Privacy Notice – Sarah Lucas Counselling
Contact Details
Sarah Lucas Counselling
Email: sarahlucas.counselling@gmail.com
If you have any questions about this privacy notice or how your information is handled, please contact me using the details above.
What Information Is Collected and Why
To Provide Counselling Services
The following personal information is collected and used in order to provide safe and effective counselling services:
Name, address and contact details
Date of birth
Next of kin and emergency contact details
Health information (including mental health history, medical history, medication and relevant background information)
Records of counselling sessions and professional decisions
Payment details (such as bank transfer information)
Special Category Data
Counselling involves processing sensitive information. This may include:
Health information
Racial or ethnic origin
Religious or philosophical beliefs
Sex life information
Sexual orientation information
This information is subject to additional protection under UK data protection law.
Safeguarding and Public Protection
In certain circumstances, personal information may be processed for safeguarding purposes. This may include:
Contact details
Emergency contact information
Health and risk information
Relevant session records
Legal and Administrative Purposes
Personal information may also be processed in order to:
Comply with legal obligations (such as tax and accounting requirements)
Manage complaints or disputes
Respond to enquiries
Lawful Bases for Processing
Under UK data protection law, the following lawful bases are relied upon:
Contract
Processing is necessary to enter into or fulfil a counselling agreement.
Legal obligation
Processing is necessary to comply with legal requirements.
Legitimate interests
Information may be processed where necessary for legitimate professional reasons, such as responding to enquiries or managing complaints, provided this does not override your rights and freedoms.
Vital interests
In rare and urgent situations, information may be processed where necessary to protect someone’s life or safety.
Special Category Data Condition
Special category data is processed under Article 9(2)(h) of the UK GDPR for the provision of health or social care (counselling), and where necessary under Article 9(2)(c) for vital interests or safeguarding purposes.
Your Data Protection Rights
Under UK data protection law, you have the right to:
Request access to your personal information
Request correction of inaccurate information
Request erasure of information (in certain circumstances)
Request restriction of processing
Object to processing
Request data portability (where applicable)
Requests will be responded to within one month.
To exercise your rights, please contact me using the details above.
Where Personal Information Is Obtained
Personal information is obtained directly from you.
If you contact me via the website contact form, the information you provide is transmitted securely via SSL encryption and delivered to my secure email account. Contact form submissions are not stored on the website database.
How Long Information Is Kept
Information is retained in line with professional and legal guidance:
Adult client records are retained for 7 years after therapy ends.
Where therapy is provided to someone under 18, records are retained until the client reaches age 25 (or 7 years after therapy ends, whichever is longer).
Financial records are retained for 6 years in accordance with HMRC requirements.
Enquiry information where therapy does not proceed is retained for up to 3 months and then securely deleted.
After the relevant retention period, information is securely deleted or destroyed.
Who Information Is Shared With
Personal information is not sold.
Information may be shared, where appropriate, with:
Other health professionals (with consent or where required)
Safeguarding agencies
Emergency services
Professional advisors (such as accountants or insurers)
Organisations where there is a legal requirement to share information
Data Processors
Third-party service providers are used to support the practice. These may include:
- Krystal Hosting (UK) – website hosting
- WPForms – contact form processing
- Google (Gmail) – secure email communication
- Calendly – appointment scheduling
- Zoom – online video sessions
- Natwest – payment processing services
These providers process personal information under contractual agreements and in accordance with data protection law.
Confidentiality
As a counsellor, there is a professional and legal duty of confidentiality.
Information shared in counselling will not be disclosed without your consent, except in limited circumstances, including:
Where there is a serious risk of harm to you or others
Where there are safeguarding concerns involving a child or vulnerable adult
Where disclosure is required by law (for example by court order)
Where there is an overriding public interest in preventing serious harm
Where possible, any need to share information will be discussed with you beforehand.
Information may also be discussed confidentially within professional supervision. Supervisors are bound by strict confidentiality.
International Transfers
Some service providers (such as Google and Calendly) may process personal information outside the UK, including in the United States.
Where this occurs, appropriate safeguards are in place, such as the UK Addendum to the EU Standard Contractual Clauses, to ensure that personal information is protected in accordance with UK data protection law.
How to Complain
If you have concerns about how your personal information is handled, please contact me in the first instance.
If you remain dissatisfied, you may contact:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: https://www.ico.org.uk