Privacy notice

Last updated: 19 July 2026

This notice explains what personal information I hold about you, why I hold it, who I share it with, and your rights. Please read it alongside our counselling agreement. This privacy notice does not replace or limit the terms of our counselling agreement; both documents apply together. If anything about how I use your information seems to conflict between this notice and our counselling agreement, this privacy notice applies for data protection matters.

1. Who I am

Counselling Services Ltd (company number 12042385), trading as Barnsley Counselling Services, is the data controller for the information I hold about you. I, Tracy Simpson, am the director and point of contact for data protection matters. You can contact me at hello@barnsleycounselling.co.uk or 07903 274683. My practice is based at South Yorkshire Physiotherapy Centre, Day St, Barnsley S70 1NW. My registered office is Modern House, Summer Lane, Barnsley, England, S70 2NP. I am registered with the Information Commissioner's Office (ICO), registration number ZA399663. I am a registered member of BACP (reference 45587). You can check my registration on the BACP register.

2. The information I hold

• Contact and booking details: your name, address, phone number, email, date of birth, and the name and number of your emergency contact and, where relevant, your GP.
• Counselling information: the reasons you have come to counselling, relevant history you share, and the brief notes I make. This is information about your health, which data protection law calls “special category data” and gives extra protection.
• Payment records: invoices and records of payments. I do not store card details.
• Referral information: where you are referred by another service, for example your GP or another professional, the information they pass to me.
• Enquiry details: if you contact me through my website or by email before we begin, the details you send.

You do not have to give me any of this by law, but without basic contact details and some information about what brings you to counselling I will not be able to offer you the service.

3. Why I use your information, and my lawful basis

Data protection law requires me to have a lawful basis for using your information. Because counselling information is health data, I also need an additional condition for that. My bases are:

• Arrange and provide your counselling — Article 6(1)(b): necessary for our agreement.
• Keep session notes and practice records, and deal with any complaint or claim — Article 6(1)(f): my legitimate interests in safe, accountable practice.
• Keep financial records — Article 6(1)(c): legal obligation (tax law).
• Act in an emergency where there is a serious risk to life or safety — Article 6(1)(d): vital interests (with Article 9(2)(c) for health information).
• Reply to an enquiry you send before we begin — Article 6(1)(b): steps taken at your request before entering into an agreement, and/or Article 6(1)(f): my legitimate interest in responding to enquiries.
• Send you occasional updates about my practice — Article 6(1)(a): your consent, which you can withdraw at any time.

For the health information within your records I rely on Article 9(2)(h) (the provision of health care or treatment by a professional bound by a duty of confidentiality, with Schedule 1 paragraph 2 of the Data Protection Act 2018). Where your information is needed in connection with a complaint or legal claim I rely on Article 9(2)(f) (legal claims), and where there is an emergency risk to life I rely on Article 9(2)(c) (vital interests). Where the law requires me to disclose information, for example under a court order, or under safeguarding, anti-terrorism or anti-money-laundering law, my lawful basis is Article 6(1)(c) (legal obligation). For any health information within an emergency or statutory disclosure I rely on Article 9(2)(c) (vital interests), where there is a risk to someone's life or safety. I do not make any decisions about you by automated means, and I do not profile you.

Consent is not the main lawful basis for keeping your core counselling records, so that they stay properly protected even if you later change your mind. I do ask for your explicit consent for specific additional things where it applies, for example sharing information with a referrer, recording a session, or using a third-party service beyond the minimal set I need in order to work with you. You can withdraw that consent at any time, without it affecting your counselling.

If and when I use AI tools (for example, for note drafting, transcription, or administrative text), I do not upload identifiable personal data into them. I do not use AI to make decisions about clients. Any use is for administrative or note-drafting support only, with human oversight, and I do not allow these tools to use your information to train their models. I will update this notice if my use of AI tools changes.

4. Who I share your information with

I will never sell your information, and I keep sharing to the minimum. The people and organisations within this “circle of confidentiality” are:

• My clinical supervisor. Good practice, and my professional body, require me to discuss my work in regular supervision. I do not normally use your full name, but some detail may still identify you, so I treat this as a disclosure. My supervisor is an experienced practitioner bound by the same duty of confidentiality.
• My professional executor. If I am suddenly unable to continue working because of serious illness, incapacity, or death, a trusted colleague — a qualified practitioner bound by professional confidentiality — will contact you to let you know and to help you find ongoing support. They will access and use only the minimum information necessary for that purpose.
• Trusted service providers. Google Workspace, Zoom, Acuity Scheduling (for example my email, video-call, booking and notes software) process some information for me under contracts that require them to keep it secure and use it only on my instructions.
• Your GP or the emergency services, if I reasonably believe there is a serious risk to your life or safety or to someone else. Wherever it is safe to do so I will talk to you first.
• Authorities, courts or safeguarding services, where the law requires it. This means a court order; information connected to terrorism; information connected to drug trafficking or money laundering; and concerns that a child or an adult at risk may be suffering abuse or neglect.
• My insurer and legal advisers, if needed to deal with a complaint or claim, limited to what is necessary and treated in confidence.
• The organisation that referred you (for example an employer or Employee Assistance Programme). Where an organisation such as this arranges your counselling, I share only limited information such as attendance and a short summary or outcome scores, not the content of our sessions. That organisation is a separate data controller with its own privacy notice, which you should also read.

Most of the service providers I use store data within the UK. Some providers may store or access data outside the UK, for example in the EEA or the US: for instance video-calling services such as Zoom or Microsoft Teams. Where any provider transfers personal data outside the UK, the transfer is protected by safeguards recognised under UK law, such as the UK Addendum to the standard contractual clauses or a UK adequacy decision.

5. How long I keep your information

• Counselling records: kept for 7 years after our work ends, which allows for the time limits on making a complaint or claim, then securely destroyed.
• If you are under 18 at the time counselling ends, I keep your records until you are 25, or 26 if you were 17 when counselling ended, following NHS practice. This is in line with recommended practice for child and adolescent records, and longer retention is to safeguard the child's interests.
• Financial records: 6 years, as tax law requires.
• Enquiries that do not lead to counselling: deleted after 6 months.

6. How I keep your information safe

Paper records are kept locked away. Electronic records are held on password-protected, encrypted devices and accounts with two-factor authentication where available, and backed up securely. I keep your session notes separate from your contact details and identify them by initials or a client code rather than your full name. I control who can access your records, and only I use them routinely, except where sharing is described in this notice.

If a data breach happens that is likely to put your rights or freedoms at risk, I will assess it promptly and, where required, report it to the ICO and inform you without undue delay.

7. Your rights

You have the right to ask to see the information I hold about you (a subject access request), to have inaccurate information corrected, to ask me to delete it, and to restrict or object to how I use it. You can also ask for a copy of information you gave me that I process electronically under our agreement. You can withdraw your consent to marketing at any time, without it affecting your counselling.

To use any of these rights, contact me at hello@barnsleycounselling.co.uk. I will respond within one month and will not charge you. Please note that my notes sometimes contain information about other people, or information whose release could cause serious harm. In the first case I may need to redact part of a record; in the second, before relying on the serious-harm exemption to withhold information, I will seek the opinion of a suitably qualified health professional. These rights are not affected by anything in our counselling agreement.

8. Marketing

If you have asked to receive occasional updates about my practice, I keep your details on a separate marketing list, held only with your consent. I will not use the contact details you give me for counselling to send you marketing. You can unsubscribe at any time using the link in any message, or by emailing me.

9. Website and cookies

My website at barnsleycounselling.co.uk is served over a secure, encrypted (HTTPS/TLS) connection, which protects information while it is in transit. The site uses only essential cookies needed for it to work. For analytics I use a privacy-first, cookieless tool that sets no cookies, stores nothing on your device, and collects no personal data or IP addresses. Even so, please avoid putting sensitive personal details in the website contact form; anything you send comes through to my email and is handled as described in this notice. The site is hosted by Vercel, who process this information for me.

10. Complaints

If you are unhappy with how I handle your information, please tell me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Changes to this notice

I review this notice at least once a year and whenever my practice changes. The date at the top shows when it was last updated. If I make significant changes, I will tell current clients directly.