Privacy Notice

Last updated: July 2026

I am Caro Southcombe, a private counsellor and registered member of the British Association for Counselling and Psychotherapy (BACP). I am registered with the Information Commissioner's Office (ICO). For data protection purposes, I am the data controller for the personal information I collect and use in connection with my counselling practice. This notice explains what information I collect, why I use it, how it is stored and shared, how long I keep it, and your rights in relation to it.

What information I collect
When you make an enquiry or become a client, I may collect and store:
• your name
• your email address and telephone number
• your home address
• your GP's contact details
• emergency contact details
• information you provide when making an enquiry
• brief counselling session notes
• appointment and attendance information
• relevant correspondence between us
• a record of your agreement to my counselling and privacy arrangements

Because of the nature of counselling, some of the information you choose to share with me may be sensitive and personal. This may include information about your physical or mental health, relationships, family circumstances or other aspects of your life.I only collect information that is reasonably necessary to provide counselling safely and professionally and to manage my practice.

Why I use your information
I use your personal information to:
• respond to enquiries
• provide and manage counselling services
• communicate with you and manage appointments
• maintain appropriate professional records
• provide counselling safely and responsibly
• meet my professional, ethical, legal and insurance responsibilities
• respond appropriately to serious safeguarding or safety concerns

My lawful basis for using your information
Under UK data protection law, I need a lawful basis for processing your personal information. I generally rely on legitimate interests under Article 6(1)(f) of the UK GDPR where processing is necessary for the safe, confidential and professionally accountable provision and management of my counselling practice. Where processing is necessary to take steps at your request before entering into a counselling agreement, or to provide counselling under our agreement, I may also rely on contract under Article 6(1)(b).

Counselling involves information that may be classed as special category data under data protection law, particularly information concerning physical or mental health. Where I process this information for the provision of counselling, I rely on Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, which provide for the processing of special category information where necessary for health or social care purposes, subject to the applicable duty of confidentiality. In exceptional circumstances, a different lawful basis or special category condition may apply, for example where processing is necessary to protect someone's vital interests or for the establishment, exercise or defence of legal claims.

Information you need to provide
I need some basic personal and contact information in order to arrange and provide counselling safely and to manage our counselling agreement. If you choose not to provide information that is necessary for these purposes, I may be unable to provide counselling to you. You do not need to provide more personal information than is necessary. In particular, the section of my website enquiry form asking for your reason for seeking counselling is optional and may be left blank.

How I store and communicate your information
I use a limited number of digital services to manage my counselling practice and communicate with clients.
Kiku – I use Kiku as my practice management system. It is used to store information including client contact details, home address, GP and emergency contact details, brief counselling notes and relevant administrative records.
Gmail – I use Gmail for email communication, primarily concerning enquiries, appointments and other practical matters. I do not send detailed therapeutic information by email. However, if you choose to send personal or sensitive information to me by email, that information will form part of our email correspondence.
Zoom – I use Zoom for online counselling sessions. Counselling sessions are never recorded.
Telephone and text messages – I use telephone calls and text messages where appropriate for enquiries, appointments and other practical communication. I avoid sending sensitive therapeutic information by text. I take reasonable measures to protect the confidentiality and security of personal information and limit the information held on each system to what is necessary for its purpose.

My website and contact form
My website is hosted by Squarespace. When you visit my website, Squarespace may process technical information necessary to provide, operate and secure the website and may use cookies or similar technologies. If you contact me using the website contact form, I use the information you provide to respond to your enquiry. This may include your contact details and, if you choose to provide it, information about your reason for seeking counselling. You do not have to provide a reason for seeking counselling when making an enquiry and this part of the form may be left blank. Information submitted through the contact form is processed through Squarespace and may also be received and stored in my email account.

Confidentiality and sharing your information
What you discuss with me in counselling is confidential. I will not normally disclose information about you to another person or organisation without your knowledge or agreement. As part of good professional practice, I discuss my counselling work in regular clinical supervision. I take care to protect clients' identities and avoid using identifying information unnecessarily. There may be exceptional circumstances in which I need to disclose information without your consent. These may include situations involving a serious risk of harm to you or another person, safeguarding concerns, or circumstances in which disclosure is required by law. Wherever possible and appropriate, I would discuss this with you before making a disclosure. I also use service providers including Kiku, Google, Zoom and Squarespace to help me operate my practice. These providers may process personal information in providing their services to me.

International data transfers
Some of the digital service providers I use operate internationally. This means that personal information may in some circumstances be processed or stored outside the UK. Where personal information is transferred outside the UK, I require that the transfer is covered by an appropriate mechanism under UK data protection law, such as UK adequacy regulations or appropriate safeguards. You can contact me at carosouthcombe@gmail.com if you would like further information about the safeguards relevant to your personal information.

How long I keep your information
I normally keep client records for seven years after our counselling work ends. This enables me to meet my professional, legal and insurance responsibilities. After the relevant retention period, records are securely deleted or destroyed. Some administrative information may need to be kept for a different period where there is a legal, regulatory, insurance or accounting reason for doing so. I periodically review the information I hold and do not keep personal information for longer than is reasonably necessary.

Your data protection rights
Depending on the circumstances and the lawful basis on which your information is processed, you may have the right to:
• request access to the personal information I hold about you
• ask me to correct inaccurate or incomplete information
• request deletion of your information
• request restriction of processing
• object to certain processing
• receive certain information in a portable format where the right to data portability applies

These rights are not all absolute and exemptions may apply in particular circumstances. Where I rely on legitimate interests to process your information, you have the right to object to that processing. If you object, I will consider your particular circumstances and whether there are compelling legitimate grounds for the processing to continue. To exercise any of your data protection rights, please contact me at carosouthcombe@gmail.com.

Automated decision-making
I do not use your personal information to make decisions about you solely by automated means and I do not use automated profiling.

Concerns or complaints about your personal information
If you have questions or concerns about how I collect, use, store or share your personal information, or if you would like to make a data protection complaint, please contact me at:carosouthcombe@gmail.com
I will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome to you without undue delay. You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Information about data protection rights and making a complaint is available from the ICO at www.ico.org.uk.

Changes to this privacy notice
I may update this privacy notice if my practice, the services I use or data protection requirements change. The date at the top of this notice shows when it was last updated.