Barbara Lorusso

Privacy Policy for Sole Trader Counselling Practice (UK GDPR & ICO‑Compliant)

 

1. Introduction

This Privacy Policy explains how I collect, use, store, and protect your personal information when you visit my website or engage in counselling with me. As a counselling practitioner, I handle particularly sensitive information and follow the UK GDPR, the Data Protection Act 2018, and guidance from the Information Commissioner’s Office (ICO).

I am committed to protecting your privacy, maintaining confidentiality, and ensuring your data is handled lawfully and respectfully.

2. Who I Am (Data Controller)

Business name: Barbara Lorusso Address: Nexus Business Centre,SN2 2PN Email: [Insert Barbaralorussopsychotherapy@gmail.com Phone: 07791830275

I am the Data Controller, meaning I determine how and why your personal data is processed.

3. The Personal Data I Collect

I may collect and process the following types of personal data:

• Enquiry information — name, email address, phone number, and details you provide when contacting me.

• Client information — personal history, therapy notes, and information shared during sessions.

• Special category data — mental health information, ethnicity, sexual orientation, or other sensitive details you choose to share.

• Technical data — IP address, browser type, and website usage data.

• Cookies — used to improve website functionality.

I only collect information that is necessary for providing counselling services or responding to enquiries.

4. Lawful Bases for Processing Your Data

I process your data under the following lawful bases:

• Contract — to provide counselling services you request.

• Consent — for collecting special category data and for optional communications.

• Legitimate interests — to respond to enquiries and manage my practice.

• Legal obligations — safeguarding, preventing serious harm, or complying with tax and accounting laws.

For counselling notes and sensitive information, I rely on explicit consent and the provision of health or social care condition under UK GDPR Article 9(2)(h).

5. How I Use Your Personal Data

I use your data to:

• Respond to enquiries

• Arrange and provide counselling sessions

• Maintain clinical records

• Ensure safety and safeguarding

• Manage payments and invoicing

• Improve my website and services

I do not use your data for automated decision‑making or profiling.

6. Confidentiality & When Information May Be Shared

Everything you share in counselling is confidential. I will not share your information unless:

• You give explicit consent

• I am required to do so by law

• There is a risk of serious harm to you or others

• I am required to share information for safeguarding purposes

• My professional body or insurer requires limited information for ethical or legal reasons

• I discuss work in clinical supervision, where your identity is protected

I do not sell or trade your data.

7. Third‑Party Data Processors

I may share limited data with trusted third parties who help me run my practice, such as:

• Website hosting providers

• Email service providers

• Payment processors

• Clinical supervisors (anonymised where possible)

• Accountants for financial compliance

All third parties are required to keep your data secure and process it only according to my instructions.

8. International Data Transfers

If any third‑party services store data outside the UK (e.g., email providers), I ensure appropriate safeguards are in place, such as:

• UK adequacy regulations

• Standard Contractual Clauses (SCCs)

9. Data Retention

I keep your personal data only for as long as necessary:

• Enquiry emails: 12 months

• Client records and session notes: 7 years (professional and insurance requirement)

• Financial records: 6 years (legal requirement)

• Website analytics data: up to 26 months

After these periods, data is securely deleted or destroyed.

10. Your Rights Under UK GDPR

You have the right to:

• Access your data

• Correct inaccurate data

• Request deletion

• Restrict processing

• Object to processing

• Data portability

• Withdraw consent at any time

To exercise your rights, contact me at [Insert email].

If you are unhappy with how I handle your data, you can complain to the Information Commissioner’s Office (ICO): https://www.ico.org.uk

11. Cookies & Website Tracking

My website may use cookies to:

• Improve functionality

• Analyse website traffic

• Enhance user experience

You can disable cookies through your browser settings.

12. Security Measures

I take data security seriously and use appropriate measures, including:

• Encrypted devices

• Password‑protected files

• Secure email practices

• Locked storage for paper notes

• Regular security reviews

13. Updates to This Privacy Policy

I may update this Privacy Policy from time to time. The latest version will always be available on this page.

14. Contact Me

If you have any questions about this Privacy Policy or how I handle your data, please contact: Email: Barbaralorussopsychotherapy@gmail.com Phone: 07791830275 Address: Nexus Business Centre, SN2 2PN