Privacy Notice

Who I am

The data controller is Rebecca Shore, trading as Eunoia Therapy. I am the person responsible for the personal information described in this notice.

I am a Registered Member of the British Association for Counselling and Psychotherapy (BACP), MBACP, membership number 420880. I am registered with the Information Commissioner’s Office, registration number ZC210841.

I offer integrative counselling and psychotherapy to people aged 16 and over, where insurance cover and safeguarding arrangements are appropriate. Sessions are face to face in Skipton and Keighley, and online across the UK.

You can contact me about this notice, or about your information, at eunoiapsychotherapy@outlook.com. The website is eunoiapsychotherapy.co.uk.

Information I collect

Website and email enquiries

If you use the contact form, I receive:

• Your name
• Your email address
• Your phone number, if you choose to give it
• How you would like to begin, such as a free 15-minute phone call, online sessions, or sessions in Skipton or Keighley
• The message you write
• The fact that you ticked the box agreeing I may keep those details so I can reply
• The date and time the form was sent

The form does not ask your age, your GP, or for health or medication details. Please keep a first message brief, and leave detailed health information until we are in contact. If you include it anyway, I will use it only to reply and to think about whether we might work together.

If you email me, I keep your email address and whatever you choose to include. The website does not keep a database of enquiries. The form emails your message to me, and you receive a short automatic email confirming that it arrived.

I use enquiry information to reply, to arrange a conversation or appointments, and to communicate with you about counselling. I do not use it for marketing, and I do not sell personal information.

Please share only what is relevant. A first message does not need your history, your medication, or a full account of what is happening.

If we work together

If you decide to begin counselling, I also keep what I need for the work and for a proper clinical record. That can include:

• Your name, date of birth and contact details
• Your address
• Your GP surgery and an emergency contact
• Appointment and communication information
• Relevant health and medication information
• Counselling assessment information and confidential session notes
• Payment and transaction records, such as the amount, the date, and that a payment relates to your sessions

Please give me only the information that is relevant to your counselling. Fees are paid by bank transfer. This website does not take card payments.

You do not have to contact me, and you do not have to start counselling. If you want a reply through the form, I need your name and email address. If we work together, I need enough information to contact you, arrange sessions, and keep a proper record. You choose how much to tell me about your health. If you would rather not give a GP surgery, an address, or an emergency contact, we can talk about what that means before we start.

Why I use your information

I use personal information to:

• Respond to enquiries
• Arrange and provide counselling
• Keep appropriate clinical records
• Communicate with you about appointments
• Process payments
• Meet professional, safeguarding and legal responsibilities
• Maintain safe and ethical practice, including clinical supervision

I do not use your information for marketing, and I do not sell it.

The tick box on the contact form records that you are content for me to keep your message so I can reply. It is not a separate consent form for counselling notes.

The lawful basis for using your information

UK GDPR needs a lawful basis for each way I use personal information. The basis depends on the purpose. I do not use one basis for everything.

• Replying to an enquiry and arranging counselling. You contact me because you want a reply or a consultation. I use your details because that is necessary to take those steps at your request, before we agree to work together. This is Article 6(1)(b).
• Providing counselling and keeping the clinical record. Once we agree to work together, I use your contact details, appointment information, assessment information and session notes because that is necessary to provide the counselling we have agreed. This is Article 6(1)(b).
• Your GP surgery and emergency contact. I keep these so I know who to approach if I become seriously worried about your safety. This is legitimate interests, under Article 6(1)(f). I do not contact them as a matter of course.
• Payments and tax. I keep payment information because it is necessary for our agreement, under Article 6(1)(b), and because the law requires me to keep business records for HMRC, under Article 6(1)(c).
• Clinical supervision and running the website safely. I rely on legitimate interests, under Article 6(1)(f). The interest is in practising safely, meeting the BACP Ethical Framework, and protecting the website from misuse. You can object to this kind of use. That right is explained below.
• Keeping records after counselling has ended. I keep the clinical record for the period explained below so I can meet professional and insurance responsibilities, and so I can deal with a complaint or claim if one arises. The Article 6 basis for keeping ordinary personal information after the work has ended is still under review. Legitimate interests, under Article 6(1)(f), is the basis being considered. It is not confirmed in this notice. Where the law itself requires a record to be kept, such as an HMRC record, I rely on legal obligation, under Article 6(1)(c).
• Serious risk and the law. Where information has to be shared to protect someone’s life, I rely on vital interests, under Article 6(1)(d). Where the law requires a disclosure, such as a court order, I rely on legal obligation, under Article 6(1)(c).

Health information, medication, and counselling notes need extra protection. The law calls this special category information. Article 9 requires a further condition, as well as one of the reasons above. Some of those conditions also have tests in the Data Protection Act 2018.

The Article 9 condition for keeping health information as part of routine counselling is still being confirmed. I will explain it to you in plain language before we begin ongoing work, and I will update this notice when it is settled. I am not treating the contact-form tick box as that condition. I am not treating BACP registration, on its own, as enough to rely on Article 9(2)(h), the health or social care condition. That condition applies only where section 11 and Schedule 1, paragraph 2 of the Data Protection Act 2018 are met. BACP membership does not, by itself, place me on the list of health professionals in section 204 of that Act.

If health information has to be shared because of a serious risk, these are the conditions that can apply:

• Article 9(2)(c), where sharing is necessary to protect someone’s life and the person is physically or legally unable to give consent.
• Article 9(2)(g), together with Schedule 1, paragraph 18 of the Data Protection Act 2018, where the sharing is necessary to safeguard a child or an adult at risk and the tests in that paragraph are met. Relying on that paragraph can also require an appropriate policy document under Part 4 of Schedule 1. Whether that document is required, and whether one is in place, is being reviewed separately. I will not rely on this condition until that review is complete.
• Article 9(2)(f), where the information is needed for a legal claim. That includes a court order, and a complaint or possible claim that my insurer needs to deal with.

How long I keep your information

Counselling records for clients aged 18 and over are normally retained securely for seven years after the final counselling session.

If you were under 18 during our work together, I do not rely only on the adult seven-year period. I have asked my insurer to confirm how long those records should be kept. The wording under review is that the records would normally be kept until the later of seven years after the final session or five years after your 18th birthday. That wording is not yet confirmed. Until it is, I will not destroy those records merely because seven years have passed since the final session.

Records may be retained for longer where necessary to meet legal obligations, respond to complaints or claims, or address other justified circumstances.

Once the applicable retention period has ended, records will be securely deleted or destroyed unless there is a lawful reason to retain them.

Enquiries that do not become counselling

If we do not go on to work together, I keep the enquiry for three months after our last communication. I then securely delete it, unless there is a justified reason to keep it longer, such as a complaint or a safeguarding concern. I do not add these enquiries to a marketing list.

Payment records

I keep financial records for the period HMRC requires. That period stands apart from the period for counselling notes. Because this is a self-employed practice, HMRC normally requires business records to be kept for at least five years after the 31 January submission deadline for the tax year they relate to. I keep them for longer where HMRC requires it, for example if a return is sent late or HMRC is checking it. If a different HMRC rule applies to a particular record, I follow that rule.

How your information is stored

Your personal information and counselling records are stored securely and confidentially.

Paper counselling records are kept in a locked cabinet, and digital counselling records are stored on an encrypted hard drive. I am the only person who has access to these records. I take appropriate steps to protect confidentiality and to keep that access restricted.

I am arranging a professional will. It is not yet in place. If I become unable to practise, arrangements may be made for a designated professional to access only the information necessary to contact clients, protect their wellbeing and manage records appropriately, in line with confidentiality and data protection requirements.

Records are retained for the periods explained in this Privacy Notice and securely deleted or destroyed when no longer required, unless there is a justified reason to retain them.

Confidentiality and sharing

What you say in counselling is confidential. I do not share it with your GP, an emergency contact, a family member, or anyone else as a routine part of the work. If you are 16 or 17, that confidentiality applies to you. I do not routinely share your counselling with a parent or guardian.

I will explain the limits of confidentiality before we start. I do not sell your information, and I do not use it for marketing.

Clinical supervision

I have regular clinical supervision, which is part of safe practice under the BACP Ethical Framework. I discuss the work without naming you, and I anonymise it wherever I can. If a situation could still be recognised, I keep what I share to what the supervisor needs. Supervision is a professional conversation. It is not a report to your GP, your family, or your emergency contact.

Serious risk and safeguarding

I may need to share relevant information, which can be without your agreement, if there is a serious risk of harm to you or to someone else, if I need to safeguard a child or an adult at risk, or if the law requires it, for example a court order. I share only what is needed for that purpose. Where I can do so safely, I will tell you before I share information, or as soon as I reasonably can afterwards.

Your GP and emergency contact

I ask for your GP surgery and an emergency contact so that I know who to approach if I am seriously worried about your safety. I do not contact them as a matter of course.

I would contact your GP or your emergency contact if you asked me to, or if I believed it was necessary to protect you or someone else from serious harm, or to meet a safeguarding or legal duty. A letter or update that you ask me to send is something we would agree together. I would share only what that person needs for that purpose.

Insurer and other requests

My professional indemnity insurer is Holistic Insurance. I do not send them information about you as a routine part of counselling. If there is a complaint or a possible claim, I may need to share the information they require to deal with it. I may also share information when you ask me to, for example a letter you want sent to your GP.

Services that support the practice

I use a small number of services to run the website and to receive messages. They handle information for those tasks.

• Cloudflare hosts this website and receives the contact form so it can be emailed on. The form uses the internet address of a submission only to limit repeated messages. I do not add that address to a counselling record. Cloudflare may also keep technical logs needed to run and protect the site.
• Resend delivers the enquiry email to me and the short confirmation email to you. The confirmation is sent from Eunoia Therapy at enquiries@eunoiapsychotherapy.co.uk. Resend handles your name, email address, phone number if you gave one, your preference for how to begin, your message, the tick-box confirmation, and the time the form was sent.
• Microsoft Outlook provides the practice mailbox, eunoiapsychotherapy@outlook.com, where those messages arrive and where I correspond with you by email.
• Zoom is where online counselling sessions take place. Zoom handles the video call, including your voice, your image, and the name you use to join.

Fees are paid by bank transfer between your bank and mine. Each bank handles that payment under its own privacy notice. I keep my own record of the amount, the date, and that the payment relates to your sessions.

The website links to Instagram and to Counselling Directory. If you follow those links, those sites handle your visit under their own privacy notices. I do not receive a report of your browsing on them.

Please do not put health or counselling information in a website enquiry. Resend’s published data-processing terms do not describe that kind of information as part of the email service.

I am checking how long each of these providers keeps its own copy. I will add that here when it is confirmed. The three-month period for an enquiry that does not become counselling is the period for the copy in my own records.

Cookies and this website

This website does not use cookies to analyse visits or to advertise. The pages themselves do not set a cookie. Fonts are stored with the website, rather than loaded from another company.

Your browser may keep a short note in its own session storage, so that a link can bring you back to the right place on a page. That note stays on your device. It is not sent to me.

An ordinary visit does not set a cookie. If Cloudflare sets a cookie that is strictly necessary to protect the site from misuse, it is used for that purpose and not to follow you around the web.

Your rights

Under UK data protection law, you can ask me to:

• Confirm whether I hold personal information about you, and to provide a copy of it.
• Correct information that is inaccurate, or complete information that is incomplete.
• Delete information in the circumstances where the right to erasure applies.
• Restrict how I use information in the circumstances where that right applies.
• Provide the information you gave me, in a portable form, where the right to data portability applies. That right covers information you provided, held in digital form, and used because of our contract or because of consent.
• Consider an objection where I rely on legitimate interests, including for supervision and for running the website. I will stop unless I can show compelling grounds that override your interests, rights and freedoms, or the information is needed for a legal claim.
• Stop a particular use that is based on consent, where consent is the basis for that use. Withdrawing consent does not affect the lawfulness of what has already been done. Records that the law, my insurer, or another condition still requires me to keep may need to be retained.

I do not use your information to make solely automated decisions about you, and I do not use it for profiling.

To use any of these rights, email me at eunoiapsychotherapy@outlook.com. I will respond within one calendar month. If a request is complex, or if I have several requests from you at once, I may take up to a further two months, and I will tell you if I need that time. I may need to ask for enough information to be satisfied about who you are before I release a record.

These rights have limits. I can refuse or partly refuse a request where the law allows it, including where I have to keep a record for a legal claim or for HMRC. If I cannot do what you ask, I will explain why, unless the law prevents me from doing so.

Complaints

Please contact me first if you are unhappy about how I have handled your information. I will take your concern seriously and I will write back.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. You can do that at ico.org.uk/make-a-complaint.

Changes to this notice

I may update this notice when my practice, the services I use, or the law changes. I will also update it when the points still under review are settled. Those points include the Article 9 condition for routine counselling information, the Article 6 basis for keeping records after counselling ends, and the retention period for clients seen before they were 18. Any changes will be published on this page.

Last updated: 9 October 2026