Privacy Notice

​

Last updated: 31/8/26

​

Rebecca Rose Counselling is committed to protecting your privacy and handling your personal information in a lawful, fair and transparent way.
 

This privacy notice explains what information I collect, why I collect it, how it is used and stored, who it may be shared with, and your rights under UK data protection law.
 

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Rebecca Rose Counselling is the data controller for the personal information described in this notice.

​

Data controller: Rebecca Rose Counselling
Email: Rebeccarosecounselling@outlook.com
Telephone: 07506538980
Practice address: Rebecca Rose Counselling, Raylor Centre, James Street, York, YO10 3DW
ICO registration number: ZC206952

​

Information I may collect

​

Depending on how you contact me and whether you become a client, I may collect information including:

• your name;

• email address and telephone number;

• address, where relevant;

• date of birth or age, where relevant;

• emergency contact details;

• information you provide when making an enquiry;

• appointment and attendance information;

• payment and invoicing information;

• correspondence between us;

• brief counselling records or clinical notes;

• information relevant to your counselling, wellbeing, circumstances and support needs.

• ​

During counselling, you may choose to disclose information which is considered special category data under UK GDPR. This can include information relating to your physical or mental health, racial or ethnic origin, religious or philosophical beliefs, political opinions, sex life or sexual orientation.

​

I will only collect information that is reasonably necessary for providing counselling, managing our professional relationship, meeting legal or professional obligations, or running my practice.

​

Why I use your information

​

I may use your information to:

• respond to enquiries;

• arrange and manage counselling appointments;

• provide counselling services;

• communicate with you about your sessions;

• maintain appropriate clinical and administrative records;

• process payments and maintain financial records;

• manage cancellations, missed appointments and other contractual matters;

• maintain appropriate professional supervision;

• respond appropriately to safeguarding concerns or serious risks of harm;

• comply with legal, regulatory, insurance and professional requirements;

• establish, exercise or defend legal claims where necessary;

• maintain the security and administration of my website and practice.

My lawful bases for processing

​

Under UK GDPR, organisations must identify a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:
 

Contract – where processing is necessary to enter into or fulfil the counselling agreement between us.

Legitimate interests – where processing is reasonably necessary to operate and administer my counselling practice, respond to enquiries, maintain appropriate records, protect the security of the practice or establish or defend legal claims, provided that these interests do not override your rights and freedoms.
 

Legal obligation – where I am required to process or retain information in order to comply with the law.

Vital interests – in exceptional circumstances where processing is necessary to protect someone's life.

​

Where I process special category data in connection with counselling, I rely on Article 9(2)(g) UK GDPR - processing necessary for reasons of substantial public interest - together with the counselling condition in Schedule 1, Part 2 of the Data Protection Act 2018. Where relevant, other conditions may apply, for example in relation to safeguarding, vital interests or legal claims.

​

I do not rely on consent as the lawful basis for all counselling records simply because you have agreed to counselling. Where consent is specifically relied upon for a particular use of your information, you may withdraw that consent at any time.

​

Counselling records and confidentiality

​

Counselling is confidential, and I take reasonable measures to protect the information you share with me.

​

I may keep brief counselling notes and administrative records where appropriate. These are stored securely and access is restricted.

​

I receive professional supervision as part of ethical counselling practice. Client work may be discussed in supervision, but identifying information will be minimised wherever reasonably possible.

​

Confidentiality is not absolute. There may be exceptional circumstances in which information needs to be shared, including where:

• I believe there is a serious and imminent risk of harm to you or another person;

• there is a safeguarding concern involving a child or adult at risk;

• disclosure is required by law;

• a court requires disclosure;

• information is necessary for the establishment, exercise or defence of a legal claim;

• another exceptional situation arises in which disclosure is justified and lawful.

 

Where it is safe and appropriate to do so, I would normally aim to discuss such a disclosure with you beforehand.

​

Emergency contact information

​

If you provide details of an emergency contact, I will use those details only where reasonably necessary in connection with your safety or wellbeing.
 

Please ensure that the person whose details you provide is aware that you have given me their information.

​

Sharing your information

​

I do not sell your personal information.

​

Your information may be shared, where necessary and appropriate, with organisations or individuals such as:

• my professional supervisor;

• professional advisers such as my insurer, accountant or legal adviser;

• service providers used to operate my practice, such as website, email, appointment or secure record-storage providers;

• payment processors;

• regulatory, safeguarding, law-enforcement or other public authorities where disclosure is lawful and necessary.

 

Only the minimum information reasonably required will be shared.

​

Where third-party providers process personal information on my behalf, I take reasonable steps to use providers that offer appropriate data-protection safeguards.

​

Clinical will and unexpected incapacity

I maintain a clinical will to protect clients in the event that I die, become seriously unwell, or am otherwise unexpectedly unable to continue practising or contact clients myself.
 

In those circumstances, a named professional colleague may be given limited access to information necessary to identify and contact current clients, secure counselling records, and make appropriate arrangements regarding ongoing sessions or the safe retention or disposal of records.
 

They will only access information where necessary to carry out this role and will be required to maintain confidentiality and handle personal information in accordance with applicable data protection requirements.

​

Website and Wix

​

This website is hosted using Wix.

​

When you visit the website, Wix and associated service providers may process technical information such as your IP address, device information, browser information and information about how the website is used.

​

Some providers may process information outside the United Kingdom. Where international transfers occur, appropriate safeguards should be used in accordance with UK data protection law.

​

You can find further information about Wix's own privacy practices in Wix's privacy documentation.
 

Cookies and analytics
 

This website may use cookies and similar technologies.
 

Some cookies are necessary for the website to function. Other cookies, such as analytics or marketing cookies, may require your consent before they are placed on your device.
 

Where required, you can manage your preferences using the cookie banner or cookie settings available on this website.
 

How long I keep information
 

I do not keep personal information for longer than reasonably necessary.
 

Counselling records: 7 years, as per insurer's instructions.

Enquiries that do not lead to counselling: 6 months

Financial records: these may need to be retained for the period required by tax and accounting legislation.
 

Some information may need to be retained for longer where required by law, insurance requirements or in connection with an actual or potential legal claim.
 

When information is no longer required, it will be securely deleted or destroyed.
 

How I protect your information
 

I take appropriate organisational and technical measures to protect personal information against accidental loss, unauthorised access, alteration or disclosure.
 

These measures may include password protection, encryption, restricted access and appropriate physical security.
 

No method of electronic transmission or storage can be guaranteed to be completely secure, but reasonable measures are taken in proportion to the sensitivity of the information held.
 

Your rights
 

Depending on the circumstances, UK data protection law gives you rights including:

• the right to be informed about how your information is used;

• the right to access personal information held about you;

• the right to ask for inaccurate information to be corrected;

• the right to ask for information to be erased in certain circumstances;

• the right to ask for processing to be restricted in certain circumstances;

• the right to object to certain types of processing;

• the right to data portability in certain circumstances;

• rights relating to automated decision-making and profiling.

These rights are not absolute and may depend upon the lawful basis for processing and other legal obligations.
 

You can make a request by contacting me using the details at the top of this notice.
 

The ICO sets out the information organisations must provide about purposes, lawful bases, retention, recipients and individuals' rights.
 

Complaints
 

If you have concerns about how I have handled your personal information, please contact me first so that I have the opportunity to address them.
 

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
 

Changes to this privacy notice
 

I may update this privacy notice from time to time to reflect changes in my practice, services, legal obligations or the way personal information is processed.

The date at the top of this page will show when the notice was most recently updated.