Privacy Policy.

Last updated: 01 November 2026

The Counselling Hut is committed to protecting your privacy and handling your personal information respectfully, securely and in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal information I collect, why I use it, how it is stored, when it may be shared and what rights you have over your information.

I recognise that counselling involves highly personal and sometimes sensitive information. I aim to collect only the information necessary to provide my services and to protect your confidentiality wherever possible.

1. Who is responsible for your information?

The Counselling Hut is the data controller responsible for the personal information processed in connection with my counselling services.

Contact details

The Counselling Hut is registered with the Information Commissioner's Office (ICO), registration reference ZB182301.

2. What information do I collect?

The information I collect depends on the services you use and your interactions with The Counselling Hut.

This may include:

Contact and identification information

  • Your name and contact details.

  • Information you provide when making an enquiry or arranging an appointment.

  • Appointment dates, times and attendance information.

Counselling information

  • Brief session notes and relevant information about the therapeutic work.

  • Personal information you share about your circumstances, relationships, wellbeing or health.

  • Relevant information concerning safety or safeguarding where necessary.

Communication information

  • Emails sent or received through Gmail.

  • WhatsApp messages, including personal or therapeutic information you choose to send.

  • Relevant text messages and telephone communications through my Apple iPhone.

  • Other correspondence necessary to manage the counselling relationship.

Payment information

  • Records of fees, payments, refunds and outstanding balances.

  • Transaction references and other financial information necessary to administer payments and maintain appropriate business records.

I aim to limit the information I collect and retain to what is relevant and necessary for the purpose for which it is used.

3. Why do I use your information?

I use personal information for the following purposes:

  • Respond to enquiries and arrange appointments.

  • Provide and manage counselling sessions.

  • Maintain appropriate session notes and support continuity of care.

  • Communicate about appointments and practical arrangements.

  • Administer payments and maintain financial records.

  • Discuss relevant aspects of my work in professional supervision.

  • Respond appropriately to safeguarding concerns or risks of serious harm.

  • Meet applicable legal, professional, insurance and regulatory obligations.

  • Manage complaints and establish, exercise or defend legal claims where necessary.

I do not use counselling records to train AI systems or to generate AI summaries or analyses of client sessions.

4. What is my lawful basis for using your information?

I process personal information only where an appropriate lawful basis applies under data protection law.

Depending on the circumstances, this may include taking steps to provide counselling services under our agreement, pursuing legitimate interests where appropriate, complying with legal obligations, or another applicable lawful basis.

Article 6 — Lawful basis

Depending on the purpose, The Counselling Hut may rely on the following lawful bases:

  • Article 6(1)(b) — Performance of a contract: to respond to requests for counselling, arrange appointments, provide agreed counselling services, manage the counselling relationship and administer payments where the processing is necessary for the contract or requested pre-contractual steps.

  • Article 6(1)(c) — Legal obligation: where personal information must be processed to comply with an applicable legal obligation, including relevant financial and accounting requirements.

  • Article 6(1)(f) — Legitimate interests: where necessary for legitimate business and professional purposes, such as maintaining appropriate business records, managing enquiries and dealing with complaints or potential legal claims, provided these interests are not overridden by the individual's rights and freedoms.

Article 9 — Special category personal data

Counselling may involve information about mental health, physical health and other sensitive personal circumstances. Health information is special category personal data under the UK GDPR and requires an additional condition for processing, as well as an Article 6 lawful basis.

Where the legal requirements are met, The Counselling Hut intends to rely on Article 9(2)(h) — health or social care, for processing health information that is necessary to provide counselling and manage the delivery of that service.

This condition will be relied upon only where the applicable requirements of the UK GDPR and Data Protection Act 2018 are satisfied, including the relevant professional confidentiality safeguards.

Other Article 9 conditions may apply to particular circumstances where appropriate and legally justified.

Data minimisation and security

Only information reasonably necessary for the relevant purpose is collected and retained. Personal information is handled securely and in accordance with the Privacy Policy and Data Retention and Secure Disposal Schedule.

5. Where your information is stored and who processes it?

I use the following systems to support my practice.

WeAreKiku — client records and practice management

WeAreKiku is my booking and practice management system. I use it to store client details, session notes and relevant appointment information. Access is protected by a password and two-factor authentication.

Gmail — email

I use Gmail to manage enquiries and email correspondence. Emails and attachments may contain personal information that you provide.

WhatsApp and Apple iPhone — messages and calls

I use WhatsApp, telephone calls and messaging through my iPhone for appropriate communication with clients. Clients sometimes send personal or therapeutic information through WhatsApp. Such messages may therefore contain sensitive personal information.

I will take reasonable steps to protect these communications, limit access and retain information only where appropriate. However, the privacy of messages may also depend on your device, account settings, notifications, backups and linked devices.

Zoom — online counselling

Where online counselling is provided, I use Zoom to deliver sessions.

I do not record or transcribe counselling sessions on Zoom. If this practice changes, I will review the relevant privacy information and arrangements before introducing recording or transcription.

Square Terminal — card payments

I use Square Terminal to accept card payments. Square processes the information required to complete card transactions and provide its payment services.

Starling — bank transfers

I use my Starling business bank account to receive bank transfers and manage business finances. Relevant transaction information may be retained for accounting and legal purposes.

These providers may process information on my behalf or for their own purposes, depending on their services and contractual arrangements. Their own privacy notices explain their respective practices.

6. Confidentiality and professional supervision

Confidentiality is central to my counselling practice.

I discuss relevant aspects of my work in professional supervision to support safe, ethical and effective practice. I aim to minimise identifying information and share only what is necessary for the supervisory purpose.

There may be circumstances in which confidential information needs to be shared without your consent. These may include:

  • Where disclosure is required by law.

  • Where disclosure is legally and ethically justified to address a serious risk of harm to you or another person.

  • Where relevant safeguarding concerns arise, including concerns involving children or adults at risk.

  • Where another lawful and ethically justified reason for disclosure applies.

Any proposed disclosure will be considered carefully, including its necessity and proportionality.

Where appropriate and safe to do so, I will discuss a proposed disclosure with you beforehand. I may be unable to do so if this is legally prohibited or could increase the risk of harm.

Information will be shared only to the extent reasonably necessary for the relevant purpose.

7. Use of artificial intelligence (AI)

I may use AI tools to help create general counselling resources and other practice materials.

I occasionally use anonymised examples when creating resources. These examples must be sufficiently anonymised so that an individual cannot reasonably be identified, including through a combination of details or other information available.

I do not enter identifiable client information, identifiable case material or client session notes into AI tools. I do not use AI to create, analyse, summarise or process client records.

AI-generated resources are reviewed by me for accuracy, suitability and appropriateness before use. AI does not replace my professional judgement, clinical responsibility or supervision.

I periodically review my use of AI and digital technology, including confidentiality, privacy, security and ethical considerations.

8. How I protect your information

I take reasonable and proportionate steps to protect your information against unauthorised access, loss, misuse or disclosure.

These measures include password protection, two-factor authentication where available, appropriate device security and secure storage of physical records in a locked cabinet.

I aim to restrict access to information to what is necessary and to use appropriate security settings when communicating electronically.

Electronic communication and online services cannot be guaranteed to be completely secure. Please consider this when deciding what information to include in emails, WhatsApp messages or other electronic communications.

If a personal data breach occurs, I will assess the circumstances and take appropriate action, including notifying the ICO or affected individuals where required by law.

9. Email, messaging and online privacy

I may use email, WhatsApp, telephone calls and other agreed communication methods for enquiries, appointments and appropriate practical matters.

Please be aware that:

  • Emails and messages may be accessible to someone who has access to your device or account.

  • Message previews and notifications may reveal information on a screen.

  • Privacy may depend on your device security, account settings, backups and linked devices.

  • Messages may contain sensitive information and should be sent with appropriate care.

You are welcome to discuss your preferred method of communication with me, including any concerns about privacy.

Messages are not monitored continuously and are not an emergency service. Please do not rely on email, WhatsApp or telephone messages for an urgent response.

For online sessions, I encourage you to use a private space and take reasonable steps to prevent others from overhearing the session.

10. How long do I retain your information?

I retain information for as long as necessary for the purpose for which it is held, taking account of applicable legal obligations, professional responsibilities, insurance requirements and any relevant legal claims.

Different types of information are retained for different periods. For example, counselling records, enquiries, correspondence, appointment information and financial records may require different retention arrangements.

My retention schedule sets out the period applicable to each category of information, when that period begins and how the information is securely disposed of when it is no longer required.

Where information is no longer necessary, I will take appropriate steps to delete it securely or otherwise dispose of it safely, subject to any applicable legal or professional obligation to retain it.

The retention periods for each category of information will be confirmed in my retention schedule and reviewed periodically.

11. Your data protection rights

Under data protection law, you may have the right to:

  • Access the personal information I hold about you.

  • Rectification of inaccurate or incomplete information.

  • Erasure of information where the legal conditions for deletion are met.

  • Restriction of processing in certain circumstances.

  • Object to certain types of processing where the relevant legal conditions apply.

  • Data portability in circumstances where this right applies.

  • Withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exceptions. For example, some information may need to be retained to meet legal or professional obligations or to establish, exercise or defend legal claims.

If you wish to exercise a right or ask a question about your information, please contact me using the details at the end of this policy. I may need to verify your identity before responding.

12. Cookies and website information

When you visit my website, certain technical information may be collected by the website platform or through cookies and similar technologies.

The information collected depends on the website features, settings and any third-party services in use.

My website is hosted by Squarespace, which sets essential functional cookies to ensure secure operations and navigation. We also use Squarespace Analytics cookies (such as ss_cid, ss_cvisit, and related identifiers) to understand visitor interactions. Third-party tools or embedded content may deploy additional cookies. You can manage or disable non-essential cookies via your browser or site banner. Refer to the Squarespace Privacy Policy and Cookie Policy for more details

13. Complaints and concerns

If you have concerns about how your personal information is handled, please contact me first so that I can consider your concerns and try to resolve them.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk/make-a-complaint/

ICO information and guidance: https://ico.org.uk/

14. Changes to this Privacy Policy

I may update this Privacy Policy to reflect changes in my practice, the services I use, applicable law or professional guidance.

The latest version will be published on The Counselling Hut website, together with the date it was last updated.

Where a change materially affects how I use your information, I will take appropriate steps to bring the change to your attention.

15. Contact The Counselling Hut

If you have any questions about this Privacy Policy, your personal information or your data protection rights, please contact:

The Counselling Hut

Email: thecounsellinghut@gmail.com

Telephone: 07311 293531

Website: https://www.thecounsellinghut.co.uk/

 
ico-registered.png