1. Introduction

This privacy policy explains how Caroline Marr Counselling, a sole trader counselling practice, collects, uses, and protects your personal information. We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Caroline Marr
Telephone: 07840 725975
Email:carolinemarrcounselling@gmail.com

We may collect the following types of personal information:

• Contact details: Name, address, telephone number, email address
• Demographic information: Age, gender, occupation
• Health information: Mental health concerns, medical history relevant to counselling, medication details
• Session notes: Records of our counselling sessions, treatment plans, and progress notes
• Emergency contact information: Details of someone to contact in case of emergency
• Financial information: Payment details for invoicing purposes
• Communication records: Correspondence between us via email, text, or other means

How We Collect Information

Information is collected through:

• Initial consultation forms and assessments
• During counselling sessions
• Email and telephone communications
• Online booking systems (if applicable)
• Referral letters from GPs or other healthcare professionals

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You have given clear consent for us to process your personal data for counselling purposes
• Vital interests: Processing is necessary to protect your vital interests or those of another person
• Public task: Processing is necessary for the performance of a task carried out in the public interest
• Legitimate interests: Processing is necessary for our legitimate interests in providing professional counselling services

For special category data (health information), we rely on:

• Explicit consent: You have given explicit consent for processing health data
• Healthcare purposes: Processing is necessary for healthcare provision

Your personal information is used to:

• Provide counselling and therapeutic services
• Maintain accurate session notes and treatment records
• Contact you regarding appointments and session arrangements
• Process payments and maintain financial records
• Comply with professional and legal obligations
• Provide reports to referrers (with your consent)
• Contact emergency services or your emergency contact if there are serious concerns about your safety

We may share your information in the following circumstances:

With your consent:

• Providing reports to your GP or referring healthcare professional
• Coordinating care with other healthcare providers
• Sharing information with family members or carers as appropriate

Without your consent (legal or professional obligations):

• When there is a serious risk of harm to yourself or others
• When required by court order or legal proceedings
• To comply with statutory obligations (e.g., safeguarding requirements)
• For supervision purposes with qualified supervisors (information shared is anonymised where possible)

Professional supervision: We may discuss your case with qualified supervisors for professional development and to ensure best practice. Information shared is kept confidential and used solely for supervision purposes.

We may share information with:

• Secure cloud storage providers for data backup
• Practice management software providers
• Payment processing services
• Professional indemnity insurers
• Regulatory bodies (e.g., BACP, UKCP) when required

All third-party providers are required to maintain appropriate security measures and confidentiality.

We implement appropriate technical and organisational measures to protect your personal information:

• Secure storage of physical records in locked filing cabinets
• Password-protected electronic records with encryption
• Secure disposal of confidential waste
• Regular backup of electronic data to secure cloud storage
• Limited access to records on a need-to-know basis
• Professional indemnity and cyber liability insurance

We retain your personal information for the following periods:

• Adult clients: 7 years from the end of treatment
• Child clients: Until the client's 25th birthday or 7 years from the end of treatment, whichever is longer
• Financial records: 6 years from the end of the financial year
• Correspondence: 7 years from the date of correspondence

Records may be retained for longer periods if:

• Required for legal proceedings
• Necessary for safeguarding purposes
• You request continued storage for ongoing care

8. Your Rights

Under UK GDPR, you have the following rights:

Right of Access:

You can request a copy of the personal information we hold about you.

Right to Rectification:

You can request correction of inaccurate or incomplete information.

Right to Erasure:

You can request deletion of your personal information in certain circumstances.

Right to Restrict Processing:

You can request that we limit how we use your information.

Right to Data Portability:

You can request transfer of your information to another provider.

Right to Object:

You can object to processing based on legitimate interests.

Right to Withdraw Consent:

You can withdraw consent for processing at any time.

Important note: Some rights may be limited where processing is necessary for healthcare purposes or to comply with legal obligations.

To exercise any of these rights, please contact us using the details provided above.

9. Online Services and Website

Website Cookies:

Our website may use cookies to improve your browsing experience. You can control cookie settings through your browser preferences.

Online Booking Systems:

If we use online booking systems, your information is processed securely and in accordance with this privacy policy.

Video Counselling:

If we provide video counselling services, we use secure, encrypted platforms. Session recordings are not made unless specifically agreed with you.

10. Complaints

If you have concerns about how we handle your personal information, you can:

1. Contact us directly using the details below
2. Contact our professional body (if applicable)
3. Make a complaint to the Information Commissioner's Office (ICO): 
   • Website: www.ico.org.uk
   • Telephone: 0303 123 1113
   • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by email or through our website. The date of the latest update is shown at the top of this policy.

12. Contact Us

If you have any questions about this privacy policy or how we handle your personal information, please contact us:

Caroline Marr
Caroline Marr Counselling
Mercure CTA 14 Newbury Street Wantage OX12 8DA

Tel: 07840725975
Email: carolinemarrcounselling@gmail.com

MBACP 390125 / MNCPS Acc. NCS23-04806