Privacy Policy –

 

Candlewood Counselling

Effective date: 20/10/2025
Data Controller: Candlewood Counselling (Samantha Jane Martin)
Email: [email protected]

Phone: 07554 356807

1. Introduction

This privacy policy explains how I, Candlewood Counselling, collect, use, store and share personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

I am committed to protecting your privacy and handling your information with care, confidentiality, and transparency.

I am registered with the Information Commissioner’s Office (ICO) as a data controller. My registration number is ZC008383

2. The information I collect

In the course of providing counselling services, I may collect:

• Basic details: name, address, date of birth, phone number, email.
• Health and special category data: information you share in sessions, therapy notes, relevant medical or personal history.
• Administrative and financial data: invoices, payments, and records required for tax purposes.

3. Why I use your information

(lawful bases)

I process your data under the following lawful bases:

• Contract: to provide counselling services you have requested.
• Legal obligation: to maintain financial/tax records for HMRC.
• Consent: for any optional processing (e.g., if you ask me to share information with a GP or other professional).

For special category (sensitive) data, such as therapy notes, I process this as it is necessary for the provision of health care and with your explicit consent.

Consent is obtained in writing at the start of therapy, as part of the client agreement. You may withdraw your consent at any time, unless there is a legal or safeguarding reason that prevents this.

4. How I store your information

• Written therapy notes are kept in a locked filing cabinet.
• Electronic records and email are stored on a password-protected laptop using Microsoft 365 email services.
• Appropriate safeguards are in place to protect against loss, misuse, or unauthorised access.
• My devices are encrypted and protected by up-to-date security software. I regularly review my data protection practices to ensure compliance with UK GDPR.
• My website may use cookies to improve user experience. You can manage cookie preferences via your browser settings. No personal data is collected through cookies without your consent.

5. How long I keep your information

• Therapy notes are retained for 5 years after counselling ends.
• Client records (administrative/financial) are retained for 7 years in line with professional and legal requirements.
  After this period, records are securely destroyed.

6. Sharing your information

Your information is treated as strictly confidential.
I will only share it:

• With your consent (e.g., liaising with your GP or another professional).
• If required by law (e.g., HMRC for tax purposes).
• In professional supervision, where material may be discussed in a way that does not identify you.
• In rare cases, if there are serious safeguarding concerns or risks of harm to yourself or others, I may need to share limited information without consent.

7. International transfers

I use Microsoft 365 to provide email services. Data may be stored on servers outside the UK/EEA, but Microsoft provides safeguards (including UK GDPR-compliant transfer mechanisms) to protect your data.

8. Your rights under UK GDPR

You have the right to:

• Access a copy of your data.
• Request correction of inaccurate data.
• Request erasure of your data (where applicable).
• Restrict or object to certain types of processing.
• Data portability (where applicable).
• Withdraw consent at any time (where consent is the lawful basis).
• Complain to the UK regulator (the Information Commissioner’s Office, ICO) if you are unhappy with how your data is handled: www.ico.org.uk.
• You can make a subject access request by contacting me via email. I will respond within one calendar month, in line with UK GDPR.

9. Data Breaches

In the unlikely event of a data breach, I will take immediate steps to contain and assess the breach. If necessary, I will report it to the ICO within 72 hours and inform affected individuals where appropriate.

10. Contact me

If you have any questions about this privacy policy or how your data is handled, please contact:

Samantha Jane Martin
Candlewood Counselling
[email protected]
07554 356807