Privacy Policy, Data Protection & Practice Information


Privacy & Practice Policies

(Counselling & Clinical Supervision — UK GDPR, DPA 2018, DPDI Act 2026)

​

Counselling & Clinical Supervision

(UK GDPR, Data Protection Act 2018 & BACP Ethical Framework 2026) Last Updated: October 2026

 

1. Who I Am

 

I am Kelly-Anne Singleton, a UK-based counsellor, registered with the British Association for Counselling and Psychotherapy (BACP) and working in accordance with the BACP Ethical Framework.

​

Data Controller: Kelly-Anne Singleton
Email: kellyanne@dorsetcounsellor.co.uk
Website: www.dorsetcounsellor.co.uk
Location: Poole, Dorset, United Kingdom

​

I am responsible for determining how your personal information is collected, used, stored and protected.

 

2. Information I Collect

 

2.1 Contact Information

I may collect:

  • Name
  • Email address
  • Telephone number
  • Postal address (where relevant)
  • Emergency contact details (where appropriate)

 

2.2 Administrative Information

I may collect:

  • Appointment history
  • Session attendance records
  • Correspondence by email, telephone or text
  • Invoices and payment information
  • Clinical supervision records
  • Contractual agreements and consent forms

 

2.3 Clinical Information (Special Category Data)

As part of providing counselling services, I may collect sensitive personal information relating to:

  • Mental health and emotional wellbeing
  • Physical health where relevant to therapeutic work
  • Family and relationship history
  • Risk assessments
  • Safeguarding concerns
  • Protected characteristics, including ethnicity, sexuality, disability, religion or gender identity where relevant to therapeutic work

​

This information is treated with a high level of confidentiality and protected in accordance with UK data protection legislation.

 

3. Lawful Basis for Processing

I process personal information under the following lawful bases:

​

Article 6 UK GDPR

  • Contract - to provide counselling and supervision services
  • Legitimate Interests - to respond to enquiries, manage appointments and maintain professional records
  • Legal Obligation - where required by law, safeguarding duties or regulatory requirements
  • Vital Interests - where there is a serious risk of harm to you or another person

 

Article 9 UK GDPR (Special Category Data)

 

I process health-related and other special category data under:

  • Article 9(2)(h) - provision of health or social care services
  • Article 9(2)(a) - explicit consent where appropriate

 

4. How Your Information Is Used

 

Your information may be used to:

  • Provide counselling or supervision services
  • Maintain clinical records
  • Maintain administrative records
  • Arrange and manage appointments
  • Communicate regarding sessions
  • Manage payments and invoices
  • Meet professional, ethical and legal obligations
  • Assess and manage risk
  • Fulfil safeguarding responsibilities
  • Discuss anonymised client work in professional supervision
  • Demonstrate ethical decision-making, ethical rationale / reasoning and professional accountability in accordance with the BACP Ethical Framework 2026

 

I do not sell personal data and I do not use your information for marketing purposes without your consent.

 

5. Storage of Notes and Data Security

 

Your information is stored securely using appropriate technical and organisational measures.

 

These measures include:

  • Encrypted devices
  • Password-protected systems
  • Secure Microsoft Outlook email
  • Microsoft OneDrive encrypted cloud storage
  • Multi-factor authentication where available
  • Regular review of digital security measures
  • Locked physical storage where paper records are used
  • Secure destruction of records at the end of the retention period

​

Access to identifiable client information is restricted to me unless disclosure is required by law or authorised by you.

 

6. Retention Periods

 

Records are retained only for as long as necessary for professional, legal and insurance purposes.

 

Current retention periods are:

  • Adult counselling records: 7 years from the date of the final session
  • Clients seen as minors: until age 25, or 8 years after the final session, whichever is longer
  • Clinical supervision records: 7 years
  • Financial and tax records: 6 years
  • Initial enquiry emails that do not proceed to counselling: up to 12 months
  • Safeguarding records: in accordance with statutory guidance and risk management requirements

 

Following these periods, records will be securely deleted or destroyed.

 

7. Sharing Your Information

 

Your information will not normally be shared without your knowledge.

Information may be shared only under the following circumstances.

 

7.1 Legal and Ethical Requirements

Information may be disclosed where:

  • There is a serious risk of harm to you or another person
  • Safeguarding concerns arise regarding a child or vulnerable adult
  • Disclosure is required by law
  • A court order requires disclosure
  • There is a legal or professional duty to share information

 

Where possible and appropriate, I will discuss disclosure with you beforehand.

 

7.2 Professional Supervision

As required by the BACP Ethical Framework, I discuss my work with a qualified supervisor.

Where client material is discussed:

  • Information is anonymised whenever possible
  • Identifiable information is minimised
  • Confidentiality obligations apply to all parties involved

 

7.3 With Your Explicit Consent (unless in line with point 7.1)

Information may be shared with:

  • GPs
  • Medical professionals
  • Schools or colleges
  • Other healthcare providers
  • Referring organisations
  • Multi-agency support services

 

Only information necessary for the stated purpose will be shared.

 

8. Your Rights

 

You have the right to:

  • Access your personal information
  • Request correction of inaccurate data
  • Request restriction of processing
  • Object to processing where applicable
  • Request deletion of information where legally permissible
  • Receive a copy of your information in a portable format where applicable
  • Withdraw consent where consent forms the basis of processing

 

Requests should be made in writing to:

melanieedmundstherapies@outlook.com

 

9. Website Privacy and Cookies

 

Cookies

My website uses cookies to support functionality and improve your experience.

These may include:

  • Essential security cookies
  • Website performance cookies
  • Analytics cookies (where consent has been provided)
  • Embedded content cookies

You may manage or remove cookies through your browser settings or website cookie preferences.

 

Website Analytics

Technical information may automatically be collected, including:

  • IP address
  • Device type
  • Browser type
  • Operating system
  • Website usage information

​

This information helps maintain website performance and security.

No behavioural advertising cookies are knowingly used.

 

10. Artificial Intelligence (AI) and Digital Technology

 

In line with the BACP Ethical Framework, I carefully consider the ethical, privacy and confidentiality implications of any digital technologies used within my practice.

I do not use Artificial Intelligence (AI) systems to process identifiable client information, counselling records, correspondence, supervision notes, assessments, or session content.

AI may occasionally be used to assist with general business administration, practice policies, website content, or other non-client-facing administrative tasks.

No identifiable client information is entered into AI systems for these purposes.

Professional judgement, risk assessments, therapeutic decision-making and clinical responsibility remain solely my responsibility and are never delegated to AI systems.

Should my use of technology change significantly in the future, this policy will be updated and clients will be informed where appropriate.

 

11. Data Breach Procedure

 

In the event of a personal data breach, I will:

  • Take immediate steps to contain the breach
  • Assess any risks to individuals
  • Maintain a record of the incident
  • Notify affected individuals where required
  • Notify the Information Commissioner's Office (ICO) within required timescales where applicable
  • Take reasonable steps to reduce the likelihood of recurrence

 

12. Children and Young People

 

When working with clients under 18 years of age:

  • Parental responsibility and consent requirements will be considered
  • Gillick competence principles may apply where appropriate
  • Confidentiality will be respected wherever possible
  • Safeguarding responsibilities remain paramount
  • Record retention follows current safeguarding guidance

 

13. Online Counselling and Supervision

 

Where services are provided online:

  • Sessions take place via Zoom using a secure account
  • Sessions are not recorded unless expressly agreed in advance
  • Clients are responsible for ensuring privacy at their location
  • If technology fails, reasonable attempts will be made to reconnect
  • Emergency contact details may be requested
  • Current location may be confirmed when appropriate for risk management purposes
  • Online work may not be suitable for all clients and alternative arrangements may be discussed

 

14. Equality, Diversity and Inclusion

 

I welcome clients and supervisees from all backgrounds and identities.

​

This includes, but is not limited to:

  • Race and ethnicity
  • Gender identity and expression
  • Sexual orientation
  • Disability
  • Neurodiversity
  • Religion or belief
  • Age
  • Socioeconomic background
  • Relationship and family structures

​

My practice is guided by the principles of equality, inclusion and respect, and by a commitment to challenging discrimination and oppression.

 

15. Data Processors and Third-Party Services

To provide services securely, I use a number of trusted organisations that may process certain personal information on my behalf.

 

Microsoft Outlook

Used for email communication and protected through Microsoft's security and encryption measures.

 

Zoom

Used for online counselling and supervision sessions.

 

Microsoft OneDrive

Used for secure cloud storage of practice records and documents.

 

Ionos

My website is hosted by Ionos

Ionos may process:

  • Contact form submissions
  • Technical website data
  • Cookie information
  • Website usage statistics

in accordance with its own privacy policies.

 

BACP Therapist Directory

If you find my practice through the BACP Therapist Directory, BACP may process information according to its own privacy policy and may pass enquiries to me for the purpose of responding.

​

I remain the Data Controller for information held within my private practice.

 

16. Fees

 

Professional fees are reviewed annually each March.

If fees change, reasonable notice will be provided before the new fees take effect.

Any fee changes will not apply retrospectively to services already delivered.

 

17. Safeguarding Statement

 

I follow UK safeguarding legislation and the BACP Ethical Framework.

Information may be shared where concerns arise regarding:

  • Risk of significant harm to yourself
  • Risk of significant harm to others
  • Child protection concerns
  • Vulnerable adult safeguarding concerns
  • Serious criminal activity
  • Legal obligations

 

Where possible, I will discuss such concerns with you before sharing information.

Only information necessary for the specific purpose will be disclosed.

 

18. Complaints Procedure

I am committed to providing a professional, respectful and ethical service.

 

If you are unhappy with any aspect of my service or the way your personal information has been handled, I encourage you to raise your concerns with me first.

Concerns may be raised:

  • During a session
  • By email
  • In writing

​

I will acknowledge your concern and aim to respond within 30 days.

 

Where appropriate, I will:

  • Listen carefully to your concerns
  • Review the circumstances
  • Seek clarification where needed
  • Discuss possible resolutions
  • Respond in writing with any outcomes
  • Keep a record of the complaint and outcome

​

Many concerns can be resolved through open discussion and informal resolution.

If you remain dissatisfied, or if the concern relates specifically to data protection, you may contact:

 

Information Commissioner's Office (ICO)

For concerns relating to privacy, confidentiality or data protection.

 

British Association for Counselling and Psychotherapy (BACP)

For concerns relating to professional conduct, ethics or professional practice.

Raising concerns directly with me first does not affect your right to contact either organisation at any stage.

​

19. Clinical will & Professional Executor Arrangements

I maintain arrangements to ensure continuity and responsible management of client & supervision records in the event of my death, incapacity or serious illness. My clinical will is held with ClinicalWill.App.

 

A designated professional colleague may be authorised to access limited client information solely for the purpose of:

  • Informing current clients & Supervisees where appropriate
  • Managing ongoing practice arrangements
  • Securely administering or disposing of records
  • Meeting legal and professional obligations

​

Any access will be restricted to information necessary for these purposes and confidentiality obligations will remain in place.

 

20. Updates to This Policy

This Privacy Policy is reviewed regularly and reflects:

  • UK GDPR
  • Data Protection Act 2018
  • Relevant UK data protection legislation
  • BACP Ethical Framework for the Counselling Professions (effective 3 November 2026)

 

Any future updates will be published on my website