Data Controller: Libby Hill

Psychotherapeutic Counsellor

Contact Email: email@libbyhill.co.uk

Registered as a Data Controller with the Information Commissioner’s Office (ICO) under registration number ZA187453.

Policy date: 05 10 2026

Policy review date: 04 10 2027

This document outlines how I collect, process, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. As a sole trader and a registered member of the British Association for Counselling and Psychotherapy (BACP), I am committed to protecting your privacy and maintaining absolute confidentiality.

1. The Types of Data I Collect

I collect and process both personal data and “special category” data (which includes health-related information) to provide safe, professional psychotherapeutic counselling: 

Contact Information:
Your name, phone number, email address, and home address.
Emergency Contact: Name and telephone number of a trusted person or your GP (this is optional and only used in crisis situations).

Special Category Data:
Session notes, psychological history, and relevant medical or lifestyle details, to ensure your safety during counselling sessions.

Digital Identifier Data: Your IP address or email metadata when you contact me digitally or attend video sessions.

2. How I Collect Your Data

Data is collected directly from you via:
• Your initial enquiry (email or telephone).
• Our initial assessment form or introductory conversation.
• Information verbally shared by you during our ongoing counselling sessions.

3. Lawful Basis for Processing Data

Under GDPR, I must have a valid lawful basis to process your information.
I rely on the following:
• Contractual Necessity (Article 6(1)(b)): To fulfill our agreement to provide counselling services to you.
• Legitimate Interests (Article 6(1)(f)): To manage my business efficiently, maintain professional records, and respond to your enquiries.
• Special Category Data / Health & Social Care (Article 9(2)(h))
• I process your health data (session notes) specifically to provide confidential therapeutic treatment, as permitted for health professionals bound by strict ethical duties of confidentiality.

4. How Your Data is Stored & Secured

I operate a very secure, non-computerised physical storage model for my clinical work, supplemented by minimal, secure digital tools for communication:
Clinical Session Notes & Assessments: All therapeutic notes are written by hand and kept entirely offline. They are stored securely in a locked filing cabinet to which only I have access. I use Christian names only for notes, so you cannot be identified. 

Email Communication: I use a dedicated, stand alone email account solely for client communications.
Video Sessions: Online therapy sessions are hosted via Microsoft Teams. These video calls are fully encrypted, strictly confidential, and are never recorded.

Digital Booking/Storage Systems: I do not use third-party cloud apps, automated booking software, or electronic note-taking databases.

5. Sharing Your Data (Confidentiality & Exceptions)

Our work together is strictly confidential. Your information will never be sold or used for marketing. It is only shared under the following limited circumstances:

• Professional Supervision: As a requirement of the BACP, my work is regularly reviewed with a qualified clinical supervisor to maintain safe practice. Your identity is always kept anonymous during these consultations.
• Legal & Ethical Duties: I may breach confidentiality if I am legally compelled to do so (e.g., by a court order), or if I have reason to believe that you or someone else is at risk of serious, imminent harm. I will always endeavour to discuss this with you first if possible.
• Therapeutic Will: In the event of my sudden incapacity or death, a designated professional executor (also bound by strict confidentiality) will be granted secure access to your contact information solely to notify you and assist with your ongoing care.

6. Data Retention

• Enquiry Data: If you contact me but do not begin therapy, your contact details and emails will be permanently deleted within 3 months.
• Clinical Records: To comply with professional standards and the requirements of my professional indemnity insurer (Balens), your clinical notes and contact details will be retained securely for 7 years, following the conclusion of our therapy. After this period, all paper files will be securely shredded, and digital emails will be permanently deleted.

7. Your Rights Under GDPR

You have specific rights regarding the data I hold about you:

• The Right of Access: You can request a copy of the personal data and notes I hold about you (a Subject Access Request).
• The Right to Rectification: You can ask me to correct any inaccurate or incomplete personal information.
• The Right to Erasure (“Right to be Forgotten”): You can ask me to delete your data, though this right is limited by my legal and insurance requirements to retain clinical records.
• The Right to Restrict Processing: You can object to or limit how your data is used.

8. Queries or Complaints

If you have any complaints or questions, please contact me directly via phone or email. Hopefully we can find a solution together but if you believe your data has been mishandled and we cannot resolve the issue, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO) via their website (https://ico.org.uk).

Last Updated: October 2026