Privacy Policy

At Counselling with Madison, I understand that the information you share with me is personal and often sensitive. I am committed to respecting your privacy, protecting your confidentiality and handling your personal information securely.

This privacy notice explains how I collect, use, store, share and protect your personal information when you contact me, enquire about counselling, access counselling sessions or communicate with me after counselling has ended.

I process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and other relevant legislation. I also work in accordance with the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.

Data controller: Madison Byrne, as Counselling with Madison
Email: counsellingwithmadison@gmail.com
Website: https://counsellingwithmadison.com

As the data controller, I am responsible for deciding how and why your personal information is processed.

2. What personal information do I collect?

Depending on your contact with me and the counselling service you access, I may collect:

Identity information: your name and date of birth.
Contact information: your email address, telephone number and address, where required.
Emergency and support information: details of an emergency contact and, where appropriate, your GP.
Counselling information: information you share about your circumstances, experiences, emotional wellbeing and reasons for seeking counselling.
Session records: brief professional notes relating to our work together, including relevant assessments, agreed actions and safeguarding considerations where necessary.
Administrative and financial information: appointment records, payment information, invoices and relevant correspondence.
Website information: technical information and cookie or analytics data, where applicable, depending on your consent and website settings.

Some of this information may be special category personal data under data protection legislation, particularly information concerning your physical or mental health.

I aim to collect only information that is relevant and necessary to provide a safe, appropriate and professional counselling service.

3. Why do I use your personal information?

I use your personal information for the following purposes:

Responding to enquiries and arranging initial calls.
Assessing whether counselling is appropriate for your needs.
Arranging, confirming, cancelling and rearranging appointments.
Providing counselling and maintaining appropriate professional records.
Supporting safe practice, including responding to safeguarding concerns where necessary.
Managing payments, invoices and accounting obligations.
Communicating with you about your appointments and our agreed work.
Meeting applicable legal, regulatory and professional obligations.
Maintaining the security and effective operation of my website.

I will not sell your personal information or share your contact details with third parties for their own marketing purposes.

4. My lawful basis for processing your information

Data protection legislation requires me to have a lawful basis for processing personal information. The appropriate basis depends on the information involved and the purpose for which it is used.

Depending on the circumstances, I may rely on the following lawful bases:

Contract: where processing is necessary to take steps at your request before entering into a counselling agreement or to fulfil my agreement with you.
Legitimate interests: where processing is necessary for legitimate interests connected with running my counselling practice, maintaining appropriate records or managing administrative matters, provided your rights do not override those interests.
Legal obligation: where I need to process or retain information to comply with a legal requirement, such as applicable tax and accounting obligations.
Vital interests: where necessary to protect someone's life in an emergency.

Health information and other special category personal data require an additional condition under data protection legislation. Depending on the circumstances, I may rely on the provision of health or social care under Article 9(2)(h) UK GDPR, together with the applicable requirements of the Data Protection Act 2018, including the relevant conditions for processing and professional confidentiality.

Where processing relies on consent, I will explain what you are being asked to consent to and how you can withdraw that consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and it does not automatically require me to delete information that I am legally or ethically required to retain.

The lawful basis and special category condition will be considered for each relevant processing activity. I will not assume that one lawful basis applies to every piece of information I hold.

5. When you first contact me

When you contact me to enquire about counselling or arrange a free initial call, I may collect your name, email address, telephone number and any information you choose to include in your message.

I use this information to respond to your enquiry, discuss the service and arrange an appointment where appropriate.

If you decide not to proceed with counselling, I will delete or securely dispose of your enquiry information within one month, unless I have a lawful reason to retain some information for longer. If you ask me to delete your information sooner, I will consider your request in accordance with my legal obligations.

If another person or organisation contacts me on your behalf, I will handle the information provided appropriately and take reasonable steps to ensure that any further contact or processing is lawful.

Please avoid including unnecessary sensitive personal information in an initial website enquiry.

6. While you are accessing counselling

If you proceed with counselling, I may ask you to complete an initial information form containing details such as your name, date of birth, contact information, address and GP details where relevant to the service and our agreed arrangements.

I will explain why this information is requested and keep it to what is necessary for the service I provide.

I may use your email address or telephone number to confirm appointments, notify you of changes and communicate about our agreed counselling arrangements. I will use these contact details for other purposes only where appropriate and lawful.

I keep brief, relevant session notes to support continuity of care, reflect on our work and maintain appropriate professional records. I aim to keep these notes factual, proportionate and limited to information that is relevant to the counselling process.

Your identifying information is stored separately from your session notes where practicable, with access restricted to me. Even when identifying details are removed, session notes may still constitute personal data if you could be identified from their contents or through a reference number.

Confidentiality and its limits

Confidentiality is central to our counselling relationship. Information you share during sessions will be treated confidentially, and I will take reasonable steps to protect it from unauthorised access or disclosure.

There are circumstances in which I may need to share information without your consent. These may include:

Where I have a legal obligation to disclose information or a court order or other lawful requirement applies.
Where disclosure is necessary and legally justified to protect you or another person from a serious risk of harm.
Where safeguarding concerns arise, including concerns involving a child or an adult at risk, and sharing information is necessary and lawful.
Where another legal basis or recognised ethical justification permits or requires disclosure.

I will consider each situation individually, taking account of the circumstances, applicable law, professional guidance and the need to share only information that is relevant and necessary.

Where appropriate and safe to do so, I will discuss the proposed disclosure with you beforehand. There may be circumstances in which I cannot do this, for example, where doing so could increase risk or compromise a lawful safeguarding response.

Professional supervision

As part of my professional responsibilities, I attend regular supervision with a suitably qualified supervisor. I may discuss aspects of our work in supervision to reflect on the counselling process, maintain good practice and consider any ethical or safeguarding concerns.

I will use anonymised information wherever practicable. If identifiable information needs to be shared, I will consider confidentiality, the lawful basis for sharing and any relevant consent or other justification. My supervisor is expected to respect professional confidentiality and applicable data protection requirements.

7. If another person or organisation pays for or arranges counselling

If your counselling is funded, arranged or paid for by an employer or another organisation, I will explain what information may be shared with that organisation before sharing it.

Where appropriate and agreed, this may include attendance information or information required for invoicing and payment. I will not routinely share the content of your sessions or your session notes with the paying organisation.

Any disclosure of further information will require an appropriate lawful basis and will be handled in accordance with our confidentiality agreement and applicable legal and professional obligations.

8. How long do I keep your information?

I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of legal requirements, professional responsibilities, the nature of the information and the circumstances of the counselling relationship.

My intended retention periods are:

Enquiries where counselling does not proceed: normally deleted within one month, unless there is a lawful reason to retain them longer.
Session notes and associated client records: normally retained for seven years after counselling ends, subject to review of the justification for this period and any applicable legal or professional requirements.
Identifying information and client reference records: retained only for as long as necessary to manage the records they relate to and meet applicable requirements. Where a reference number is needed to identify retained session notes, the corresponding information may be retained for the same justified period.
Financial and accounting records: retained for the period required by applicable tax and accounting legislation.
Routine correspondence: deleted when no longer needed, subject to any relevant legal, professional or record-keeping requirements.

The seven-year period is my intended retention policy for relevant counselling records, not a universal period prescribed by UK GDPR. I will periodically review whether records still need to be retained. When information is no longer required, I will securely delete it, destroy it or anonymise it where appropriate.

Requests for erasure will be considered individually. There may be circumstances in which I need to retain certain information despite a deletion request.

9. Who may receive your information?

I do not sell your information or share it with third parties for their own marketing purposes.

Where necessary for providing counselling or running my practice, information may be processed by:

My professional supervisor, as described above.
Email, cloud storage and IT service providers, where these services are used to communicate with you or securely store records.
Website and form service providers, where applicable.
Payment providers and accounting services, where necessary to process payments or maintain financial records.
Professional advisers, regulators or public authorities, where disclosure is necessary and lawful.
Healthcare professionals or safeguarding services, where sharing is necessary, appropriate and legally justified.

I take reasonable steps to use reputable providers and protect personal information. Some service providers may process information outside the UK. Where this occurs, I will ensure that the applicable data protection requirements for international transfers are met.

I will not disclose your personal information to another recipient without an appropriate lawful basis.

10. How I protect your information

I take reasonable and appropriate technical and organisational measures to protect the information I hold against loss, misuse, unauthorised access, alteration or disclosure.

These measures include restricting access to client records, using password-protected devices and accounts, and storing electronic records in secure locations with access limited to authorised individuals.

I aim to keep identifying information separate from session notes where practicable and to dispose of information securely when it is no longer required.

Email and other electronic communications carry some risk. Although I take reasonable steps to protect communications, I cannot guarantee that information transmitted electronically is entirely risk-free. Please contact me if you would like to discuss a communication method that is more suitable for your circumstances.

11. Your data protection rights

Under data protection legislation, you may have the right to:

Access the personal information I hold about you.
Rectification of inaccurate or incomplete information.
Erasure of personal information in certain circumstances.
Restriction of processing in certain circumstances.
Object to processing based on legitimate interests in certain circumstances.
Data portability, where the relevant legal conditions apply.
Withdraw consent, where processing is based on consent.
Complain to the Information Commissioner's Office (ICO).

These rights are subject to certain legal conditions and exemptions. For example, I may need to retain some information to meet legal obligations or protect relevant legal interests. If I cannot fulfil a request in full, I will explain the reasons where the law requires me to do so.

To exercise your rights or ask a question about your personal information, please email counsellingwithmadison@gmail.com. I may need to verify your identity before responding.

You can find further information about your rights at the ICO's Your Data Matters guidance.

12. Website visitors, cookies and analytics

My website is hosted on Squarespace. The website may use essential cookies and similar technologies to support its operation and security. Depending on the settings and services enabled, it may also use analytics, embedded maps, external content or other third-party technologies.

These services may collect technical information, such as information about your device, browser, website usage and online identifiers.

Non-essential cookies and similar technologies will be managed in accordance with applicable legal requirements. Where consent is required, I will seek it before placing or accessing those technologies. You can manage your preferences using the website's cookie settings, where available.

Third-party services, such as Google Maps or analytics providers, may process information in accordance with their own privacy notices. I do not control all of their processing activities.

If you contact me using a website form, the information you submit may be transmitted to me by email or processed by the relevant form or website service provider, depending on the configuration of the website. I will handle that information in accordance with this notice.

For further details about cookies and the technologies actually used on my website, please consult the website's cookie information and settings.

13. Complaints and concerns

If you have concerns about how I handle your personal information, please contact me first at counsellingwithmadison@gmail.com so I can try to address them.

You also have the right to raise a concern or make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

You can find further information at ico.org.uk/make-a-complaint.

14. Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in legislation, professional guidance, the services I provide or the way I handle personal information.

The latest version will be available on my website. Where a change materially affects how I use your information, I will take appropriate steps to bring it to your attention.

Last updated: 13/10/26