes are held securely on WriteUpp, an ISO 27001-certified and fully UK GDPR-compliant practice management platform. No artificial intelligence (AI) transcription, automated listening tools, or AI scribe software are utilized within my practice.
Online Sessions: When conducting sessions online, I use the Zoom platform and/or Microsoft Teams platforms, both of which are UK GDPR-compliant. While I make every effort to ensure the data integrity of the platforms I use for online work, I cannot guarantee that digital communication is 100% secure.
Direct Bank Transfers: Payments are made via direct bank transfer (BACS) into a dedicated, separate business bank account. When you make a transfer, your bank shares your account name, sort code, account number, and payment reference with my bank for accounting and tax purposes.
Payment Reference Privacy: To protect your confidentiality on financial statements, I ask that you use the date of your session followed by your initials (e.g., 010520LA) as the transaction reference. Please be aware that if you enter your full name or words like "counselling," this will appear permanently on both of our bank statements.
Invoicing via WriteUpp: I occasionally issue invoices directly from WriteUpp. These invoices may be delivered via email. Standard email delivery relies on external network providers, which cannot be guaranteed as 100% secure.
Online, email, telephone and messaging communications: If you choose to contact me by email, telephone, WhatsApp, Skype or another electronic communication service, the confidentiality and security of your information may also be affected by the provider of that service. Electronic communications cannot be guaranteed to be completely secure. No method of electronic transmission or storage can be guaranteed to be completely secure. However, I will take reasonable steps to protect information I hold, but you should consider the limitations of electronic communication when deciding what information to send electronically.

Confidentiality & Safeguarding Limitations

Confidentiality is an essential part of counselling. I will normally keep information you share with me confidential and take rigorous steps to protect it. In accordance with the BACP Ethical Framework, the exceptional limits where confidentiality must be broken include:

Consent: Where appropriate consent has been given or you have asked me to share information, for example with another professional involved in your care.
Safeguarding & Harm: If I reasonably believe that you or another person (specifically a child or a vulnerable adult) is at serious risk of significant harm, abuse, or exploitation. This incorporates my legal duties under the Children Act and the Care Act.
Compliance with law: If I am required to disclose information by a court of law, or if a disclosure concerns mandatory legal reporting under UK law, such as acts of terrorism under the Terrorism Act.
Professional Supervision: As required for professional practice, I discuss my clinical work with a qualified supervisor. During supervision, your identity is strictly and completely anonymised.
Where legally permissible and clinically safe, I will always make every effort to discuss any proposed disclosure with you before information is shared.

Clinical Continuity (Clinical Will)

In strict accordance with BACP ethical requirements, I maintain a formal Clinical Will to safeguard your continuity of care. In the unexpected event of my sudden illness, severe incapacity, or death, a designated Clinical Executor (who is a qualified practitioner bound by strict professional confidentiality) will be granted minimal, secure access to your contact information. They will contact you strictly to inform you of my absence, offer immediate transition support, and assist you with onward professional referrals if required.

Access to Records in the Event of Death or Incapacity

In the event of my death or permanent or temporary incapacity to practise, I have arrangements in place for a suitably qualified clinical executor to take responsibility for the appropriate management and safekeeping of client records. Where necessary, the clinical executor may access relevant client records and personal information to ensure their continued confidentiality, security, appropriate retention and, where necessary, arrangements for the safe transfer or disposal of records. The clinical executor will be expected to respect client confidentiality and handle all personal information in accordance with applicable data protection legislation and professional obligations. Client records will continue to be retained for the required period, including any additional retention requirements relating to clients who were under 18 when receiving counselling.

Retention of Information

I retain information only for as long as is necessary and appropriate for the purposes for which it is held. Data protection law does not generally prescribe a single retention period for counselling records. The relevant principle is that personal data should not be kept for longer than is necessary for the purpose for which it is processed

Clinical Records: Client notes and clinical files are retained securely for 7 years after our counselling or supervision agreement ends. Where clients are under 18, records will be retained for at least five years after the date they would have reached 18, in accordance with my professional indemnity insurer's requirements. Records may be retained for longer where there is a legal, professional or insurance requirement to do so.
Contact Details: Administrative contact details are retained for up to 10 years without ongoing contact, unless an insurance or legal requirement dictates a different duration.
After these respective periods may be reviewed where there is a specific legal, professional, insurance or other legitimate requirement to retain information for a different period.

Your Data Rights

Under data protection law, you have rights including the right to be informed, the right to request a copy of your records via a Subject Access Request, and the right to rectify inaccuracies. These rights are subject to specific exemptions; for example, I cannot delete clinical records prematurely if I have an overriding legal or insurance obligation to retain them

Data Protection Complaints

If you have a concern about how I handle your personal information, you have the right to lodge a data protection complaint directly with me:

Contact: Lorna Ashley (lornaashley@hotmail.co.uk / 07739465165)

Please explain your concern and, where possible, provide enough information for me to understand what has happened. In compliance with the Data (Use and Access) Act 2025, the formal complaint procedure is as follows:

I will acknowledge receipt of your data protection complaint within 30 days. The 30-day acknowledgement period does not mean that every complaint must be resolved within 30 days. The time required to investigate will depend on the nature and complexity of the complaint.
I will investigate the matter appropriately, without undue delay, and keep you reasonably informed of its progress.
I will provide you with the formal outcome of the investigation in writing without undue delay.

You also retain the absolute right to escalate data complaints directly to the Information Commissioner’s Office (ICO) via their official channels if you believe your information has not been handled in accordance with the law. Full details of your rights can be found at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
You may withdraw your consent for us to hold and process your data at any time. However, if you do this while actively receiving counselling or complementary treatments, further sessions may have to stop. If you wish to exercise any of these rights, please use the contact details given above. If you are dissatisfied with the response you can complain to the Information Commissioner’s Office; their contact details are at:

Accuracy of information

I aim to ensure that personal information I hold is accurate and up to date. Please let me know if your contact details or other relevant information change, or if you believe information I hold about you is inaccurate..

Changes to this policy

I may update this Privacy Policy from time to time to reflect changes in legislation, professional requirements, technology or the way in which I operate my practice. The most recent version will apply to the information I hold and process.

Professional and ethical standards

As a BACP member, I recognise my professional responsibility to protect client confidentiality and privacy, maintain appropriate records and comply with applicable data protection requirements.

This Privacy Policy is intended to support those professional responsibilities alongside my legal obligations under UK data protection law.