Privacy Notice
1. About this Privacy Notice
Counselling in Preston with Claire Law is the trading name of Claire Law, who is the data controller for personal information processed in connection with the services described in this Privacy Notice.
Claire Law provides individual counselling and psychotherapy via in-person, online and telephone therapy. Claire Law also provides content writing and training services to individuals, groups and organisations.
This Privacy Notice explains how I collect, use, store and protect personal information and the rights you have in relation to your personal data.
I process personal information in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, together with relevant guidance from the Information Commissioner's Office (ICO).
I also work in accordance with the BACP Ethical Framework for the Counselling Professions 2026.
The BACP 2026 Ethical Framework requires practitioners to protect clients' confidentiality and privacy, explain how personal information is used and who may have access to it, explain foreseeable limitations to confidentiality, and maintain appropriate records.
2. What personal information do I collect?
The information I collect depends upon the service you are accessing and may include:
General personal information
name;
contact details, including telephone number, email address and home address where relevant;
date of birth, where relevant;
information about accessibility or communication needs;
appointment and attendance information;
correspondence between us;
information needed to administer the counselling relationship.
Counselling and health information
Where relevant to providing counselling, I may process information concerning:
mental health;
physical health;
emotional wellbeing;
previous or current treatment;
medication;
relevant medical information;
GP details;
other support services you are accessing;
information relating to risk, safeguarding or wellbeing.
Some of this information is special category personal data under data protection law and receives additional protection.
I only seek and process information that is relevant and necessary for the service being provided.
Safeguarding and risk information
Where relevant, I may process information relating to:
risk of harm to yourself or another person;
safeguarding concerns;
children or adults at risk;
information necessary to assess and manage risk;
information received from another professional or service where this is necessary and lawful.
Criminal offence information
Where relevant and necessary to provide a safe and appropriate service, I may process information concerning criminal convictions, offences or alleged offences.
Such information is subject to additional legal protections and will only be processed where there is an appropriate lawful basis and condition under applicable data protection law.
Financial information
I may process information relating to:
payments;
invoices;
refunds;
limited payment information necessary to administer the counselling service.
I do not routinely retain clients' full bank account or card details.
Emergency contact information
Where appropriate, I may collect the name and contact details of an emergency contact and/or relevant healthcare professional.
The circumstances in which this information may be used will be discussed with you where appropriate.
Online Appointment Booking – Calendly
I use Calendly as an online appointment scheduling service for people seeking to book an intro call prior to commencing counselling. If you use the Calendly booking facility on my website, I may collect your name, email address and telephone number, and ask you to confirm if you are in the UK, are over the age of 18 and whether your enquiry relates to you or someone else.
I use this information to arrange and manage appointments and communicate with you about your appointment.
Calendly processes this information on my behalf as a service provider/data processor. I remain responsible for the personal data I collect through the booking system.
My lawful basis for processing this information is Article 6(1)(b) UK GDPR – processing necessary to take steps at your request prior to entering into a contract. I only collect information that is necessary for arranging and managing your appointment.
Please note that Calendly has its own privacy information explaining how it processes personal data. Further information is available in the Calendly Privacy Notice.
Website Contact Form – Squarespace
My website includes a contact form provided by Squarespace. When you submit an enquiry through the form, I may collect information such as your name, email address, telephone number and the contents of your message.
I use this information to respond to your enquiry, communicate with you about counselling or psychotherapy services and, where appropriate, arrange an initial appointment.
Please avoid including detailed or highly sensitive information about your mental health or personal circumstances in the website contact form. Information provided through the form may be transmitted and stored using Squarespace and/or the email or other storage service connected to the form.
Squarespace acts as a service provider/data processor in relation to personal data that it processes on my behalf. I remain responsible for determining why and how I process the information you submit.
My lawful basis for processing contact enquiries is Article 6(1)(b) UK GDPR – processing necessary to take steps at your request prior to entering into a contract. I retain enquiry information only for as long as reasonably necessary for the purpose for which it was collected, subject to any applicable legal, professional or insurance requirements.
Further information about Squarespace's processing of personal data is available in its Privacy Policy.
CCTV
CCTV is installed within the carpark and covers the entrance to the premises where in-person counselling sessions take place. There are no CCTV cameras within the counselling room. The data controller for the CCTV is the landlord of the property. The purpose of the CCTV is to maintain the safety and security of the premises, and people attending the premises. The lawful basis for this processing is legitimate interests under Article 6(1)(f) UK GDPR. Surveillance is limited to what is reasonably necessary for this purpose. Recorded footage is securely stored, access is restricted to those who have a legitimate need to access it, and footage is retained only for as long as necessary for the stated purpose before being securely deleted.
Footage may be disclosed where necessary and lawful, for example where required by law or where necessary for the prevention or detection of crime or to protect an individual from serious harm.
Information about the operation of the camera is provided through appropriate signage at or before the area monitored by the camera.
3. Information contained in counselling records
I keep appropriate professional records of counselling work.
These records are:
factual and relevant;
adequate for the type of service being provided;
limited to information that is necessary;
stored securely; and
managed in accordance with applicable data protection and professional requirements.
Records may include information from counselling sessions, relevant correspondence, appointment information, risk or safeguarding information and other information necessary for the safe and effective provision of counselling.
Where practicable, identifying information is kept separately from clinical notes.
However, some records, such as emails, text messages, invoices and appointment records, may necessarily contain identifying information.
4. Why do I collect and use your personal information?
I use personal information where necessary to:
provide counselling or psychotherapy;
communicate with you about appointments;
understand your counselling needs;
provide a safe and appropriate therapeutic service;
maintain appropriate professional records;
assess and respond to safeguarding or serious-risk concerns;
communicate with relevant professionals or services where this is necessary and lawful;
administer payments and accounts;
meet legal, regulatory and professional responsibilities;
obtain professional supervision and consultation;
maintain continuity of care arrangements;
respond to complaints or concerns;
maintain appropriate professional insurance and governance; and
meet other legitimate professional or legal responsibilities.
I will not sell your personal information.
I will not use counselling information for direct marketing purposes.
5. Lawful bases for processing
Different types of personal information may be processed under different lawful bases.
Depending upon the circumstances, these may include:
contractual necessity, where processing is necessary to provide the counselling service you have requested;
legal obligation, where I am required to process information to comply with a legal requirement;
legitimate interests, where applicable and where these interests are not overridden by your rights and interests;
consent, where I have specifically asked for your consent and consent is the appropriate legal basis;
other lawful bases available under applicable data protection legislation.
Where special category information, such as health information, is processed, an additional condition under Article 9 UK GDPR will also be required.
Where criminal offence information is processed, the additional requirements of Article 10 UK GDPR and the Data Protection Act 2018 will apply.
The particular lawful basis and relevant special-category condition will depend upon the circumstances and purpose of the processing.
6. Confidentiality and privacy
Confidentiality is an important part of counselling, but total confidentiality cannot be guaranteed in every circumstance.
I will protect your personal information from unauthorised access or disclosure.
There are, however, foreseeable circumstances where information may need to be shared. These may include:
professional supervision in line with BACP requirements for Senior Accredited counsellors;
serious concerns about risk of harm;
safeguarding concerns;
legal requirements or lawful authority to disclose information;
circumstances where sharing information is otherwise legally and ethically justified.
Where it is safe and appropriate, I will discuss the need to share information with you beforehand.
There may be circumstances where I cannot do this, for example where doing so could increase risk or conflict with a legal requirement.
Where information needs to be shared, I will seek to share only information that is necessary and proportionate for the purpose.
7. Who may have access to your information?
The people or organisations who may receive or have access to your information will depend upon the circumstances.
These may include, where necessary and appropriate:
Claire Law;
my professional supervisor;
relevant safeguarding professionals;
healthcare professionals;
emergency services;
other professionals involved in your care, where appropriate and lawful;
courts or legal professionals where disclosure is legally required or authorised;
professional insurers where necessary;
organisations providing technical, administrative or payment services on my behalf.
Where a third party processes personal information on my behalf, I will take appropriate steps to ensure that the processing is governed by appropriate contractual and data-protection arrangements.
I will not disclose personally identifiable information simply because another organisation requests it.
8. Professional supervision
I receive regular professional supervision as part of maintaining safe, ethical and effective practice. This is in line with BACP requirements for Senior Accredited counsellors.
I may discuss aspects of my counselling work with my clinical supervisor.
Where practicable, I use anonymised information so that you cannot be readily identified.
Where personally identifiable information needs to be shared, I will consider whether the disclosure is necessary, proportionate and legally and ethically justified.
My supervisor is professionally required to respect the confidentiality of information discussed in supervision.
9. Professional will and continuity of care
I have arrangements in place for continuity of care in the event of my sudden death or prolonged incapacity.
My clinical supervisor has been instructed to enact a professional/clinical will in these circumstances.
This may involve my supervisor accessing limited client contact information so that clients can be informed that I am no longer able to provide therapy and, where appropriate, offered information about alternative sources of support.
Access to your information for this purpose will be limited to what is necessary and appropriate.
10. Sharing information for safeguarding or serious risk
I may need to share relevant information where I become concerned about:
serious risk of harm to you;
serious risk of harm to another person;
the safety or wellbeing of a child;
the safety or wellbeing of an adult at risk;
other circumstances where safeguarding action is necessary.
I will consider the circumstances carefully and may seek professional consultation from my clinical supervisor.
Where possible and safe, I will discuss concerns with you before sharing information.
Where information does need to be shared, I will seek to share the minimum information reasonably necessary and proportionate for the purpose.
11. Sharing information with your consent
There may be circumstances where you ask me to share information with another person or organisation, for example a GP, healthcare professional, employer or another service.
Where appropriate, I will discuss:
what information is being requested;
why it is being requested;
who will receive it;
the purpose for which it will be used; and
any limitations on what I can appropriately disclose.
Where consent is the appropriate legal basis for the disclosure, I will obtain your consent before sharing the information.
12. Counselling arranged through an organisation or third party
If counselling is arranged or funded by another individual or organisation, such as an employer, there may be contractual arrangements concerning what information can be shared with that organisation.
Before counselling begins, I will explain what information may be shared and with whom.
Unless there is a legal, safeguarding or other appropriate basis for disclosure, I will not share the content of counselling sessions simply because an organisation or another individual is paying for or arranging the service.
Where applicable, information such as attendance or appointment information may be shared in accordance with the arrangements agreed before counselling begins.
13. Data security
I take appropriate technical and organisational measures to protect personal information against:
unauthorised access;
accidental loss;
destruction;
alteration;
inappropriate disclosure; and
other forms of unlawful or unauthorised processing.
Paper records are stored securely.
Electronic information is stored using appropriate security measures, which may include password protection, device security, access controls, encryption and security updates, depending upon the system being used.
I regularly review the security arrangements used to process personal information.
14. Email, telephone and text messages
I may use email, telephone and SMS to communicate with you about appointments and other practical aspects of counselling.
These communication methods can involve privacy and security risks.
Please consider the privacy of the device, email account or telephone you use when communicating with me.
I will take reasonable steps to protect information I send and receive, but electronic communication can never be guaranteed to be completely secure.
15. Online counselling and digital platforms
Where counselling is provided online, personal information may be processed through the digital platform used (usually MS Teams) to provide the service.
I will take reasonable steps to use appropriate and secure technology and will consider confidentiality, privacy, security and data-protection implications when selecting and using digital services.
The particular online platform and any relevant privacy information will be provided or made available to you before online counselling begins.
Where a service provider processes personal information on my behalf, appropriate data-protection arrangements will be maintained.
16. Artificial intelligence and digital technology
I recognise that artificial intelligence and other digital technologies can create particular risks in counselling practice, including risks relating to confidentiality, privacy and data security.
I do not use publicly available generative AI tools to analyse, summarise, transcribe or generate clinical records from identifiable information about counselling clients.
17. Financial information
I do not routinely store clients' bank or payment-card details in counselling records.
Where payment is made by bank transfer, information relating to the payment may be retained as part of financial and accounting records.
If payment or refund details are provided to me by email or SMS solely to facilitate a transaction, I will delete them when they are no longer required for that purpose, subject to any legal or accounting requirements to retain relevant financial information.
18. Data retention
Counselling records are currently retained for five years following the end of the therapeutic relationship.
This retention period is based on my professional and insurance requirements and will be reviewed periodically.
Different types of information may have different retention requirements. For example, financial records may need to be retained for accounting or legal purposes for a different period.
When personal information is no longer required, it will be securely deleted, destroyed or otherwise disposed of.
19. Your data protection rights
Depending upon the circumstances and subject to applicable legal exemptions, you may have rights including:
the right to be informed about how your personal information is used;
the right to request access to your personal information;
the right to request correction of inaccurate or incomplete information;
the right to request erasure in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to object to certain processing;
the right to data portability where the legal conditions for this apply; and
rights concerning automated decision-making and profiling where applicable.
These rights are subject to conditions and exemptions under data protection law and therefore may not apply in every circumstance.
20. Making a Subject Access Request or other data protection request
If you wish to exercise your data protection rights, please contact:
Claire Law
Email: claire@freetobecounselling.org
You do not have to pay a fee to exercise your data protection rights.
I will normally respond to a valid request within one calendar month.
Where permitted by law, this period may be extended by up to a further two months where a request is complex or numerous. If an extension is required, I will explain this to you.
21. Data protection complaints
The Data (Use and Access) Act 2025 introduced new statutory requirements for organisations to provide a process for handling complaints about the processing of personal information. These requirements came into force on 19 June 2026.
If you have a concern about how I have handled your personal information, please contact:
Claire Law
Email: claire@freetobecounselling.org
I will:
provide a clear way for you to raise your concern;
acknowledge your complaint within 30 days;
investigate your complaint appropriately; and
communicate the outcome to you without undue delay.
If you remain dissatisfied with how your complaint has been handled, you may complain to the Information Commissioner's Office (ICO).
ICO website: https://ico.org.uk/
ICO telephone helpline: 0303 123 1113
You do not have to wait for me to complete my complaints process before contacting the ICO, although the ICO encourages people to raise concerns with the organisation first where appropriate.
22. Information Commissioner’s Office
I am registered with the Information Commissioner's Office where registration is required.
Further information about data protection rights and responsibilities is available from the ICO:
23. Changes to this Privacy Notice
This Privacy Notice may be updated from time to time to reflect:
changes in legislation;
changes to ICO guidance;
changes to BACP requirements or guidance;
changes to the services I provide;
changes to the technology or systems I use to process personal information; or
changes to my professional or organisational arrangements.
I will review this Privacy Notice regularly and update it where necessary.
Where a change is significant, I will take reasonable steps to bring the change to your attention.
Current version: September 2026
Next planned review: September 2027
Counselling in Preston with Claire Law
www.freetobecounselling.org
claire@freetobecounselling.org