Privacy notice

This notice explains how Rutland Counselling Ltd collects and uses your personal data, whether you are a therapy client, a supervisee, a trauma consultancy client, a CPD delegate, or someone who contacts the practice or visits the website. It should be read alongside the cookie notice.

I am Sally Atkinson, a UKCP-registered psychotherapist and supervisor (registration no. 2011163790), and the data controller for Rutland Counselling Ltd. I am committed to protecting your privacy and to upholding confidentiality in line with the UKCP Code of Ethics, the UK GDPR and the Data Protection Act 2018.

The information I collect

• If you are a therapy client: your name and contact details, and the date and time of your appointments. I do not keep detailed notes on therapy clients beyond appointment records.
• If you are a supervisee or trauma consultancy client: your name and contact details, your professional role and registration, our contract and correspondence, and brief, non-evaluative process notes. Trauma consultancy is often a one-off session about a complex case, and is handled in the same way as supervision.
• If you are a CPD delegate: your name, contact and professional details, and your booking and payment records.
• If you contact me: your name, contact details, and anything you choose to tell me about why you are getting in touch.

Because much of this information concerns health and wellbeing, it is treated in law as 'special category' data, and I handle it with particular care.

Why I process your data, and my lawful basis

I use your data:

• to provide and manage your therapy, supervision, consultancy or CPD
• to communicate with you
• to keep appropriate professional and financial records
• and to meet my legal, ethical and safeguarding duties.

My lawful bases under the UK GDPR are contract, legal obligation, and legitimate interests. For health information, I rely on Article 9(2)(h) (provision of health care by a professional bound by confidentiality) and, where relevant, vital interests, the defence of legal claims, and safeguarding.

Marketing

If you have consented, or have purchased or enquired about my CPD or consultancy, I may email you occasional information about these services. Every email includes a way to unsubscribe, and I will stop as soon as you ask. I do not share your details with anyone else for marketing.

Working with overseas clients

I provide trauma consultancy to therapists based in the UK and overseas, including in the United States, over Zoom. Where I work with an overseas client, I generally hold only their contact details, and any case material is anonymised. My handling of your data is governed by UK data protection law.

When I act for a training organisation

When I tutor for Sherwood Psychotherapy Training Institute, or work under Yellow Frog Psychotherapy Training with Carolyn Spring Ltd, I handle student data on that organisation's behalf and under its instructions. For that data, the organisation is the data controller and its own privacy information applies; if you have a query about it, I will pass it to them.

Confidentiality and its limits

What you share with me is confidential. I may need to break confidentiality only where there is serious concern about harm to you or others, where a child or vulnerable adult may be at risk, where a court requires it, or, in anonymised form, within my own clinical supervision. Wherever it is safe and appropriate, I will talk to you first. These limits are also in your contract.

Who I share your data with

I share your data only where necessary:

• with my clinical supervisor (anonymised);
• the UKCP (anonymised, unless you complain, when your information is shared with your consent);
• my insurer (only if there is a claim);
• my accountant (financial records only);
• and social or emergency services where a safeguarding or serious-harm concern requires it.

I never sell your data.

Storing your data and keeping it safe

Paper records are kept in a locked cabinet in my Oakham office. Electronic records are held on encrypted, password-protected devices and in secure cloud storage, with two-factor authentication on my accounts. Online sessions take place over Zoom. I do not currently record sessions; if I ever do, it will be only with your explicit consent, stored securely and deleted in line with my retention periods.

Sending data outside the UK

Some services I use – email, calendar, cloud storage, video calls, and (for Yellow Frog) messaging and document tools – are run by companies based outside the UK. Where your data is transferred abroad, it is protected by safeguards approved under UK data protection law.

How long I keep your data

I keep therapy, supervision and consultancy records for 7 years after our work ends. If you were under 18 when we worked together, I keep your records until your 25th birthday. Marketing contacts are removed after 24 months of no engagement, enquiries after six months of no contact, and financial records after six years. After these periods, records are securely deleted or destroyed.

Your rights and complaints

You have the right to see the data I hold about you, to have inaccurate data corrected, to ask me to erase it (subject to my professional and legal duties), to object to or restrict how I use it, and to object to direct marketing at any time. To exercise any of these, please email me; I will respond within one month.

If you are unhappy with how I have handled your data, please tell me at hello@rutlandtherapycentre.com – I will acknowledge within 30 days and look into it promptly. You can also complain to the Information Commissioner's Office at any time (www.ico.org.uk), though I would appreciate the chance to put things right first.