Key Policies at Candlewood Counselling

Candlewood Counselling 

Client Privacy Notice 

Effective date: 7 September 2026 

Version: 2.0 

This notice explains what personal information I collect, why I use it, where it is kept, when it may be shared and how long it is retained. It applies to people who enquire about or receive counselling from Candlewood Counselling. 

1. Who is responsible for your information 

Candlewood Counselling is a sole-trader practice operated by Samantha Jane Martin. I am the data controller, which means I decide what personal information is needed and how it is used. I am registered with the Information Commissioner’s Office (ICO). 

Contact 

Samantha Jane Martin 

Candlewood Counselling 

Email: samantha[at]candlewoodcounselling.co.uk 

Telephone: 07554 356807 

Website: www.candlewoodcounselling.co.uk 

I do not publish my home address. A correspondence address can be provided where it is reasonably required. 

2. Information I may collect 

I collect only information that is relevant to handling an enquiry, providing counselling safely, administering the practice, meeting professional responsibilities and complying with the law. 

Enquiry and contact information 

This may include your name, preferred name, email address, telephone number, how and when you contacted me, the source of the enquiry, whether I replied, arrangements for an initial call and brief factual follow-up information. An enquiry may arrive through my website, a counselling directory, BACP, email, telephone, text or WhatsApp. 

Administrative information 

This includes your client code, enquiry and client status, appointment dates and mode, attendance, agreed fees, reminder preferences, follow-up dates, records that an agreement or privacy notice was sent, and short practical notes about booking or communication. It does not include a narrative of counselling sessions. 

Sensitive and health-related information 

This may include your address, GP details, emergency-contact details, relevant physical or mental health information, accessibility or communication needs, risk or safeguarding information, and information you choose to discuss during counselling. Information about health, sexuality, racial or ethnic origin, religion or beliefs may be special-category information under UK GDPR and receives additional protection. 

Clinical records 

I make brief paper notes after sessions. These may record the date, main themes relevant to the work, important decisions, risk or safeguarding matters, agreed actions and referrals. Notes are identified by a client code rather than your name wherever practicable. 

Communications and online-session information 

I may retain relevant emails, text or WhatsApp messages, telephone call information and Microsoft Teams meeting details. Online counselling sessions are never recorded. I do not use automated transcription or AI note-taking in sessions. 

Payment and financial information 

This may include the amount charged, date and method of payment, payment status, invoices and information needed for bookkeeping and tax. Payments may be made by bank transfer, cash or card through SumUp. I do not keep a copy of your full card details. 

3. Where information is kept 

I separate information across systems so that each service holds only what is needed for its purpose. 

SharePoint Client Administration and Microsoft 365 

The private Candlewood Counselling SharePoint site contains the Client Administration list. This is the live administrative record. It holds contact details and information such as your client code, name, preferred name, email, telephone number, enquiry source and date, status, follow-up actions, initial-call and first-session information, session mode, reminder preferences, confirmation records. 

Microsoft Outlook is used for practice email. OneDrive for Business holds current and archived practice documents, including versions of the counselling agreement and privacy notice. Private Microsoft Forms are used by me to log enquiries and first-session arrangements. Power Automate transfers administrative information between these services, sends agreed messages and creates administrative alerts. Microsoft To Do contains code-only tasks and does not contain names, contact details or clinical information. 

The SharePoint site and related practice files are private. Access is restricted to me unless another person has a genuine authorised need. The Microsoft and Google practice accounts use multi-factor authentication. Devices use password protection, automatic locking, encryption and security updates. 

TherapyLock 

TherapyLock is used separately for more sensitive information. I store a client code or reference there together with information such as your address, GP, emergency contact and relevant health, accessibility, risk or safeguarding information. I do not store my paper session notes there. 

TherapyLock acts as my data processor. According to its service information, data is hosted in Frankfurt, Germany, encrypted while being transmitted and while stored, and protected by access controls and activity logging. A limited technical-support team may access the underlying system only when necessary for maintenance or to investigate a problem, under data-protection and confidentiality obligations. TherapyLock states that it does not use AI to read or analyse therapeutic information and does not use client information for advertising. 

Agreeing to the use of TherapyLock is separate from the legal basis on which I keep records needed to provide counselling and meet professional obligations. If you do not wish me to use TherapyLock, or later change your mind, please speak to me. We can discuss a suitable alternative. This will not necessarily require the deletion of information that I must retain for another lawful reason. 

Paper clinical notes 

Session notes are kept on paper in a locked filing cabinet. The notes are coded and kept separately from readily identifying contact information. They are not stored in SharePoint, Outlook, Google Calendar, Microsoft Teams or TherapyLock. 

Google Calendar and Microsoft Teams 

Google Calendar is my main appointment diary. Calendar entries use a client code and a generic description such as “counselling session” or “initial call”. They do not contain your name, contact details, presenting concerns or clinical notes. 

Microsoft Teams is used for online sessions. Microsoft may process the account, meeting and technical information needed to provide the connection. Sessions are not recorded or transcribed. 

Telephone, text, WhatsApp and payments 

My practice telephone and its service providers process call, SMS and WhatsApp information. Please avoid sending detailed clinical information by ordinary email, text or WhatsApp. SumUp and the relevant banks process card or bank-transfer information under their own legal and regulatory responsibilities. I retain only the payment and accounting information needed for my records. 

4. Why I use information and my lawful bases 

UK GDPR requires a lawful basis under Article 6 whenever personal information is used. Special-category information also requires a condition under Article 9. 

My legitimate interests are providing a safe and accountable counselling service, maintaining accurate evidence of the service provided, protecting clients and others, and responding properly to complaints, insurance matters or legal claims. I consider the necessity of the processing and its effect on your rights before relying on this basis. 

Consent to counselling is important professionally and ethically, but consent is not used as the blanket data-protection basis for every necessary record. Where I do rely on consent for a particular use or disclosure, you may withdraw it. Withdrawal does not affect processing that was lawful before withdrawal or information retained under another lawful basis. 

5. Who may receive information 

I do not sell client information or use it for marketing. Information is shared only when there is a clear reason and, where possible, I will discuss this with you first. I disclose no more than is necessary. 

Information may be shared with: 

• my clinical supervisor, using a client code and removing identifying details wherever practicable 

• your GP, emergency contact or another professional when you have agreed, or when a serious safety or safeguarding situation provides another lawful and ethical justification 

• emergency services, safeguarding services or police where necessary to address a serious and immediate risk, meet a safeguarding responsibility or comply with the law 

• a court or another body with lawful authority, after I have considered the scope and validity of the request and sought advice where appropriate 

• HMRC, my accountant, bank, SumUp or insurer where necessary for tax, payment, insurance, complaint or legal purposes 

• BACP, NCPS, the ICO or a professional or legal adviser where necessary to respond to a complaint, investigation, data-protection matter or legal claim 

• the service providers named in this notice, acting under contracts or their own applicable legal duties. 

If severe illness or death prevents me from contacting clients, a nominated professional colleague may have limited access to your name and contact details so that they can tell you what has happened and help you consider alternative arrangements. They will not have access to the content of your sessions and will be bound by confidentiality. 

Confidentiality may occasionally need to be limited to protect you or another person from serious harm, to meet safeguarding responsibilities, or where disclosure is legally required or authorised. A disclosure is not automatic merely because a concern has arisen. I will consider the facts, professional guidance and the law, seek supervision or legal advice when time permits, and share only what is necessary. I will usually tell you before sharing unless doing so would increase risk, prejudice an investigation or be unlawful. 

7. How long information is kept 

I review records and securely delete or destroy them when they are no longer needed. A longer period may apply if there is an unresolved complaint, safeguarding matter, insurance notification, legal claim or legal requirement. Where that happens, I retain only the information relevant to that purpose. 

The five-year period for consultation records follows the current record-keeping requirement of Holistic Insurance Services for adult clients. It also provides a defined period for responding to a complaint or claim. BACP and NCPS require appropriate, relevant and secure records but do not prescribe one universal retention period for every adult private-practice record. UK GDPR requires me to justify the period and not retain information indefinitely. 

Deleting a record from the live system may not remove it immediately from a supplier’s security backup. Backup copies are protected from ordinary use and deleted or overwritten in accordance with the supplier’s backup cycle. 

8. Your data-protection rights 

Depending on the lawful basis and the circumstances, you may have the right to: 

• ask for a copy of personal information I hold about you 

• ask me to correct information that is inaccurate or incomplete 

• ask me to delete information in circumstances where the right to erasure applies 

• ask me to restrict how information is used 

• object to processing based on legitimate interests 

• receive information you provided in a structured, commonly used, machine-readable format where data portability applies 

• withdraw consent where I am relying on consent for a particular use. 

These rights are not absolute. For example, I may need to retain information to meet a legal obligation, provide health care under a duty of confidentiality, or establish, exercise or defend a legal claim. I will explain any lawful reason why I cannot fully comply with a request. 

Please send a request to samantha@candlewoodcounselling.co.uk. I may ask for enough information to confirm your identity. I will normally respond without undue delay and within one month. There is usually no charge. 

No decision about your counselling, risk or access to services is made solely by automated means. 

9. If something goes wrong 

I take reasonable steps to prevent loss, misuse or unauthorised access. If a personal-data breach occurs, I will contain it, record and assess it, take steps to reduce harm, and notify the ICO and affected people when UK data-protection law requires this. 

If you have a concern, please contact me first so that I can investigate it: 

Samantha Jane Martin 

Email: samantha@candlewoodcounselling.co.uk 

Telephone: 07554 356807 

You may also complain to: 

Information Commissioner’s Office 

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 

Telephone: 0303 123 1113 

Website: www.ico.org.uk/make-a-complaint 

You may raise a professional concern through the complaints processes of BACP or NCPS. Their complaints processes are separate from the ICO’s role as the data-protection regulator. 

10. Changes to this notice 

I review this notice when the law, professional guidance or my working systems change. The effective date and version number show when it was last updated. If a change materially affects how existing client information is used, I will take reasonable steps to tell current clients. 

This notice provides information about Candlewood Counselling’s actual handling of client data. It is not a substitute for individual legal advice.