Data Privacy Policy [GDPR]

Chrisalis Counselling is committed to complying with the terms of the UK General Data Protection Regulation (UK-GDPR) and to the responsible and secure use of your data.  Chrisalis Counselling has a legitimate interest in processing personal data to provide counselling services.   The purpose of this statement is to let you know what personal information Chrisalis Counselling collects and holds, why this data is collected, how long it is stored for, how it is destroyed and your rights.

Contact details

Name: Chrissy Peel

Mob: 07387 955499

Email: info@chrisaliscounselling.com

Role: Data controller - i.e. the counsellor / therapist - responsible for ensuring that personal data is processed in a way that is lawful, fair and transparent.

ICO Reference #: ZB136943

Lawful Basis and Data Protection Rights

Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful basis in the UK GDPR. You can find out more about lawful basis on the ICO’s website.

Which lawful basis I rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, I must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact me using the contact details tab or via email.

Overview of Schedule 1 Data Protection Act

Overview of Schedule 1 of the Data Protection Act 2018 (DPA 2018) provides specific conditions under which personal data can be processed. This schedule is crucial for organizations to ensure compliance with the UK GDPR. Here are some key points:

  1. Conditions for Processing: The schedule includes various conditions that must be met for lawful processing of personal data. For example, processing may be necessary for compliance with legal obligations, for the performance of a contract, or for the protection of vital interests of individuals.

  2. Employment and Social Protection: One of the primary conditions relates to processing necessary for employment, social security, or social protection purposes. Organizations must have appropriate policy documents in place when processing data in these contexts Legislation.gov.uk.

  3. Health and Social Care: Another condition allows for processing personal data when it is necessary for health or social care purposes. This is particularly relevant for organizations involved in healthcare services Legislation.gov.uk.

Lawful basis for the collection and use of your data

Under UK GDPR Article 9, my lawful basis for collecting or using personal information to provide health care services are:

  • Contract: I have to collect or use the information so I can enter into or carry out a contract [Working Agreement] with you. All of your data protection rights may apply except the right to object.

  • Recognized legitimate interest: My pre-approved purpose for collecting or using personal information to provide client care or services. I need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect [the ‘safeguarding condition’].

  • Vital interests: Collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. All or your data protection rights may apply, except the right to object and the right to portability.

Where I get personal information from

  • Directly from you.

  • Charities or voluntary sector organizations that may outsource support to local counsellors / therapists.

Others I may share personal and sensitive information with

  • Other health providers [eg GP Surgery, local Mental Health Support Team].

  • Organisations I may need to share information with for safeguarding reasons.

  • Emergency services.

Duty of Confidentiality

I am subject to a common law duty of confidentiality. However there are circumstances where I will share relevant health and care information. These are where:

  • you’ve provided me with your consent [I have taken it as implied to provide you with care,] or you have given it explicitly for other uses;

  • I have a legal requirement [including court orders] to collect, share or use the data;

  • on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality [for example sharing information with the police to support the detection or prevention of serious crime];

  • if in England or Wales - the requirement of The Health Service [Control of Patient Information] Regulations 2002 are satisfied; or

  • if in Scotland - we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.

Cookies

Please see my separate policy on Cookies.

Personal Data - What information I take

1.       Storing and taking note of your general personal data and any sensitive personal information, is for the purpose of being able to provide you with a safe, professional and ethical service only. 

2. Your email and / or contact telephone information will be obtained from you when you initially contact us, in order for me to respond to your request. This initial contact could be through a third party such as Counselling Directory, BACP Website - these platforms have their own Data Privacy Policies, or via my own website which is on the Squarespace platform, who have their own Data Privacy Policy, which details how your information is used. Please do read these Data Privacy policies if you have concerns about how your information may be used by them.

3. Personal information will be requested at our initial Assessment Session including:

Full / preferred name; Address; Date of birth; Gender; Preferred pronoun; Ethnicity; Relevant spiritual / Religious beliefs;    Emergency contact details; Relevant physical medical conditions / psychological conditions, medications and allergies;   GP details; Other information that is relevant solely to my being able to provide you with a safe, professional and ethical service.

4.       I will not share your details with any other person or organization without your knowledge and permission unless there is a legal requirement to do so or in line with my Confidentiality Policy / Clinical Will policy. Your data will only be used to provide you with the relevant information relating to the counselling services I offer. 

5.       You can request to view / update any personal information that I hold about you at any time.

Note Taking

1.       You understand that I will write brief minimal notes, which are for my benefit as an aide memoir and in line with any BACP and Insurance requirements, and that I will retain these notes after you end therapy for the required time in accordance with my insurance guidelines. 

2.       Notes are written and stored securely in a BACP approved client management system [a password protected excel spreadsheet], identified by an id number, which is retained separately from your personal identifiable information, in accordance with the requirements of UK-GDPR guidelines. 

3.       You are welcome to view the notes at any reasonable time. You have the right to access and receive a copy of your own personal data and any other supplementary information that I hold about you. Any requests for information will be actioned as soon as possible and at the latest within one month of receiving the request, as per UK-GDPR guidelines.

4.       I would be required to release your notes if requested by a judge through a court order / subpoena, however I would let you know about this, if it was requested.

Records Retention - How / where I store your information

1.       Laptop / Mobile Phone: Information stored on my laptop is password/pin/face recognition protected, accessed by myself only.  Your name and telephone number are also stored electronically in a password / thumbprint protected standard mobile phone used for business purposes only, so that I can contact you regarding my counselling services / availability.  I am the only one with access to both the laptop and mobile phone [notwithstanding my Clinical Will Executor].

2. Business Account: Your name will be referenced in my password / thumbprint protected mobile [android] phone App for my business bank account for professional purposes, in order for me to check that session fees have been paid. The bank will also have it’s own data privacy policy, which you can check when you receive the bank account details.

3.       Hardcopy information: All client personal data hardcopies are stored in a lockable filing cabinet, that only I have access to [notwithstanding my Clinical Will Executor].

How long will I keep your information

1.      Once we have ended our counselling sessions, all of your data will be stored securely for 5 years [or 7 years if EFT Tapping is used], as required by my insurance company.

What happens when I no longer need to keep your information

1. Once this retention period has expired, any information I hold on you will then be destroyed and deleted from my laptop emails and mobile phone. This includes any information held on a back up hard-drive.

2.   Any hardcopy information relating to you will be shredded.

Complaints Procedure - How to Complain

I am registered with the Information Commissioner's Office (ICO).   If you have any concerns about my use of your personal information, please contact me directly at info@chrisaliscounselling.com or by using the guidance on ‘How to Complain’ on my website page.

I will do my utmost to resolve any concerns you have, however, if for any reason I cannot resolve the issues, you may of course choose to contact the ICO directly. If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO.

  • ICO address: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL.

  • Helpline #: 0303 123 1113

  • Website: https://www.ico.org.uk/make-a-complaint

With effect from Jun 2026, the responsibility is for me to try and resolve your issue first and a complaint process must be in place.

Communication Encryption

1.       The methods of communication I use in order to provide you with an effective service are via mobile phone, email or text message, which may not be encrypted.

2. Zoom: for online clients sessions, I use Zoom platform.  I disable any AI related functions, communications or options, and I do not activate ‘automatic note-taking’.    I also enable End to End Encryption on Zoom for additional security.   

I do not use WhatsApp for client purposes.

3.        Mobile Phones: Please be aware that if your mobile phone is switched on and in the room for our sessions, there is the possibility that information could be picked up by the device or ‘listened’ in on.  If this is of concern, please put you phone in Airplane Mode whilst you are in the session or do not bring it into the session.

4.       Whilst I endeavour to keep my systems and communication devices protected against viruses and other harmful effects, I cannot guarantee or be responsible for, all communications being virus-free.

Consent to share information

If agreed with you, I may contact other professionals where provision of additional support is necessary in order to offer you what you need or to keep you safe.

Clinical Will Policy

1.       In the event of my being incapacitated or upon death and in accordance with BACP requirements, your data will be handled as detailed in my Clinical Will Policy, by a named qualified counsellor colleague, who is my Clinical Will Executor and also bound by confidentiality.

2. The Clinical Will Executor would contact you and advise you of any such event. They will use your contact details with the strictest confidence and handle the information as per current GDPR guidelines.  

Confidentiality Policy

A separate Confidentiality Policy is available which outlines confidentiality and the limits of confidentiality regarding sharing of information, including legal limitations, safeguarding and supervision.

Use of AI [Artificial Intelligence]

I do not use AI such as Chat GTP in my practice for client work. However if I did find this necessary, I will tell you about it and obtain consent from you first.

Explicit Client Understanding and Informed Consent

1.       You have access to this Data Privacy Policy online [which will be the most current version] and I will offer you a copy at your first [assessment] session.

2. We will both read through my Working Agreement [contract], Confidentiality Policy, and GDPR Data Privacy Policy, and both of us will sign and date each document during the initial Assessment Session.

3. Under Article 9 as detailed above, explicit ‘opt in’ consent is not required.

Changes to this privacy policy

I may update this privacy policy from time to time in order to reflect, for example, changes to my practice, for clarification, or for other operational, legal or regulatory reasons.

Last update: Nov 2026

© Chrisalis Counselling 2021 - 2026

Contact Me