top of page

Privacy Notice and Terms of Use 

 

Your privacy is very important to me. I take the security and confidentiality of your personal information seriously and will only use your information where there is a lawful and appropriate reason to do so. 

​

I process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (DUAA). Where applicable, I also comply with the Privacy and Electronic Communications Regulations 2003 (PECR). 

​

This Privacy Notice explains how I collect, use, store and protect your personal information from your initial contact with me, throughout your counselling, and after counselling has ended. 

​

It explains: 

  • what personal information I collect and why; 

  • the lawful bases on which I process your information; 

  • whether you are required to provide particular information; 

  • how long I retain your information; 

  • who your information may be shared with; 

  • whether your information may be transferred outside the UK; 

  • whether I use automated decision-making or profiling; and 

  • your rights under data protection law. 

 

If you have any questions about how I use your personal information, I am happy to discuss them with you. 

 

You can contact me at therapy@carolinevohoracounselling.com. 

 

Who is responsible for your information? 

 

The term "data controller" describes the person who determines how and why personal information is processed. 

For the purposes of the personal information processed in connection with my counselling practice, I am the data controller. 

​

I am registered with the Information Commissioner's Office (ICO), where required. 

 

ICO registration number: ZC211922 

 

What personal information do I collect? 

 

The information I collect will depend on your contact with me and the counselling services you receive. 

 

This may include: 

  • your name; 

  • contact details, including telephone number, email address and address where necessary; 

  • date of birth and other identifying information where reasonably necessary; 

  • emergency contact details; 

  • GP or medical practice details, where provided; 

  • information about your physical and psychological wellbeing; 

  • information about medication, diagnoses or other health support where relevant to your counselling; 

  • background and personal history relevant to the therapeutic work; 

  • information about your current circumstances and social support; 

  • previous counselling or therapy experience; 

  • your reasons for seeking counselling and your goals for the work; 

  • appointment and attendance information; 

  • correspondence between you and me; 

  • payment and invoicing information; and 

  • brief counselling notes and records. 

 

Counselling may involve information concerning your physical or mental health and wellbeing. This is known as special category personal data and receives additional protection under data protection law. 

 

I aim to collect only information that is reasonably necessary for providing and administering counselling and for appropriate professional, legal, regulatory and insurance purposes. 

 

Where information is optional, I will make this clear. 

 

How I use your information 

 

I may use your personal information to: 

  • respond to your initial enquiry; 

  • assess whether counselling with me is appropriate; 

  • arrange and manage appointments; 

  • provide counselling; 

  • maintain appropriate professional records; 

  • communicate with you about your counselling; 

  • process payments and maintain financial records; 

  • obtain professional supervision; 

  • manage safeguarding or serious-risk situations; 

  • meet legal, professional, regulatory or insurance requirements; 

  • deal with complaints or legal matters; and 

  • maintain appropriate professional contingency arrangements, including my Clinical Will. 

 

I will not use your personal information for purposes that are incompatible with those described in this Privacy Notice unless I have a lawful basis to do so. 

 

My lawful basis for processing your information 

 

Data protection law requires me to have a lawful basis for processing personal information. The lawful basis I rely on depends on what information I am processing and why. 

 

Depending on the circumstances, I may process your personal information where it is: 

  • necessary to take steps at your request before entering into a counselling agreement; 

  • necessary for the performance of our counselling agreement; 

  • necessary for my legitimate interests, where those interests are not overridden by your rights and interests; 

  • necessary for me to comply with a legal obligation; or 

  • otherwise permitted by applicable data protection legislation. 

 

Different lawful bases may apply to different types of information and different stages of our work together. 

 

Special category information 

​

Information concerning your physical or mental health is special category personal data. 

​

I will only process special category information where I have both an appropriate Article 6 lawful basis (consent (Art.6 (1) (a) and contract (Art.6 (1) (b)) and a valid Article 9 condition (health (h) Art.9) under the UK GDPR, together with any additional safeguards required by law. 

​

The processing of special category information will be limited to what is reasonably necessary for the purposes described in this Privacy Notice. 

 

Initial contact 

 

When you contact me with an enquiry about counselling, I will collect information that is reasonably necessary to respond to your enquiry and, if you decide to work with me, to arrange and provide counselling. 

 

If you decide not to proceed with counselling, I will not retain your information for longer than is reasonably necessary for the purpose for which it was collected. 

 

Where there is no continuing legal, professional, insurance or administrative reason to retain the information, it will be securely deleted or destroyed in accordance with my retention procedures. 

 

Different types of information may therefore be retained for different periods. 

 

Counselling records and notes 

 

I keep brief counselling notes and only record information that is necessary for the provision of counselling and appropriate professional record keeping. 

 

Where possible, identifying information is minimised. I may use reference letters or other identifiers rather than unnecessary personal details. 

 

Counselling records are stored securely. Paper records are kept in locked storage and electronic information is protected using appropriate security measures, including password protection and encryption where available. 

 

Access to counselling records is restricted. Information will only be accessed, used or disclosed where there is a lawful and appropriate reason to do so. 

​

Confidentiality 

 

Information shared during counselling is treated as confidential and confidentiality is an important part of the therapeutic relationship. 

 

There are circumstances in which confidentiality may need to be limited. These may include: 

  • where I believe there is a serious and significant risk of harm to you or another person; 

  • where there are safeguarding concerns involving a child or adult at risk; 

  • where disclosure is required or permitted by law; 

  • where disclosure is necessary to meet a professional or legal obligation; or 

  • where another lawful and proportionate basis for disclosure applies. 

 

Where it is safe and appropriate to do so, I will normally discuss a proposed disclosure with you beforehand. However, there may be circumstances where I cannot do this. 

 

Where information needs to be disclosed, I will seek to share only information that is relevant and proportionate to the circumstances. 

 

Professional supervision 

 

I undertake regular professional supervision as part of my ethical and professional practice. 

 

I may discuss aspects of my counselling work with my supervisor to support safe, ethical and effective practice. 

Where a client's circumstances are discussed, I minimise identifying information wherever possible and share only information that is reasonably necessary for supervision. 

 

My supervisor is subject to professional confidentiality and ethical obligations. 

 

Clinical Will 

 

As part of my professional contingency planning, I maintain a Clinical Will using ClinicalWill.app. 

 

The purpose of the Clinical Will is to ensure that, in the unlikely event that I become seriously ill, incapacitated or die and cannot continue providing counselling, an appropriately nominated fellow professional can identify and contact relevant clients and help them understand their options for ongoing support. 

 

Only limited information necessary for this purpose is included in the Clinical Will; your name, email address and usual session day and time. 

 

A nominated Clinical Trustee may access this information for the purposes of carrying out the Clinical Will arrangements. 

 

If you do not wish your information to be included in my Clinical Will arrangements, please contact me so that I can discuss this with you and record your preference. 

 

Further information about how ClinicalWill.app processes personal information is available through its own privacy information ( https://clinicalwill.app/security )  

 

Online counselling 

 

Where counselling takes place online, I use Microsoft Teams. 

 

Personal information may be processed in connection with arranging and conducting online counselling sessions. 

I take reasonable steps to ensure that online sessions and associated information are handled securely. However, electronic communications and online services cannot be guaranteed to be completely free from technical or security risks. 

 

You should take reasonable steps to ensure that you are in a private environment where you cannot be overheard during an online counselling session. 

 

Communication by email and text 

 

I may use email and telephone/text messages to communicate with you about appointments and other practical matters relating to your counselling. 

 

For security and confidentiality reasons, I do not routinely retain text messages for longer than is necessary. Where a text contains information that is relevant to your counselling record, I may retain the relevant information securely as part of your records. 

 

Email correspondence that is not required for an ongoing purpose will normally be deleted when it is no longer necessary to retain it. Where correspondence needs to be retained, it will be stored securely. 

 

Please be aware that ordinary email and text messaging cannot be guaranteed to be completely secure. I therefore encourage you not to send highly sensitive therapeutic information by ordinary email or text unless necessary. 

 

Who may receive your information? 

 

I do not routinely share your personal information with third parties. 

 

However, information may be accessed or shared where there is a lawful and appropriate reason to do so. Depending on the circumstances, this may include: 

  • my professional supervisor; 

  • my nominated Clinical Trustee in accordance with my Clinical Will arrangements; 

  • ClinicalWill.app and relevant technology providers; 

  • Microsoft Teams and other technology providers supporting my practice; 

  • my bank or payment providers; 

  • my insurer or professional advisers where necessary; 

  • professional or regulatory organisations where required; 

  • emergency, safeguarding or statutory services where appropriate; and 

  • courts, law-enforcement bodies or other authorities where disclosure is legally required or permitted. 

 

Where information is shared, I will seek to limit this to information that is relevant and proportionate to the purpose for which it is being shared. 

 

Transfers of personal information outside the UK 

 

Where a service provider processes personal information outside the UK, I will ensure that any transfer is carried out in accordance with applicable UK data protection law and that appropriate safeguards are in place where required. 

 

Further information about relevant international transfers can be provided on request. 

 

How long I keep your information 

 

Counselling records are normally retained for five years following the end of counselling, in accordance with my professional and insurance requirements. 

 

Other information may have different retention periods. For example, financial and accounting information may need to be retained for longer to meet legal or accounting requirements. 

 

When information is no longer required, it will be securely deleted or destroyed. 

 

If there is a legitimate legal, professional, regulatory or insurance reason why information needs to be retained for longer, I may retain it for the period necessary for that purpose. 

 

Your data protection rights 

 

Depending on the circumstances and the way I process your personal information, you may have rights under data protection law, including: 

  • the right to request access to your personal information; 

  • the right to request correction of inaccurate or incomplete information; 

  • the right to request restriction of processing in certain circumstances; 

  • the right to object to certain processing; 

  • the right to request erasure in certain circumstances; 

  • the right to data portability where applicable; and 

  • rights relating to certain automated decision-making, where applicable. 

 

These rights are not absolute and may be subject to legal conditions and exemptions. For example, I may need to retain certain information to meet legal, professional, regulatory or insurance requirements. 

 

Access to your information 

 

You have the right to ask me for a copy of the personal information I hold about you, subject to applicable legal exemptions. 

 

If you make a Subject Access Request, I will undertake a reasonable and proportionate search for the personal information relevant to your request. 

 

I may need to ask you to provide information to verify your identity before providing personal information, in order to ensure that information is not disclosed to the wrong person. 

 

I will normally respond to a valid request within one month, subject to the applicable provisions of data protection law concerning complex or multiple requests. 

 

To make a Subject Access Request, or to exercise any of your other data protection rights, please contact me in writing at: therapy@carolinevohoracounselling.com 

 

Data protection complaints 

 

If you have a concern or complaint about how I have collected, used, stored or otherwise processed your personal information, please contact me in the first instance at: 

therapy@carolinevohoracounselling.com 

 

I will acknowledge a data protection complaint within 30 days and will take appropriate steps to investigate and respond to the complaint without undue delay. 

 

I will keep you informed as appropriate during the process and will provide you with the outcome of my investigation. 

If you remain dissatisfied with my response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. 

 

Information about making a complaint to the ICO can be found on the ICO website. 

 

Data security 

 

I take reasonable and appropriate steps to protect your personal information against loss, misuse, unauthorised access, alteration or disclosure. 

 

Depending on the type of information, I use measures including: 

  • locked filing cabinets for physical records; 

  • password-protected and encrypted electronic documents where appropriate; 

  • secure devices and accounts; 

  • restricted access to personal information; and 

  • secure destruction or deletion of information when it is no longer required. 

 

No method of storing or transmitting information can be guaranteed to be completely secure, but I take reasonable steps to protect the information I hold. 

 

Automated decision-making and profiling 

 

I do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you. 

 

Use of this website and cookies 

 

This website is hosted using Wix.  For more information see their website: https://support.wix.com/en/article/cookies-and-your-wix-site.  

 

The website may use cookies and similar technologies that are necessary for the website to function, maintain security, remember preferences and improve the user experience. 

 

Some cookies or similar technologies may collect information about how visitors use the website. Where consent is required by applicable law, I will request consent before using those technologies. 

 

You can manage your cookie preferences using the cookie settings available on the website. 

 

The cookies and similar technologies used on the website may change from time to time. The website's cookie settings provide further information about the technologies in use and how you can manage your preferences. 

 

Changes to this Privacy Notice 

 

I may update this Privacy Notice from time to time to reflect changes in my practice, the services I provide, the technology I use or applicable data protection legislation. 

 

The most recent version will be made available on my website. 

 

Contact 

 

If you have any questions about this Privacy Notice, how I process your personal information, or your data protection rights, please contact me at: 

 

Caroline Vohora 
Email: therapy@carolinevohoracounselling.com 
Website: www.carolinevohoracounselling.com 

ICO registration number: ZC211922 

Privacy Notice last updated: September 2026 

bottom of page