Privacy Notice
Privacy Policy
Last updated: September 2026
This privacy policy explains how I collect, store, and use your personal data. It complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and aligns with the British Association for Counselling and Psychotherapy (BACP) Ethical Framework for the Counselling Professions.
Data Controller
I am the sole Data Controller for this private practice. I am registered with the Information Commissioner's Office (ICO) under registration number ZC233295 .
Name: Cara Hicks
Phone: 07551191912
Lawful Basis for Processing
Under the UK GDPR, I process your data using the following legal bases:
Contract: To fulfill the counselling agreement we make.
Legitimate Interests: To safely manage my business and respond to website enquiries.
Special Category Data: I process health-related data under UK GDPR Article 9(2)(h) for the provision of health or social care treatment.
Information I Collect
I only collect information necessary to provide safe, ethical, and person-centered counselling. Information is collected directly from you.
Website Enquiries
When you use the contact form on my website, I collect:
Name
Email address
Phone number
Any message you choose to include
Cookies and Tracking
My website uses cookies to improve your browsing experience.
Essential Cookies: Required for the website to function safely (e.g., security features, contact form handling).
Managing Cookies: You can accept or decline cookies through your browser settings or my website's cookie banner.
Client Intake and Therapy
If we decide to work together, I will collect:
Postal address
Emergency contact details
GP name and practice details
Basic relevant details about your mental health and history
Brief, anonymised session notes
How I Use Your Data
I use your information to:
Respond to your initial website enquiries.
Provide professional counselling services.
Maintain ethical records of our sessions in line with BACP guidelines.
Contact your emergency contact or GP if there is a severe risk to your safety or the safety of others.
Data Storage and Security
I secure your data using professional, modern standards.
Google Workspace: I use Google Workspace for emails, forms, and digital storage. This account uses strong passwords and two-factor authentication (2FA). Google processes data securely and complies with UK adequacy standards or standard contractual clauses.
Your personal information may exist within:
Text messages; Emails; Voicemails; Therapy contracts; Written notes; Bank statements.
Please be aware that all counsellors are required to undergo regular supervision, of which some details of your counselling may be discussed to ensure safe and ethical practice - your information is presented in an anonymised way and is treated confidentially by supervisors.
No Data Sharing: I do not sell, rent, or pass your data to third parties. The only exception is if I am legally required to do so, or if I believe you are at immediate risk of serious harm (in alignment with BACP confidentiality exceptions).
Social Media
Social media messaging systems are not secure, GDPR-compliant spaces for sensitive health data. Please use my secure business email or telephone number for all scheduling and communication.
Public Following: You are welcome to follow my professional business pages.
Privacy Risks: Please be aware that liking, commenting, or following my business page creates a public link. Other users may infer that you are in therapy with me.
Interaction Rules: To protect your privacy, I will not reply to comments or messages left by clients on my public business posts. If your profile appears in my feed due to platform algorithms, I will ignore it.
Use of artificial intelligence (A.I.)
I never use A.I. audio recorders, transcribers, or smart speakers to listen to, record, or log our therapy sessions.
I do not input any of your personally identifiable information, session transcripts, or clinical notes into public or third-party A.I. tools (such as ChatGPT).
All clinical assessments, reflections, and progress notes are written solely by me.
Data Retention
Enquiry Data: If you do not start therapy with me, I delete your website enquiry data within 3 months. If you would prefer your information to be deleted sooner than this, please provide a written notice, see ‘contact information’.
Client Records: If we work together, I keep your basic data and session notes for 6 years after our final session. This timeline meets UK professional indemnity insurance requirements and BACP record-keeping recommendations. After 6 years, all your digital records are permanently deleted.
Your Rights
Under UK data protection laws, you have the right to:
Access a copy of the personal data I hold about you.
Ask me to correct any inaccurate information.
Request that I delete your data (subject to my insurance requirements to keep therapy records for 6 years).
Withdraw your consent for me to process your data at any time.
Complain to the Information Commissioner’s Office (ICO) if you are unhappy with how I handle your data.
How to complain
If you have any concerns about the use of your personal information, you can make a data protection complaint to me using the email address below; this will be formally acknowledged in writing within 30 days of receiving the communication.
If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AFHelpline number: 0303 123 1113
