Privacy Notice
Counselling can involve sharing information that is very personal. I take your privacy seriously.
This notice explains what information I collect, why I use it, how I protect it and when I may need to share it.
Who I am and how to contact me:
I am Leah Williams, trading as Leah W Counselling, and I am responsible for how your personal information is collected and used.
Email: leahwcounselling@gmail.com
Please use these details if you have a question about your information, want to exercise one of your data-protection rights, or have a concern.
What information I collect:
I only collect information that is relevant and necessary for providing counselling and running my practice. This may include:
• your name, preferred name, address, telephone number, email address and date of birth;
• emergency-contact details, where appropriate;
• information you choose to share about your life, relationships, experiences, wellbeing and reasons for seeking counselling;
• relevant physical or mental health information, including information about disability, medication or other health-related circumstances;
• counselling records, including appropriate session notes and relevant correspondence;
• appointment, payment and other administrative information.
Health and some other information discussed in counselling is known as special category data and receives additional protection under data-protection law. You do not need to tell me everything about yourself when you begin counselling. I aim to collect only information that I reasonably need for the work we are doing.
Why I use your information:
I use your information to:
• respond to enquiries and arrange appointments;
• provide appropriate and effective counselling;
• keep appropriate records of our work;
• manage appointments, payments and the administration of my practice;
• meet legal, professional, insurance and regulatory responsibilities;
• deal with complaints or legal claims where necessary;
• respond to safeguarding concerns, serious risk of harm or emergencies where necessary.
I do not sell your personal information or use your counselling information for advertising. I do not use solely automated decision-making or profiling.
Legal Bases:
UK data-protection law requires me to have a lawful basis for using your information. Depending on the circumstances, I may rely on:
• Contract – where using your information is necessary to respond to a request from you before we enter into an agreement, or to arrange and provide the counselling service we have agreed between us.
• Legitimate interests – where using information is necessary to manage and protect my practice, maintain appropriate professional records, deal with enquiries or complaints, or establish, exercise or defend a legal claim. I will take care to respect your privacy and rights when relying on this basis.
• Legal obligation – where I am required to collect, use or retain information by law.
Some information discussed in counselling, particularly health information, is special category data and is subject to additional legal protections. Where necessary, I may rely on the legal condition for the provision of health or social care, together with the required safeguards under UK data-protection law.
Confidentiality:
Confidentiality is an important part of counselling. I will normally keep what you share with me private. There are, however, some circumstances in which information may need to be shared:
• Supervision
I attend regular clinical supervision as part of my professional practice. I may discuss aspects of my work with my supervisor so that I can reflect on the therapy and practise safely and effectively. I use anonymised information wherever reasonably possible.
• Safeguarding and serious risk
If I become concerned that you, a child or another person may be at serious risk of harm, I may need to share relevant information with an appropriate professional or service. Where it is safe and appropriate to do so, I will discuss this with you first. There may be circumstances where this is not possible.
• Legal requirements
I may also need to disclose information where required by law, a court order or another lawful authority. Where information does need to be shared, I will aim to share only what is relevant and necessary.
I will not routinely share information about your counselling with your GP, employer, family members or other professionals unless there is an appropriate reason and lawful basis for doing so.
Where your information comes from:
Most of the information I hold about you comes directly from you. Sometimes I may receive limited information from another person or organisation involved in arranging or supporting your counselling, for example where someone refers you or provides your contact details on your behalf.
Who I share information with:
I do not routinely share your counselling information with other organisations. Where appropriate and lawful, relevant information may be shared with:
• my clinical supervisor;
• safeguarding or emergency services;
• other professionals where there is an appropriate reason and lawful basis;
• organisations I am legally required to provide information to.
I also use external service providers to run my practice. These may process personal information on my behalf, including:
• Microsoft – storage and management of business and client documents;
• Google/Gmail – email communication;
• Wix – website hosting and related services;
• Counselling Directory – where you contact me through my profile;
• Starling Bank and relevant payment providers – to receive and record payments.
These providers process the information necessary to provide their services to my business.
Information transferred outside the UK:
Some of the service providers I use may process or store information outside the UK. Where this happens, I will take reasonable steps to ensure that your information is protected in accordance with UK data-protection law. This may include using a destination covered by UK adequacy regulations or an appropriate safeguard for international transfers. You can contact me using the details above if you would like further information about an international transfer.
How I protect your information:
I take reasonable technical and organisational measures to protect your information from loss, misuse, unauthorised access or disclosure. Digital records are stored using password-protected systems and accounts with appropriate security measures. Access to counselling records is restricted to me, except where information needs to be shared appropriately as described in this notice. Paper records, where used, are stored securely and disposed of appropriately when no longer needed.
How long I keep your information:
I do not keep personal information for longer than I reasonably need it.
• Counselling records
Normally three years after counselling ends. This allows me to meet my professional responsibilities and deal with any complaint, claim or other matter relating to the work. It may also allow me to refer back to relevant information if you return for counselling within this period.
• Enquiries that do not become clients
Normally six months after our last contact.
• Financial and tax records
For the period required by HM Revenue & Customs and other applicable legal requirements.
If there is a complaint, claim, investigation or other matter that requires information to be preserved, I may keep relevant information for longer while it is needed. When information is no longer required, I will securely delete, destroy or anonymise it as appropriate.
Your data-protection rights:
Depending on the circumstances, you may have the right to:
• ask for a copy of the personal information I hold about you;
• ask me to correct inaccurate or incomplete information;
• ask me to delete information where there is a legal right to do so;
• ask me to restrict how your information is used;
• object to certain processing, particularly where I rely on legitimate interests;
• request transfer of your information in certain limited circumstances.
These rights do not all apply in every situation.
You can make a request verbally or in writing using the contact details above. I will normally respond within one month.
Do I have to provide my information?
You do not have to provide information simply because I ask for it. However, some information is necessary for me to provide counselling safely and appropriately or to manage our agreement. If you choose not to provide information that is necessary for these purposes, I may not be able to provide or continue providing counselling.
How to make a data-protection complaint:
If you have a concern about how I have handled your personal information, please contact me first so that I have an opportunity to understand and resolve it.
Email: leahwcounselling@gmail.com
If you remain unhappy, you can complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office
Public Advice and Data Protection Complaints Service
ICO Head Office
4th Floor,
No.3 Circle Square
5 Hawkshaw Street Manchester
M1 7BL
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to this privacy notice
I may update this notice if my practice, the services I use or my legal responsibilities change. The current version will be provided to clients and made available online.
Last updated: October 2026