Privacy Policy
Last updated: August 2026
1. Purpose
This Data Protection Policy sets out how Lucy Green Counselling collects, stores, uses and protects personal information in accordance with applicable UK data-protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The purpose of this policy is to ensure that personal information is handled lawfully, fairly, securely and respectfully.
2. Data Controller
Lucy Green, from Lucy Green Counselling is responsible for determining how and why personal information is processed.
3. Data protection principles
Personal information will be handled in accordance with the principles of UK data-protection law.
Information will be:
1. Processed lawfully, fairly and transparently.
2. Collected for specified and legitimate purposes.
3. Adequate, relevant and limited to what is necessary.
4. Accurate and kept up to date where necessary.
5. Kept only for as long as necessary.
6. Processed securely and protected against unauthorised access, loss, destruction or disclosure.
4. Information collected
The practice (Lucy Green Counselling) may collect the following:
1. Names and contact details
2. Appointment information
3. Emergency contact details
4. Initial assessment information
5. Relevant health and wellbeing information
6. Risk and safeguarding information
7. Counselling session notes
8. Payment records
9. Communications relating to counselling
10. Information necessary to meet professional and legal obligations
(Only information that is relevant and necessary for the provision of counselling will be collected.)
5. Special category data
Counselling records may contain special category personal data, including information relating to a person’s physical or mental health. Such information will only be processed where there is an appropriate lawful basis and special-category condition under applicable data-protection legislation. Particular care will be taken to ensure that sensitive information is: Relevant, necessary, accurate, secure and accessible only to authorised persons
6. Client records
Client records will be maintained to support safe and ethical counselling practice. Records will be factual, professional, relevant and proportionate. Session notes will avoid unnecessary personal detail and should not contain derogatory, speculative or inappropriate comments. Where possible, identifying information should be kept separate from therapeutic notes.
7. Security of information
Reasonable technical and organisational measures will be used to protect client information. These may include: Password-protected devices, Strong, unique passwords, Device security and automatic locking, Appropriate antivirus/security measures, Secure storage of electronic records, Secure physical storage of paper records, Restricting access to client information, Regular review of storage arrangements, Secure deletion of information when no longer required Client information must not be stored on unsecured or publicly accessible devices.
8. Mobile phones and messaging
Client information should not be stored unnecessarily within personal messaging applications. Text messages should generally be limited to practical matters such as appointment arrangements. Sensitive therapeutic information should not ordinarily be communicated by text message. Devices used for communication with clients must be protected by an appropriate passcode or equivalent security measure.
9. Email
Email may be used for appropriate administrative communication. Sensitive therapeutic information should not ordinarily be included in email communications unless there is an appropriate reason and adequate safeguards are in place. Email accounts used for professional purposes must be protected by a strong password and appropriate security measures.
10. Paper records
Where paper records are used, they must be kept securely and should not be left unattended or accessible to unauthorised individuals. Paper records should be securely destroyed when they are no longer required.
11. Professional supervision
Professional supervision is an essential part of counselling practice. Relevant client material may be discussed during supervision where necessary for safe and ethical practice. Only information necessary for supervision should be shared, and identifying information should be minimised wherever possible.
12. Disclosure of information
Client information will normally remain confidential. Information may be disclosed without consent where: There is a serious and significant risk of harm to the client or another person There is a safeguarding concern Disclosure is required by law Disclosure is otherwise legally permitted and necessary Where possible and appropriate, the client will be informed before information is disclosed. Only information that is necessary and proportionate should be shared.
13. Data retention Client records will be retained in accordance with the practice’s retention arrangements and applicable professional, legal and insurance requirements. Retention periods will be reviewed periodically. When information is no longer required, it will be securely deleted or destroyed.
14. Data subject requests
Clients may exercise their applicable rights under UK GDPR and the Data Protection Act 2018. Requests will be considered and responded to within the applicable statutory timeframe. Requests will be verified where necessary to protect against unauthorised disclosure of personal information.
15. Data breaches
A personal-data breach may include: Loss or theft of client records Sending information to the wrong person Unauthorised access to client information Loss of an unsecured device Accidental disclosure of confidential information Any suspected breach will be assessed promptly. Appropriate steps will be taken to contain the breach, reduce potential harm and determine whether notification to the ICO or affected individuals is legally required. All significant breaches will be documented.
16. Third-party services
Where third-party services are used to store or process client information, they will be selected carefully and reviewed for appropriate security and data-protection arrangements. Examples may include: Email providers Appointment-booking systems Secure client-record systems Cloud storage Payment providers Only services considered appropriate for the nature and sensitivity of counselling information should be used.
17. Data protection training and review
Data-protection arrangements will be reviewed periodically and whenever there is a significant change to the practice, technology, services used or applicable legislation. Lucy Green will remain appropriately informed about data-protection responsibilities relevant to private counselling practice.
18. ICO registration
Lucy Green Counselling will assess whether it is required to register with the Information Commissioner’s Office and pay the applicable data-protection fee. Where registration is required, this will be maintained and renewed as appropriate.
19. Policy review
This policy will be reviewed periodically and updated when necessary to reflect changes in legislation, professional guidance, technology or the operation of the practice. Policy owner: Lucy Green Business: Lucy Green Counselling Review date: August 2027
Contact
If you have any questions about this Privacy Policy, please contact us at: lucy@lucygreencounselling.com