Privacy notice
LLintonCounselling
About this notice
This notice explains how LLintonCounselling looks after personal information: what we collect, why we hold it, who we may share it with and the rights you have over it.
It covers everyone we hold information about, including people who enquire without becoming clients, current and former clients, and people connected to our work such as family members or referrers.
Who we are
LLintonCounselling is the data controller for the information described in this notice. Controller is the legal term for the organisation that decides how and why personal information is used.
Questions about this notice, or about your information, go to Linda Linton. The quickest route is email: lindalintonuk@yahoo.co.uk.
We are based in Ipswich. Our full postal address is available on request.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our registration number is ZB872004.
Who this covers
We hold different amounts of information about different people. For most website visitors it is very little; for clients it includes the records we make in the course of our work together. This notice covers:
- people who contact us with an enquiry
- current and former clients
- family members, partners and other people who appear in our records
- people who refer clients to us, and professionals we work alongside
- visitors to our website
The information we hold
What we hold depends on your relationship with us. It can include:
- your name and contact details
- appointment and payment records
- what you share with us during our work together, and the notes we make about that work
- correspondence such as emails, letters and messages
We collect what the work needs and no more.
Where information comes from
Most of the information we hold comes directly from you: when you get in touch, complete a form, or talk with us during our work together.
Why we use information, and our lawful bases
The law requires a valid reason, called a lawful basis, for every use of personal information. This section lists each purpose we use information for and the basis we rely on. We have reviewed and confirmed each one.
Handling enquiries. Reading and replying when you contact us, and keeping a record of that exchange for a reasonable period. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Assessing whether we can help. Initial conversations and intake questions that help us decide together whether our service is right for you, including when the best answer is a referral elsewhere. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Providing the service itself. Running sessions, keeping in touch about the work and doing what we have agreed with you. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Managing appointments. Booking, rearranging and cancelling sessions and, where used, sending reminders. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Taking payment. Invoicing, processing payments, issuing receipts and keeping the financial records the law requires. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Keeping clinical records. Making and keeping session notes, assessments and related correspondence so the work is documented safely and professionally. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Clinical supervision. Discussing our client work with a clinical supervisor, as our profession expects, keeping identifying details to the minimum the discussion needs. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Safeguarding. Recording concerns and, where necessary, telling an appropriate authority that a child or an adult may be at risk of harm. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Emergencies. Contacting emergency services or your emergency contact if we believe your life, or someone else's, is in immediate danger. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Handling complaints. Receiving, looking into and responding to complaints, and keeping a record of what happened. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Responding to data rights requests. Handling requests to see, correct or delete information, including checking who is asking. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Legal claims. Using records if a dispute arises, for example a fee dispute, an insurance matter or a court order for notes. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Tax and accounting. Keeping invoices and financial records, filing returns and sharing what is needed with our accountant and HMRC. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Explicit consent (Article 9(2)(a)).
Professional body requirements. Meeting the requirements of our professional membership, such as holding insurance, engaging in supervision or cooperating with a conduct process. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)); Explicit consent (Article 9(2)(a)).
Insurance. Holding professional insurance and giving our insurer what it needs if a claim or notification arises. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)); Explicit consent (Article 9(2)(a)).
Keeping our website secure. Security logging, blocking attacks and preventing spam, which involves technical details such as IP addresses. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)).
Health and other sensitive information
Some kinds of information get extra legal protection, including anything about health, sex life or sexual orientation, race or ethnic origin, religious or philosophical beliefs, and biometric data. The law calls this special category data. Therapy involves health information by its nature, so much of what clients share with us falls into this group.
To use special category information we need both a lawful basis and a further specific condition, and we treat it with particular care.
For some processing we rely on your explicit consent (Article 9(2)(a)). Where we do, we ask clearly, we record your answer, and you can withdraw consent at any time without affecting the lawfulness of anything done before you withdrew it.
Clinical records
We keep clinical records of our work with clients, typically session notes, assessments and relevant correspondence. Records help us provide safe, consistent care. They are stored securely, access is limited to the people who genuinely need it, and they are kept for the periods set out in our retention policy before being securely destroyed.
Supervision
Like most therapy professionals, we have regular clinical supervision, where aspects of client work are discussed with an experienced supervisor. Supervision protects the quality and safety of the work. Our supervisor is bound by the same expectations of confidentiality that we are, and we share the minimum needed for the discussion, avoiding identifying details wherever possible.
Safeguarding and exceptional disclosures
What clients share with us is confidential, and we protect that confidence carefully. There are a small number of situations where the law or someone's safety can require us to share information without consent:
- when we believe a child or an adult is at serious risk of harm
- when we believe there is an immediate risk to someone's life
- when a court orders us to disclose information, or a legal duty requires it
Wherever it is safe and possible we talk to the person concerned before sharing anything, and we only ever share the minimum needed with the appropriate authority.
Who we share information with
We share information only where there is a genuine need and a proper basis, and only the minimum required. Depending on your situation, recipients can include:
- where we have clinical supervision, our supervisor, as described above
- your GP or another healthcare professional, normally with your agreement
- emergency services or safeguarding authorities, in the situations described above
- professionals who support the running of the practice, such as an accountant or IT support
We never sell personal information, and we never share client information for anyone else's advertising.
Where sessions are funded through health insurance, we share what the insurer needs to arrange and pay for your care, normally your name, policy details, attendance and invoicing information. We tell you what a funder can see before the work starts.
Information leaving the UK
The information we hold is stored and processed in the UK. If that ever changes, we will update this notice and put a recognised safeguard in place first.
How long we keep information
We keep different kinds of records for different lengths of time, and we do not keep anything longer than we need to. Clinical records are generally kept for a set period after the work ends, in line with professional guidance and insurance requirements. Our retention policy sets out each category, the period that applies and the reason for it. You are welcome to ask us for a copy.
How we protect information
We take the security of your information seriously. The measures we use are proportionate to the sensitivity of what we hold, and include keeping devices and accounts protected, limiting access to the people who need it, and storing records securely whether they are digital or on paper. No system is perfectly secure, but we work to keep risks low and we review these measures regularly.
Your rights
You have rights over your personal information. In summary:
- Access. You can ask for a copy of the information we hold about you.
- Correction. You can ask us to correct information that is inaccurate or incomplete.
- Deletion. You can ask us to delete information. This right has limits: for example, we may need to keep clinical records for a period even after such a request, and we will always explain our reasons.
- Restriction. You can ask us to pause our use of information while something is resolved.
- Objection. You can object to particular uses of your information. For marketing, we simply stop.
- Portability. In some circumstances you can ask for information you gave us in a reusable format, or for it to be sent to another provider.
- Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.
To use any of these rights, contact us at lindalintonuk@yahoo.co.uk. We normally respond within one month. If a request is complex we can extend that by up to two further months, and we will tell you within the first month if so. There is normally no charge.
Before sharing records we make sure a request really comes from you, or from someone genuinely authorised to act for you. For a current client, replying through the contact details we already hold is often enough; occasionally we may ask for more.
Therapy records often mention other people, such as a partner or family member. When we respond to a request for records we handle other people's details fairly, which usually means removing or summarising them unless it is appropriate to include them.
Raising a concern
If you are unhappy with how we have handled your information, please tell us. Contact Linda Linton at lindalintonuk@yahoo.co.uk and we will do our best to put things right. Our complaints procedure explains what happens next.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time. You can do this at ico.org.uk/make-a-complaint. We would welcome the chance to address your concern first, but you do not have to come to us before going to the ICO.
AI tools and automated processing
We do not currently use AI tools with client information. If that changes, we will update this notice first and explain what tool is involved and why.
Marketing
We do not send marketing emails or texts. If you hear from us, it is about your care or something you have asked about.
Our website
Our website collects a small amount of technical information about visits, such as the pages viewed and the browser used, which keeps the site working and secure. Our cookie and storage technologies policy explains what runs on the site and the choices you have.
If you use a form on our site, what you enter comes to us so we can respond. Form messages are treated with the same care as any other enquiry, so please share only what you are comfortable sending this way.
Changes to this document
We keep this notice under review and update it when our practice or the law changes. The version number, the date it took effect and the date of the next planned review are shown at the end. If we make a significant change, we will draw attention to it rather than changing things quietly.
Your retention schedule
| Record | Period starts | How long | Reason | Source | Disposal |
|---|
| current client admin | Start of first therapy session | Until therapy ends years | Some clients are longer term than others but keep for a maximum of 7 years then destroy | See previous answer | secure shredding |
Purposes and confirmed legal bases
| Purpose | Legal basis | Your explanation |
|---|
| Managing appointments | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Assessing whether you can help someone | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Keeping clinical records | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Handling complaints | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Handling enquiries | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Holding and using insurance | Legal obligation (Article 6(1)(c)); Explicit consent (Article 9(2)(a)) | |
| Defending or bringing legal claims | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Taking payment | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Meeting professional body requirements | Legal obligation (Article 6(1)(c)); Explicit consent (Article 9(2)(a)) | |
| Providing the therapy or service itself | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Responding to data rights requests | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Acting on safeguarding concerns | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Discussing work in supervision | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Tax and accounting | Contract (Article 6(1)(b)); Explicit consent (Article 9(2)(a)) | |
| Emergencies where someone’s life is at risk | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |
| Keeping your website secure | Consent (Article 6(1)(a)); Explicit consent (Article 9(2)(a)) | |