Introduction.
Your privacy is paramount, and your personal information is kept secure, used only for its intended purpose in compliance with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. This policy outlines how I handle your data from initial contact to post-therapy, covering lawful bases, storage, and your rights.
- Data Controller: Craig, Headwinds Counselling (ICO registration #ZB182127).
- Contact: craig@headwinds-counselling.co.uk | 07840 366 138.
My lawful basis for holding and using your personal information.
I process your personal data based on the following:
- Active/Prospective Therapy: Performance of a contract.
- Ended Therapy: Legitimate interests.
- Special Categories: Provision of health treatment (counselling) and necessary for a contract with a health professional.
How I use your information.
- Initial Contact: Data is processed for inquiries, with deletion occurring after 12 months if therapy does not proceed, or sooner upon request.
- During Counseling: Data is strictly confidential, stored on encrypted devices, with exceptions for legal obligation (subpoena, terrorism, money laundering) or immediate safety risks.
- Third-Party Access: A designated trusted person may access minimal contact data only if I am incapacitated.
- Records: Notes are kept in a coded, encrypted cloud system.
- Correspondence: Texts/emails are not retained over 12 months; relevant information is anonymized and moved to clinical notes.
- After Therapy: Records are kept for 7 years post-contact to comply with HMRC and professional insurance.
Third party recipients of personal data & International Transfers.
I use Google Workspace for email, calendar, and secure cloud storage. A trusted person is authorized to contact clients in case of my death or incapacitation. Where data is processed outside the UK, I ensure appropriate protection through legally recognized mechanisms, such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).
Your rights & Complaints.
You have the right to request access to, deletion of, or restriction of your data, and to object to processing. Under the Data (Use and Access) Act 2025, verification requests or context clarifications may pause the statutory one-month response timer.
- Complaints: In accordance with the Data (Use and Access) Act 2025, complaints can be lodged directly with me at craig@headwinds-counselling.co.uk. I will acknowledge and investigate within 30 days. You may also contact the ICO directly.
Data security.
I prioritize security by using encrypted devices, strong passwords, and, when needed, coded identifiers that separate clinical notes from personally identifiable information.
Visitors to my website.
I use Google Analytics to monitor site usage for improvements, processed in a non-identifiable manner, based on legitimate interests. Cookies are used only for this purpose, and usage can be blocked via privacy browsers. The site uses WordPress.org, which is GDPR compliant.
In the event of a data breach.
I will report breaches to the Information Commissioner’s Office and inform you if there is a risk of data compromise.