Privacy notice
Sue Cook Counselling & Psychotherapy
About this notice
This notice explains how Sue Cook Counselling & Psychotherapy looks after personal information: what we collect, why we hold it, who we may share it with and the rights you have over it.
It covers everyone we hold information about, including people who enquire without becoming clients, current and former clients, and people connected to our work such as family members or referrers.
Who we are
Sue Cook Counselling & Psychotherapy is the data controller for the information described in this notice. Controller is the legal term for the organisation that decides how and why personal information is used.
Questions about this notice, or about your information, go to Practice Owner. The quickest route is email: suecook.therapy@btinternet.com.
We are based in Bath. Our full postal address is available on request.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our registration number is HL-ICO:00340019969.
Who this covers
We hold different amounts of information about different people. For most website visitors it is very little; for clients it includes the records we make in the course of our work together. This notice covers:
- people who contact us with an enquiry
- current and former clients
- family members, partners and other people who appear in our records
- people who refer clients to us, and professionals we work alongside
- visitors to our website
The information we hold
What we hold depends on your relationship with us. It can include:
- your name and contact details
- appointment and payment records
- what you share with us during our work together, and the notes we make about that work
- correspondence such as emails, letters and messages
We collect what the work needs and no more.
We ask clients for an emergency contact. We use those details only in a genuine emergency and never contact that person for any other reason.
We only publish a testimonial or review with the written permission of the person who gave it, and that permission can be withdrawn at any time.
Our website collects limited technical information about visits, described in the website section below and in our cookie and storage technologies policy.
Where information comes from
Most of the information we hold comes directly from you: when you get in touch, complete a form, or talk with us during our work together.
Some information reaches us from other people, for example a referral from a GP or another professional, details passed on by a parent or guardian, or information from an organisation that arranges your sessions. When that happens we use only what we need, and this notice applies to that information in the same way.
Why we use information, and our lawful bases
The law requires a valid reason, called a lawful basis, for every use of personal information. This section lists each purpose we use information for and the basis we rely on. We have reviewed and confirmed each one.
Handling enquiries. Reading and replying when you contact us, and keeping a record of that exchange for a reasonable period. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)).
Assessing whether we can help. Initial conversations and intake questions that help us decide together whether our service is right for you, including when the best answer is a referral elsewhere. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Providing the service itself. Running sessions, keeping in touch about the work and doing what we have agreed with you. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Managing appointments. Booking, rearranging and cancelling sessions and, where used, sending reminders. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)).
Taking payment. Invoicing, processing payments, issuing receipts and keeping the financial records the law requires. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)).
Keeping clinical records. Making and keeping session notes, assessments and related correspondence so the work is documented safely and professionally. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Clinical supervision. Discussing our client work with a clinical supervisor, as our profession expects, keeping identifying details to the minimum the discussion needs. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Safeguarding. Recording concerns and, where necessary, telling an appropriate authority that a child or an adult may be at risk of harm. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Emergencies. Contacting emergency services or your emergency contact if we believe your life, or someone else's, is in immediate danger. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Handling complaints. Receiving, looking into and responding to complaints, and keeping a record of what happened. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Responding to data rights requests. Handling requests to see, correct or delete information, including checking who is asking. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)).
Legal claims. Using records if a dispute arises, for example a fee dispute, an insurance matter or a court order for notes. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(f) establishing, exercising or defending legal claims.
Tax and accounting. Keeping invoices and financial records, filing returns and sharing what is needed with our accountant and HMRC. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Professional body requirements. Meeting the requirements of our professional membership, such as holding insurance, engaging in supervision or cooperating with a conduct process. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Keeping our website secure. Security logging, blocking attacks and preventing spam, which involves technical details such as IP addresses. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Health and other sensitive information
Some kinds of information get extra legal protection, including anything about health, sex life or sexual orientation, race or ethnic origin, religious or philosophical beliefs, and biometric data. The law calls this special category data. Therapy involves health information by its nature, so much of what clients share with us falls into this group.
To use special category information we need both a lawful basis and a further specific condition, and we treat it with particular care.
For the health information involved in providing our service, we rely on the condition for health and social care (Article 9(2)(h) UK GDPR, with Schedule 1 of the Data Protection Act 2018). This applies because the information is used for care provided under the responsibility of a professional who owes a duty of confidentiality.
Clinical records
We keep clinical records of our work with clients, typically session notes, assessments and relevant correspondence. Records help us provide safe, consistent care. They are stored securely, access is limited to the people who genuinely need it, and they are kept for the periods set out in our retention policy before being securely destroyed.
Supervision
Like most therapy professionals, we have regular clinical supervision, where aspects of client work are discussed with an experienced supervisor. Supervision protects the quality and safety of the work. Our supervisor is bound by the same expectations of confidentiality that we are, and we share the minimum needed for the discussion, avoiding identifying details wherever possible.
Safeguarding and exceptional disclosures
What clients share with us is confidential, and we protect that confidence carefully. There are a small number of situations where the law or someone's safety can require us to share information without consent:
- when we believe a child or an adult is at serious risk of harm
- when we believe there is an immediate risk to someone's life
- when a court orders us to disclose information, or a legal duty requires it
Wherever it is safe and possible we talk to the person concerned before sharing anything, and we only ever share the minimum needed with the appropriate authority.
Who we share information with
We share information only where there is a genuine need and a proper basis, and only the minimum required. Depending on your situation, recipients can include:
- where we have clinical supervision, our supervisor, as described above
- your GP or another healthcare professional, normally with your agreement
- emergency services or safeguarding authorities, in the situations described above
- professionals who support the running of the practice, such as an accountant or IT support
We never sell personal information, and we never share client information for anyone else's advertising.
Information leaving the UK
We are reviewing exactly where each of our providers stores information. Until that review is complete we treat any possible transfer with caution, and you are welcome to ask us for the current position.
How long we keep information
We keep different kinds of records for different lengths of time, and we do not keep anything longer than we need to. Clinical records are generally kept for a set period after the work ends, in line with professional guidance and insurance requirements. Our retention policy sets out each category, the period that applies and the reason for it. You are welcome to ask us for a copy.
How we protect information
We take the security of your information seriously. The measures we use are proportionate to the sensitivity of what we hold, and include keeping devices and accounts protected, limiting access to the people who need it, and storing records securely whether they are digital or on paper. No system is perfectly secure, but we work to keep risks low and we review these measures regularly.
Your rights
You have rights over your personal information. In summary:
- Access. You can ask for a copy of the information we hold about you.
- Correction. You can ask us to correct information that is inaccurate or incomplete.
- Deletion. You can ask us to delete information. This right has limits: for example, we may need to keep clinical records for a period even after such a request, and we will always explain our reasons.
- Restriction. You can ask us to pause our use of information while something is resolved.
- Objection. You can object to particular uses of your information. For marketing, we simply stop.
- Portability. In some circumstances you can ask for information you gave us in a reusable format, or for it to be sent to another provider.
- Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.
To use any of these rights, contact us at suecook.therapy@btinternet.com. We normally respond within one month. If a request is complex we can extend that by up to two further months, and we will tell you within the first month if so. There is normally no charge.
Before sharing records we make sure a request really comes from you, or from someone genuinely authorised to act for you. For a current client, replying through the contact details we already hold is often enough; occasionally we may ask for more.
Therapy records often mention other people, such as a partner or family member. When we respond to a request for records we handle other people's details fairly, which usually means removing or summarising them unless it is appropriate to include them.
Raising a concern
If you are unhappy with how we have handled your information, please tell us. Contact Practice Owner at suecook.therapy@btinternet.com and we will do our best to put things right. Our complaints procedure explains what happens next.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time. You can do this at ico.org.uk/make-a-complaint. We would welcome the chance to address your concern first, but you do not have to come to us before going to the ICO.
AI tools and automated processing
We do not currently use AI tools with client information. If that changes, we will update this notice first and explain what tool is involved and why.
Marketing
We do not send marketing emails or texts. If you hear from us, it is about your care or something you have asked about.
Our website
Our website collects a small amount of technical information about visits, such as the pages viewed and the browser used, which keeps the site working and secure. Our cookie and storage technologies policy explains what runs on the site and the choices you have.
If you use a form on our site, what you enter comes to us so we can respond. Form messages are treated with the same care as any other enquiry, so please share only what you are comfortable sending this way.
Changes to this document
We keep this notice under review and update it when our practice or the law changes. The version number, the date it took effect and the date of the next planned review are shown at the end. If we make a significant change, we will draw attention to it rather than changing things quietly.
Your retention schedule
| Record | Period starts | How long | Reason | Source | Disposal |
|---|---|---|---|---|---|
| current client admin | When started working with me | 7 years | In case of re-referral or court needs | Same as my tax records | confidential waste service |
Purposes and confirmed legal bases
| Purpose | Legal basis | Your explanation |
|---|---|---|
| Managing appointments | Contract (Article 6(1)(b)) | Booking and moving sessions is part of providing the service you agreed. |
| Assessing whether you can help someone | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Deciding whether you can help is a step the person asked for before you agree to work together. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Keeping clinical records | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Keeping notes is part of providing therapy safely. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Handling complaints | Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | Looking into a complaint fairly is a legitimate interest of your practice. |
| Handling enquiries | Contract (Article 6(1)(b)) | Replying to someone who asks about therapy is a step they asked you to take before agreeing to work together. |
| Defending or bringing legal claims | Legitimate interests (Article 6(1)(f)); Article 9(2)(f) establishing, exercising or defending legal claims | Keeping records so you can respond to a possible claim is a legitimate interest. The legal claims condition covers any health details used for it, and needs no appropriate policy document. |
| Taking payment | Contract (Article 6(1)(b)) | Taking payment is part of the agreement between you and your client. |
| Meeting professional body requirements | Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | Meeting the requirements of your professional body is a legitimate interest of your practice. |
| Providing the therapy or service itself | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Therapy is the service you have agreed to provide. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Responding to data rights requests | Legal obligation (Article 6(1)(c)) | Data protection law requires you to respond when someone asks for their information. |
| Acting on safeguarding concerns | Legal obligation (Article 6(1)(c)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | |
| Discussing work in supervision | Legitimate interests (Article 6(1)(f)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Discussing your work in supervision is a normal part of safe practice. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Tax and accounting | Legal obligation (Article 6(1)(c)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | Tax law requires you to keep financial records. |
| Emergencies where someone’s life is at risk | Contract (Article 6(1)(b)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | |
| Keeping your website secure | Legitimate interests (Article 6(1)(f)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | Keeping your website and its forms secure is a recognised legitimate interest. |