Privacy Notice
Plain-English information about how I (Hazel Hill, Counselling in Your Community) collect, use and protect your personal information.
Last updated: 20 September 2025
1) Who I am and how to contact me
Data Controller: Hazel Hill, Counselling in Your Community.
Practice location: Nether Edge, Sheffield S7, United Kingdom.
Email: counselling@inyourcommunity.org.uk |
Tel: 07814 363 855
I am NCPS Senior Accredited and BACP Accredited, and I work to the BACP Ethical Framework.
2) What information I collect
I collect and process information so I can provide safe, ethical counselling. This may include:
- Contact details (name, phone, email), and scheduling information.
- Background information you choose to share (e.g., current difficulties, history, goals for therapy).
- Session notes (brief, factual clinical notes to support your care).
- Correspondence we exchange (emails/texts) about appointments and practicalities.
- Payment records (amounts and dates; I do not store full card/bank details in my clinical notes).
- Website/contact form data (what you submit, plus basic technical data captured by my site and security tools).
- Referrer details if applicable (e.g., insurer/EAP, or a GP/other professional you ask me to liaise with).
Special category data: Because counselling involves health information, I may process data about your mental and physical health where relevant to therapy.
3) Where the data comes from
Mostly from you directly (by email, phone, video, in person, or my website contact form). With your permission, I may also receive information from referrers (e.g., EAP/insurer) or other professionals you ask me to liaise with.
4) Lawful bases for processing (UK GDPR)
- Contract – to provide counselling you have requested and manage appointments and payments.
- Legitimate interests – to run, protect and grow a safe practice (e.g., handling enquiries, keeping minimal records, defending legal claims).
- Legal obligation – for business, tax and accounting records.
- Vital interests – very rarely, to protect life if there is a serious and immediate risk.
Special category data (health): I rely on UK GDPR Article 9(2)(h) – provision of health care/management. In specific situations I may also rely on your explicit consent (Article 9(2)(a)), e.g., if you ask me to share information with your GP.
5) How I use your information
- To arrange and deliver counselling sessions safely and effectively.
- To communicate about appointments, cancellations and practicalities.
- To keep brief clinical notes that support continuity of care.
- To maintain secure accounts and required business records.
- To improve service quality (e.g., anonymised supervision per professional standards).
I do not use your information for automated profiling or marketing.
7) Where your data is stored (and international transfers)
Data may be stored on encrypted devices and in reputable UK/EU or international cloud services. If data is transferred outside the UK/EEA, I ensure appropriate safeguards are in place (e.g., adequacy decisions or UK International Data Transfer Agreements/Standard Contractual Clauses) with providers.
Common tools I use include secure email and calendar services, a video platform for online sessions, website hosting and security tools. I keep these under review for security and privacy compliance.
8) How long I keep information
- Enquiry emails (if you don’t start therapy): normally deleted within 6 months.
- Clinical notes (adults): retained for 7 years from the end of our work.
- Clinical notes for under-18s: kept until the young person turns 25 (or 26 if treatment ended at 17).
- Business/tax records: kept for at least 6 years as required by HMRC.
I keep data only as long as necessary for the purposes above, professional guidance and legal requirements, and then dispose of it securely.
9) How I keep your data secure
- Encrypted devices and strong authentication.
- Minimal, proportionate record-keeping; contact details stored separately from clinical notes where possible.
- Secure storage (locked cabinet and/or encrypted digital systems); restricted access.
- Regular updates and reviewed security settings for online tools.
10) Your rights
You have the right to request: access to your data; correction; erasure; restriction; objection to certain processing; and data portability (where applicable). You can also withdraw consent where I rely on consent.
To make a request, email counselling@inyourcommunity.org.uk. I may need to verify your identity before acting. I aim to respond within one month.
11) Concerns and complaints
If you’re concerned about how your data is handled, please contact me first so I can put things right. You also have the right to complain to the UK regulator:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk | Tel: 0303 123 1113
12) Children and young people
Where I work with under-18s (or their parents/carers), I explain privacy in an age-appropriate way. I keep records in line with safeguarding and legal guidance (see retention periods above).
14) Changes to this notice
I review this notice periodically and when services or regulations change. I will update the “Last updated” date above and, where appropriate, notify you by email or at your session.