Privacy notice generator

This notice explains how [your name or practice name] handles information about clients and people who enquire. If you have any questions about it, contact me at [contact email].

I keep only what the work needs:

• your contact details
• appointment records
• brief notes of each session
• your GP's details
• an emergency contact or next of kin
• payment records

I hold this information to provide you with therapy safely: to keep accurate notes of our work, to stay in touch about appointments, and to meet my professional and insurance obligations.

In data protection terms, the lawful basis for most of this is our contract (UK GDPR Article 6(1)(b)); for enquiries before we agree to work together, it is legitimate interests (Article 6(1)(f)). Session notes are health data, which has extra protection: my condition for holding them is the provision of health and social care (Article 9(2)(h), with the conditions in Schedule 1 of the Data Protection Act 2018), and safeguarding where that applies.

Consent is deliberately not the basis for the records themselves. I am professionally required to keep proper notes of our work, whether or not consent is later withdrawn, so it would be misleading to suggest the records rest on it.

I do not share what you tell me, apart from the narrow exceptions set out in our counselling agreement: risk of serious harm, safeguarding concerns, court orders and narrow legal duties. Beyond those:

• I discuss anonymised case material in clinical supervision, which is a professional requirement; my supervisor never hears your name and is bound by the same confidentiality
• my practice management software stores my diary, notes and documents
• my video platform carries our online sessions
• my email provider handles our messages

I keep records for 7 years after our work ends, which is the period commonly required by professional indemnity insurers, and then delete them securely. Enquiry details from people who do not become clients are deleted much sooner.

You can ask for a copy of the information I hold about you, ask me to correct anything that is wrong, and ask me to delete it. I will respond within one month.

Because I am required to keep proper records for insurance and professional reasons, a request to erase clinical records may be lawfully declined in part until the retention period has passed. I will always explain what I can and cannot do.

If you are unhappy with how I handle your information, please tell me first and I will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.