Last updated: 31 August 2026
1. Who is responsible for your information?
Fiona Staddon, trading as fiona@your-counsellor, is the data controller for personal information collected through this website and while providing counselling services.
ICO registration number: ZB858769
For privacy enquiries, requests or complaints, email fiona@your-counsellor.co.uk.
2. Services covered by this policy
This policy applies to counselling provided face to face, online and by telephone, as well as enquiries, appointment booking, payments and use of this website.
3. Information I may collect
- your name, contact details and communication preferences;
- enquiry, appointment, attendance, cancellation and payment information;
- information you choose to provide during assessment or counselling;
- brief counselling notes, correspondence and professional records;
- GP and emergency-contact information where provided or needed for safe practice;
- information relevant to safeguarding, risk management, complaints or insurance matters;
- technical information created when you use this website, including your cookie and local-storage preferences and, where you allow analytics, website usage information collected through Google Analytics.
4. Special category information
Counselling records may include special category personal data, such as information about physical or mental health, neurodivergence, disability, sexuality, relationships, family circumstances, racial or ethnic origin, religious or philosophical beliefs, or other sensitive matters that you choose to discuss.
This information is collected only where it is relevant to providing a safe, ethical and individually tailored counselling service. It is handled with additional safeguards and is not used for marketing.
5. How and why I use information
- to respond to enquiries and take steps you request before counselling begins;
- to provide counselling and maintain appropriate professional records;
- to manage appointments, payments, cancellations and practice administration;
- to communicate with you about your counselling;
- to manage safeguarding concerns, serious risk or emergencies;
- to comply with legal, tax, insurance and professional obligations;
- to establish, exercise or defend legal claims;
- to operate the website, remember your privacy choices and, where you allow analytics, understand and improve website use.
6. Lawful bases
For ordinary personal data, the principal lawful basis is UK GDPR Article 6(1)(b): processing that is necessary to take steps at your request before entering into a counselling agreement and to perform that agreement.
Where appropriate, I may also rely on:
- Article 6(1)(c) — legal obligation, for example tax, accounting or regulatory requirements;
- Article 6(1)(f) — legitimate interests, for proportionate practice administration, information security, safeguarding, supervision, insurance and the establishment or defence of legal claims. The legitimate interests are operating a safe, ethical and accountable counselling practice and protecting clients, the practice and others;
- Article 6(1)(d) — vital interests, in a rare emergency where processing is necessary to protect someone’s life;
- Article 6(1)(a) — consent, where consent is specifically requested and is genuinely optional.
For special category information used to provide counselling, the principal condition is UK GDPR Article 9(2)(h): processing necessary for the provision and management of health or social care, subject to professional confidentiality and the safeguards required by data-protection law.
Where the circumstances require it, I may instead or additionally rely on Article 9(2)(f) for legal claims, Article 9(2)(c) to protect vital interests where a person cannot give consent, or Article 9(2)(a) where explicit consent is the appropriate condition.
7. Where information comes from
Most information comes directly from you. Information may also come from a referrer, emergency contact, GP or another professional where you have agreed to this, or where disclosure is otherwise lawful and necessary.
8. Kiku practice management system
The online appointment calendar and related client-management functions are supplied by Kiku. The embedded Kiku booking frame is not loaded until you allow the optional booking service.
When you load Kiku or make a booking, the information you enter is transmitted to and processed through Kiku. This may include contact details, appointment information, form responses, communications and administrative records. Kiku’s own privacy and cookie information also applies when you use its service.
9. Google Analytics
If you choose to allow analytics, this website uses Google Analytics 4 to understand how the website is used and to help improve it. Google Analytics may collect information such as pages visited, session information, approximate location, and browser or device information. Google Analytics is not loaded until you allow analytics through the website cookie controls.
For optional Analytics storage and associated processing where consent is required, I rely on your consent. You can withdraw that choice at any time using Cookie settings in the website footer. Further details about the cookies used are in the Cookie Policy.
10. Payments
Online payments may be processed by Stripe through Kiku. I do not receive or store your complete payment-card details. Stripe processes payment information under its own privacy arrangements. I retain only the information needed for payment reconciliation, receipts, accounting and tax records.
11. Sharing and confidentiality
Personal information is not sold. Confidentiality is central to counselling, but it is not absolute. Information may be shared only where necessary and lawful, including with:
- professional supervisors, using the minimum information needed and normally without identifying you;
- Kiku, Stripe, Google Analytics, website hosting, secure email or other suppliers supporting the practice, where relevant to the service you use and your privacy choices;
- accountants, insurers, legal advisers or regulators;
- health professionals, emergency services, safeguarding bodies or authorities where there is a serious risk, safeguarding concern, legal requirement or other lawful and proportionate reason.
The limits of confidentiality are also explained in the counselling working agreement.
12. International processing
Some service providers may process information outside the United Kingdom. Where this occurs, I rely on appropriate safeguards required by UK data-protection law, such as UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.
13. How long information is kept
| Record | Retention period |
|---|---|
| Initial enquiries that do not become counselling clients | Up to 12 months after the last contact |
| Counselling records, including assessment and brief session records | 7 years after counselling ends, unless a longer period is required because of a complaint, legal claim, safeguarding matter or insurer requirement |
| Financial, invoice and tax records | 6 years after the end of the relevant financial year, or longer where legally required |
| Website cookie and local-storage preference | Up to 90 days, unless you clear it sooner or make a new choice |
| Google Analytics information | Retained according to the data-retention settings configured in the Google Analytics property and Google’s applicable retention rules; these settings are reviewed periodically |
| Complaints, safeguarding and legal records | For as long as reasonably necessary in view of the matter, professional guidance, insurance requirements and applicable limitation periods |
When information is no longer required, it is securely deleted or destroyed. Retention periods may be reviewed if professional, insurance or legal requirements change.
14. Security
Reasonable technical and organisational measures are used to protect personal information, including access controls, secure systems, data minimisation and appropriate record-management practices. Website fonts are hosted locally, so this site does not contact Google Fonts or another font provider.
No internet or email service can be guaranteed completely secure. Please avoid sending highly sensitive information by ordinary email unless this has been discussed and agreed.
15. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to:
- receive a copy of your personal information;
- have inaccurate or incomplete information corrected;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a portable format;
- withdraw consent where consent is the basis used;
- complain about how your information is handled.
Not every right applies in every situation, and information may sometimes need to be retained for legal, safeguarding, insurance or professional reasons. I will explain any limitation that applies. Identity may need to be confirmed before information is released.
16. Privacy concerns and complaints
Please contact me first at fiona@your-counsellor.co.uk so I can consider and, where possible, resolve your concern.
You also have the right to complain to the Information Commissioner’s Office. Current contact and complaint information is available on the ICO website.
17. Cookies and local storage
This website uses necessary browser storage to remember your privacy choice. Google Analytics and the optional secure online booking system are not loaded until you allow the relevant option. See the Cookie Policy or use the button below to review or change your choice.
18. Changes to this policy
This policy may be updated when services, suppliers, professional requirements or data-protection law change. The date at the top shows the latest revision.