Welcome
to Therapy.

Website Data & Cookies

​This website uses cookies to ensure it functions properly and to understand how visitors use the site.

The types of cookies used are:

• Essential cookies (security, page loading)

• Analytics cookies (only with consent)

• Embedded content cookies (e.g., maps, videos, booking widgets)

You can manage cookies via the banner or your browser settings.

Website Analytics

Your browser may automatically share your:

• IP address

• Browser type

• Basic usage data

No advertising or tracking cookies are used.​

Information I collect

If you choose to work with me I will ask for your:

• Name

• Email address

• Phone number

• Emergency contact & GP contact details (optional)​

Administrative Information I maintain

• Appointment history

• Invoices and payment records

• Email correspondence

• Supervision records

Clinical Information (Special Category Data)

• Mental health and emotional wellbeing

• Family or personal history

• Risk or safeguarding concerns

• Protected characteristics (e.g., ethnicity, sexuality, gender identity)

All data is handled confidentially.

Lawful Bases for Processing

I process personal data under the following lawful bases:

• Contract — to provide a therapeutic service of counselling or psychotherapy

• Legitimate Interests — responding to enquiries, managing appointments, maintaining records

• Legal Obligation — safeguarding, court orders, HMRC requirements

• Vital Interests — serious risk of harm

•  Special Category Data — Article 9(2)(h) (healthcare) and Article 9(2)(a) (explicit consent where required).

How Your Information Is Used

Your information is used in order to:

• Provide counselling or psychotherapy

• Maintain clinical and administrative records

• Communicate about appointments

• Manage payments

• Meet ethical, legal, and safeguarding standards

• Discuss anonymised material in supervision

I do not use your data for marketing.

Storage of Notes & Data Security

Your data is stored securely using:

• Encrypted devices

• Password‑protected systems

• Secure email

• Encrypted cloud storage

• Locked physical storage (if used)

Only I have access to your identifiable information.

Retention Periods

• Adult counselling notes: 7 years after final session

• Clients seen as minors: until age 25 (or 8 years after last contact, whichever is longer)

• Supervision notes: 7 years

• Financial records: 6 years (HMRC requirement)

• Enquiry emails: 12 months

•    Safeguarding records: retained per statutory guidance 

Sharing Your Information

I will only share information when:

• Required by Law - Due to serious risk of harm, safeguarding concerns & court orders.

• For Professional Supervision - Wherein material is anonymised.

• With Your Explicit Consent - for GP involvement (with consent) & professional referrals.

I do not sell or trade your data.

Your Rights

You may request to:

• Access your data

• Correct inaccuracies

• Request deletion (where appropriate)

• Restrict or object to processing

• Request data portability

• Withdraw consent (where consent is the basis)

Contact: rosanna.therapy@gmail.com

Data Breach Procedure

If a data breach occurs that risks your rights or freedoms, I will:

• Notify you without undue delay

• Notify the ICO within 72 hours (if required)

I will secure systems, assess impact, document the breach, and take steps to prevent recurrence.

Online Working Policy

• Sessions take place via Microsoft Teams using a private, password‑protected account

• Sessions are not recorded

• Clients must ensure privacy at their location

• If connection drops, I will attempt reconnection for 15 minutes. Rescheduling may be discussed.

• Clients confirm their location and provide an emergency contact at each session

• Online work may not be suitable for everyone

Diversity & Inclusion Statement

I welcome clients of all identities, including diversity in:

• race and ethnicity

• gender identity and expression

• sexual orientation

• disability and neurodivergence

• age

• religion or belief

• relationship style or family structure

• socioeconomic background

My practice is guided by the BACP Ethical Framework, ongoing CPD, and a commitment to challenging discrimination and inequality.

Processor Agreements

Microsoft Outlook (Email)

Microsoft acts as a data processor, providing encrypted email services compliant with GDPR and the Microsoft Data Protection Addendum.

Microsoft OneDrive (Cloud Storage)

Microsoft acts as a data processor, providing encrypted cloud storage with secure access controls and multi‑factor authentication.

I remain the data controller.

Safeguarding Statement

I follow UK safeguarding legislation and the BACP Ethical Framework. I may share information if I become aware of:

• risk of harm to you or others

• child or vulnerable adult safeguarding concerns

• serious crime

• legal requirements

Where possible, I will discuss this with you first. I will share the minimum necessary information.

Complaints Procedure

If you have concerns about how your information is handled, please contact me at Rosanna.therapy@gmail.com. I aim to respond within 30 days.

If unresolved, you may contact:

• Information Commissioner’s Office (ICO) — data protection concerns

• British Association for Counselling and Psychotherapy (BACP) — ethical or professional concerns

You have the right to make a complaint at any time.

How to Raise Concerns

If you have concerns about our work together, you are welcome to raise them in session or by email: rosanna.therapy@gmail.com. I will respond thoughtfully and within a reasonable timeframe. If you feel unable to speak with me directly, or the issue remains unresolved, you may contact the BACP or ICO.

Updates to This Policy

This policy reflects the DPDI Act changes effective 19 June 2026. Future updates will be posted on this website.

​

​

​