Privacy notice

Last updated: 23 September 2026

This notice explains what personal information I hold about you, why I hold it, who I share it with, and your rights. Please read it alongside our counselling agreement. This privacy notice does not replace or limit the terms of our counselling agreement; both documents apply together. If anything about how I use your information seems to conflict between this notice and our counselling agreement, this privacy notice applies for data protection matters.

1. Who I am

Counselling Services Ltd (company number 12042385), trading as Barnsley Counselling Services, is the data controller for the information I hold about you. I, Tracy Simpson, am a director of the company and the point of contact for data protection matters. You can contact me at hello@barnsleycounselling.co.uk or 07903 274683. My practice is based at South Yorkshire Physiotherapy Centre, Day St, Barnsley S70 1NW. The company's registered office is Modern House, Summer Lane, Barnsley, England, S70 2NP. I'm a registered member of BACP (reference 45587). You can check my registration on the BACP register.

2. The information I hold

• Contact and booking details: your name, address, phone number, email, date of birth, and the name and number of your emergency contact and, where relevant, your GP.
• Counselling information: the reasons you have come to counselling, relevant history you share, and the brief notes I make. This is information about your health, which data protection law calls “special category data” and gives extra protection.
• Payment records: invoices and records of payments. I do not store card details.
• Referral information: where you are referred by another service, for example your GP or another professional, the information they pass to me.
• Enquiry details: if you contact me through my website or by email before we begin, the details you send.

You do not have to give me any of this by law, but without basic contact details and some information about what brings you to counselling I will not be able to offer you the service.

3. Why I use your information, and my lawful basis

Data protection law requires me to have a lawful basis for using your information. Because counselling information is health data, I also need an additional condition for that. My bases are:

• Arrange and provide your counselling: Article 6(1)(b), necessary for our agreement.
• Keep session notes and practice records, and deal with any complaint or claim: Article 6(1)(f), my legitimate interests in safe, accountable practice.
• Keep financial records: Article 6(1)(c), legal obligation (tax law).
• Act in an emergency where someone's life is at risk: Article 6(1)(d), vital interests.
• Protect a child or an adult at risk from abuse or neglect, or help prevent or detect a serious crime: Article 6(1)(ea), recognised legitimate interests (safeguarding a vulnerable person, or crime).
• Comply with a court or tribunal order, or another legal duty to disclose information: Article 6(1)(c), legal obligation.
• Reply to an enquiry you send before we begin: Article 6(1)(b), steps taken at your request before entering into an agreement, and/or Article 6(1)(f), my legitimate interest in responding to enquiries.
• Send you occasional updates about my practice: Article 6(1)(a), your consent, which you can withdraw at any time.

For the health information in your records I rely on Article 9(2)(h) (the provision of health care or treatment by a professional bound by a duty of confidentiality, with section 11(1) and Schedule 1 paragraph 2 of the Data Protection Act 2018). Where your information is needed for a complaint or legal claim, or a court or tribunal orders me to disclose it, I rely on Article 9(2)(f) (legal claims and courts).

If I have to share health information without your consent, the condition I rely on depends on the situation:

• in an emergency where someone's life is at risk and the person concerned cannot give consent (for example, because they are unconscious or lack capacity), Article 9(2)(c) (vital interests);
• to protect a child, or an adult at risk, from abuse or neglect, Article 9(2)(g) with Schedule 1 paragraph 18 of the Data Protection Act 2018 (safeguarding of children and of individuals at risk);
• to report terrorism to the police, or to help prevent or detect a serious crime, Article 9(2)(g) with Schedule 1 paragraph 10 of the Data Protection Act 2018 (preventing or detecting unlawful acts).

I do not make any decisions about you by automated means, and I do not profile you.

Consent is not the main lawful basis for keeping your core counselling records, so that they stay properly protected even if you later change your mind. I do ask for your explicit consent for specific additional things where it applies, for example sharing information with a referrer, recording a session, or using a third-party service beyond the minimal set I need in order to work with you. You can withdraw that consent at any time, without it affecting your counselling.

If and when I use AI tools (for example, for note drafting, transcription, or administrative text), I do not upload identifiable personal data into them. I do not use AI to make decisions about clients. Any use is for administrative or note-drafting support only, with human oversight, and I do not allow these tools to use your information to train their models. I will update this notice if my use of AI tools changes.

4. Who I share your information with

I will never sell your information, and I keep sharing to the minimum. The people and organisations within this “circle of confidentiality” are:

• My clinical supervisor. Good practice, and my professional body, require me to discuss my work in regular supervision. I do not normally use your full name, but some detail may still identify you, so I treat this as a disclosure. My supervisor is an experienced practitioner bound by the same duty of confidentiality.
• My professional executor. If I am suddenly unable to continue working because of serious illness, incapacity, or death, a trusted colleague — a qualified practitioner bound by professional confidentiality — will contact you to let you know and to help you find ongoing support. They will access and use only the minimum information necessary for that purpose.
• Trusted service providers. Google Workspace, Zoom, Acuity Scheduling (for example my email, video-call, booking and notes software) process some information for me under contracts that require them to keep it secure and use it only on my instructions.
• Your GP or the emergency services, if I reasonably believe there is a serious risk to your life or safety, or to someone else's. Wherever it is safe to do so, I will talk to you first.
• Children's or adult social care services, or the police, if I believe a child, or an adult at risk, is suffering or is likely to suffer abuse or neglect. This is part of my professional duty. Wherever it is safe to do so, I will talk to you first.
• Courts, the police or other authorities, where the law requires it. For example, an order of a court or tribunal, or information about terrorism, including terrorist financing, that the Terrorism Act 2000 requires me to report to the police. I share only what the law requires.
• My insurer and legal advisers, if needed to deal with a complaint or claim, limited to what is necessary and treated in confidence.
• The organisation that referred you (for example an employer or Employee Assistance Programme). Where an organisation such as this arranges your counselling, I share attendance information only, not the content of our sessions. That organisation is a separate data controller with its own privacy notice, which you should also read.

Most of the service providers I use store data within the UK. Some providers may store or access data outside the UK, for example in the EEA or the US: for instance video-calling services such as Zoom or Microsoft Teams. Where any provider transfers personal data outside the UK, the transfer is protected by safeguards recognised under UK law, such as the UK Addendum to the standard contractual clauses or a UK adequacy decision.

5. How long I keep your information

• Counselling records: kept for 7 years after our work ends, which allows for the time limits on making a complaint or claim, then securely destroyed.
• If you are under 18 at the time counselling ends, I keep your records until you are 25, or 26 if you were 17 when counselling ended, following NHS practice. This is in line with recommended practice for child and adolescent records, and longer retention is to safeguard the child's interests.
• Financial records: 6 years, as tax law requires.
• Enquiries that do not lead to counselling: deleted after 6 months.

6. How I keep your information safe

Paper records are kept locked away. Electronic records are held on password-protected, encrypted devices and accounts with two-factor authentication where available, and backed up securely. I keep your session notes separate from your contact details and identify them by initials or a client code rather than your full name. I control who can access your records, and only I use them routinely, except where sharing is described in this notice.

If a data breach happens that is likely to put your rights or freedoms at risk, I will assess it promptly and, where required, report it to the ICO and inform you without undue delay.

7. Your rights

You have the right to ask to see the information I hold about you (a subject access request), to have inaccurate information corrected, to ask me to delete it, and to restrict or object to how I use it. You can also ask for a copy of information you gave me that I process electronically under our agreement. You can withdraw your consent to marketing at any time, without it affecting your counselling.

Your right to object. Where I rely on legitimate interests or recognised legitimate interests (see section 3), you can object to my using your information on grounds relating to your situation. I will then stop, unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or I need the information to establish, exercise or defend a legal claim.

To use any of these rights, contact me at hello@barnsleycounselling.co.uk. I will respond within one month and will not charge you. Please note that my notes sometimes contain information about other people, or information whose release could cause serious harm. In the first case I may need to redact part of a record; in the second, before relying on the serious-harm exemption to withhold information, I will seek the opinion of a suitably qualified health professional. These rights are not affected by anything in our counselling agreement.

8. Marketing

If you have asked to receive occasional updates about my practice, I keep your details on a separate marketing list, held only with your consent. I will not use the contact details you give me for counselling to send you marketing. You can unsubscribe at any time using the link in any message, or by emailing me.

9. Website and cookies

My website at barnsleycounselling.co.uk is served over a secure, encrypted (HTTPS/TLS) connection, which protects information while it is in transit. The site uses only essential cookies needed for it to work. For analytics I use a privacy-first, cookieless tool that sets no cookies, stores nothing on your device, and collects no personal data or IP addresses. Even so, please keep sensitive details out of your first email or message; we can talk about them properly once we begin. The site is hosted by Vercel, who process this information for me.

10. Complaints

If you are unhappy with how I handle your information, please tell me first, by email to hello@barnsleycounselling.co.uk, by phone or in writing. I will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Changes to this notice

I review this notice at least once a year and whenever my practice changes. The date at the top shows when it was last updated. If I make significant changes, I will tell current clients directly.