Privacy Policy

1. Introduction & Overview

Your privacy is very important to me. You can be confident that your personal information will be kept safe and secure and will only be used for the purpose for which it was given.

As a registered member of the British Association for Counselling and Psychotherapy (BACP), I adhere to the BACP Ethical Framework and comply with UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This privacy notice explains what I do with your personal data from your initial enquiry through to after your therapy has ended.

2. Data Controller & Contact Details

For the purposes of data protection law, I am the Data Controller (the person responsible for collecting, storing, and managing your personal data).

  • Name / Practice Name: Monica Dunne Counselling

  • Email: monicadunnecounselling@gmail.com

  • ICO Registration Number: ZC239533 

3. Information I Collect

A. Initial Enquiries

When you contact me with an enquiry (via email, phone, or website contact form), I collect basic contact information to process your request.

  • If you decide not to proceed with therapy: All personal information from your initial enquiry will be securely deleted from my systems within 14 days of our last communication, or sooner upon your request.

B. Active Clients

If we work together, I will collect:

  • Personal & Identification Data: Name, date of birth, address, email, telephone number, emergency contact / next of kin details.

  • Medical Data: GP name and surgery details, relevant health conditions, and current medications.

  • Clinical Records: Brief, anonymised session notes stored separately from your identifying personal details.

4. Lawful Basis for Processing Data (UK GDPR)

Under UK GDPR, I must have a valid lawful basis to process your information:

  1. Personal Data (Article 6):

    • Contract: Processing contact details and health information is necessary to fulfill our agreement to provide therapy.

    • Legitimate Interests: Retaining records post-therapy is necessary for administrative management and to defend against potential legal or insurance claims.

  2. Special Category / Health Data (Article 9):

    • Article 9(2)(h): Processing is necessary for the provision of health or social care treatment.

5. Confidentiality, Supervision & Third Parties

Everything you discuss in therapy is confidential. Confidentiality will only be broken under exceptional circumstances:

  1. Legal Requirement: Where compelled by a court of law.

  2. Safeguarding / Risk: Where there is serious risk of harm to yourself or others, or in matters relating to acts of terrorism, money laundering, or child protection. (Where possible and safe, I will discuss this with you first.)

Essential Professional Sharing

In line with BACP guidelines, I share anonymised client cases with a qualified Clinical Supervisor to ensure high standards of practice. Your identity remains protected.

I also maintain a Therapeutic Will. In the event of my sudden incapacity or death, a trusted professional colleague will be granted access to client contact details to inform you appropriately.

Digital Processors & Payments

I do not sell or share data for marketing. Limited transactional data (e.g., your name on bank statements) passes through secure financial institutions if you pay by bank transfer or card.

6. Record Retention & Security

  • Storage: Digital notes and contact details are stored on password-protected, encrypted devices. Session notes are kept separate from contact details using ID codes.

  • Retention Period: In accordance with my professional insurance requirements, clinical records are securely retained for 7 years following our final session. After this period, all paper and digital records are permanently destroyed.

7. Your Data Protection Rights

Under UK data protection law, you have the right to:

  • Access: Request a copy of the personal data held about you (Subject Access Request), which will be fulfilled within 30 days free of charge.

  • Rectification: Request corrections to any inaccurate data.

  • Erasure / Restriction: Request deletion or limited processing of your data (subject to my legal and insurance requirements to retain clinical records).

To exercise any of these rights, please contact me in writing at [Your Email Address].

8. Concerns & Complaints

If you have any concerns about how your data is handled, please raise them with me first so I can resolve the issue.

If you remain dissatisfied, you have the right to lodge a formal complaint with the UK supervisory body: