Privacy Policy

This privacy policy explains how Debbie Smith Counselling collects, uses, and protects your personal information. It is written to be clear and understandable, so you can feel informed and safe when you choose to work with me.

1. Who I Am and How to Contact Me

Debbie Smith Counselling is a person-centred, trauma-informed counselling practice offering online sessions and in-person sessions in North Bristol (from 2027). I aim to provide a safe, non-judgemental space where you can explore your experiences at your own pace.

The data controller for your personal information is:

Name: Debbie Smith Counselling
Email: DebbieSmithCounselling@gmail.com

If you have any questions about this privacy policy or how your data is handled, you can contact me using the email address above.

2. What Personal Data I Collect

To offer you safe and effective counselling, I collect and process the following types of personal information:

  • Identity details – such as your name and, where relevant, preferred name or pronouns.
  • Contact details – such as your email address, telephone number, and emergency contact details.
  • Session and health information – information you share about your mental and physical health, history, current difficulties, and goals for counselling. This may include sensitive information (also known as “special category data” under data protection law).
  • Administrative information – records of appointments, invoices, and communications related to your sessions.
  • Website and cookie information – basic technical data such as your IP address, browser type, and pages visited, collected via standard WordPress cookies (see the Cookie Information section below).

3. Why I Collect Your Data and Legal Bases for Processing

Your information is collected so that I can provide a safe, person-centred, trauma-informed counselling service. I aim to be as transparent as possible about why I hold your data and the legal reasons for doing so.

The main reasons I process your personal data are:

  • To provide counselling sessions – I use your personal and health information to understand your situation and to support you in a way that feels safe and appropriate for you.
  • To communicate with you – for example, to confirm or rearrange appointments, respond to enquiries, and share practical information about your sessions.
  • To manage my practice – including maintaining records of sessions, handling payments, and meeting professional, ethical, and legal obligations.

Under UK data protection law (UK GDPR and the Data Protection Act 2018), I rely on the following legal bases for processing your data:

  • Legitimate interests – I process your information where it is necessary for the legitimate interest of providing you with a counselling service in a safe and ethical way, and where this does not override your rights and freedoms.
  • Consent – in some situations, especially for sensitive (special category) information, I will ask for your explicit consent to process your data. You have the right to withdraw this consent at any time, although this may affect my ability to continue offering counselling.

4. How Your Data Is Stored and Kept Secure

Looking after your information is an important part of offering a safe, trauma-informed counselling space. I take your privacy and confidentiality very seriously.

  • Confidentiality – Your information is treated as confidential and handled in line with the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.
  • Digital records – Any electronic notes or communications are stored using password-protected devices and accounts. Where possible, two-factor authentication is used for added security.
  • Paper records – If paper notes are kept, they are stored securely and are not accessible to others.
  • Limited access – I am the only person who has routine access to your personal data. Supervision, where used, focuses on the work and does not normally require identifying details unless absolutely necessary for your safety or the quality of care.

While no system can be completely risk-free, reasonable and proportionate steps are taken to reduce the risk of loss, misuse, or unauthorised access to your information.

5. How Long Your Data Is Kept

Your personal information is kept only for as long as it is needed for the purposes set out in this policy, and to meet legal, professional, and insurance requirements.

  • Client records – Session notes and related records are generally kept for up to 7 years after your final session, in line with common professional guidance and insurance requirements.
  • Enquiry information – If you contact me but do not proceed with counselling, I will usually keep your information for up to 6 months, then delete or anonymise it.

When information is no longer needed, it is securely deleted or destroyed.

6. Third-Party Sharing and Safeguarding

Your information is not sold or used for marketing by third parties. I value your trust and want you to feel safe in what you share.

Your data may be shared in the following limited situations:

  • Supervision – As part of ethical practice, I attend supervision to support the quality and safety of my work. Where your material is discussed, it is usually anonymised and identifying details are minimised.
  • Legal obligations – I may be required to share information if ordered to do so by a court or if I am legally obliged under UK law.
  • Safeguarding and serious harm – In rare situations where there is a serious risk of harm to you or to others, or concerns about the safety of a child or vulnerable adult, I may need to share relevant information with appropriate services (for example, your GP, emergency services, or safeguarding teams). Wherever possible, I will discuss this with you first, unless doing so would increase the risk.
  • Service providers – I may use trusted third-party services such as email providers, website hosting, or practice management tools. These providers may process data on my behalf under contracts that require them to keep your information secure and confidential.

Other than these situations, your information will not be shared without your knowledge and, where appropriate, your consent.

7. Your Rights Under UK GDPR

You have a number of rights in relation to the personal information I hold about you. These rights are designed to give you more control over your data and to support transparency.

  • Right of access – You can ask for a copy of the personal information I hold about you.
  • Right to rectification – You can ask me to correct any information that is inaccurate or incomplete.
  • Right to erasure (“right to be forgotten”) – In some circumstances, you can ask for your personal information to be deleted. There may be legal or professional reasons why I need to keep certain information for a time, and I will explain this if it applies.
  • Right to restrict processing – You can ask me to limit how your data is used in certain situations.
  • Right to data portability – You can ask for your information in a structured, commonly used format so that it can be transferred to another service, where technically possible.
  • Right to object – You can object to your information being processed under legitimate interests in some circumstances.
  • Right to withdraw consent – Where I rely on your consent to process your data, you can withdraw this at any time.

If you would like to exercise any of these rights, please contact me at DebbieSmithCounselling@gmail.com. I may need to confirm your identity before responding to a request.

8. How to Make a Complaint

If you have concerns about how your personal data is being handled, I would encourage you to contact me in the first instance so that I can try to resolve the issue with you in a way that feels respectful and supportive.

If you are not satisfied with my response, or prefer not to contact me directly, you have the right to make a complaint to the UK supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113 (UK)

More information about your rights and how to raise a concern can be found on the ICO’s website.

9. Cookies and Website Use

This website is built using WordPress and may use small text files called “cookies” that are stored on your device. These help the site function smoothly and provide basic information about how the website is used.

  • Essential cookies – These are needed for the website to work properly, for example to load pages or keep the site secure.
  • Functional and performance cookies – WordPress and related plugins may use cookies to remember basic preferences or to collect anonymous statistics about which pages are visited and how the site is used. This helps me understand how the website is working and where it can be improved.
  • Third-party cookies – If any embedded content is used (for example, maps or videos), these services may set their own cookies. You can check their privacy policies for more details.

You can control or delete cookies through your browser settings. Most browsers allow you to refuse cookies or to delete those that have already been set. Please be aware that disabling certain cookies may affect how the website functions.

10. Updates to This Privacy Policy

This privacy policy may be updated from time to time, for example to reflect changes in the law or in how the counselling service is provided. The date of the most recent version will be shown on this page, and any significant changes will be highlighted where possible.

If you have questions about any changes, you are very welcome to contact me at DebbieSmithCounselling@gmail.com.