GDPR Statement

My commitment to your privacy

Your privacy matters a lot to me since you are trusting me with personal and sensitive information. Protecting your confidentiality is fundamental to our counselling relationship. This statement explains how I collect, use, and look after your personal information in plain language.

What information I collect

If you begin counselling with me, I may collect and keep the following types of personal data:

Your name, address, telephone number and email address

Emergency contact details

The reason you are coming for counselling (your presenting issues)

Relevant medical and mental health history

Information about your current circumstances, relationships and background

Session notes about our counselling work together

Risk assessments where appropriate

Invoices and payment information

Why I collect this information:

In order for me to fulfill my responsibilities as your counsellor I need your personal information and data protection law under I rely on:

For general personal data: Article 6 (1)(b) UK GDPR – processing is necessary for the performance of the therapeutic contract between us. When you engage me as your counsellor, we enter into a contract for therapy services. I need to process your personal data to fulfil that contract.

For health related information: Because counselling is a health-related service, and processing your therapy-related information is essential to that care, I rely on Article 9 (2)(h) UK GDPR. The additional legal basis under UK law is DPA 2018 is Schedule 1 Part 1, paragraph 2 (health or social care). As a qualified counsellor I am bound by professional confidentiality obligations under the ethical framework of the BACP (British Association for Counselling and Psychotherapy), and this means I meet the requirements for processing this kind of sensitive information.

My professional obligations

As a member of the BACP, I am required to attend regular clinical supervision. This is an essential part of maintaining high standards of practice and ensuring I provide you with the best possible care.

When I discuss my therapeutic work with my supervisor, your name and any identifying details are not shared with my supervisor. I use anonymised or pseudonymised case material only – which means I change or remove details that could identify you. My supervisor is a qualified professional bound by the same confidentiality obligations as I am.

Clinical will

I have appointed a clinical trustee – a trusted colleague who is also a qualified counsellor, who would step in, in the event of my death, serious illness or incapacity that prevents me from continuing to practise. In such circumstances, my clinical trustee would contact you to inform you of the situation and discuss arrangements for your records. They are bound by the same professional confidentiality requirements.

Who else may see your information

The following parties may have access to your data in specific circumstances:

Clinical supervisor: my supervisor receives anonymised case material only. Your name and identifying details are not shared.

External accountant: my accountant has access to invoice data only (your name and amounts paid) for accounting purposes. They do not have access to your counselling records.

Employee Assistance Programme (EAP): If you were referred to me through an EAP, limited information may be shared with the commissioning organisation as part of that arrangement. This is typically limited to confirmation of attendance and session numbers, not the content of our work.

IT Support: external IT support may have incidental access to my systems during maintenance. They are bound by confidentiality arrangements and do not access your records unless strictly necessary for technical purposes.

Third party services on my website:

Google Analytics – to understand how visitors use my website

WordPress – the platform my website runs on

WebHealer – the website builder service

WhatsApp – for online therapy sessions

Each of these services is bound by a data processing agreement. I can provide links to their privacy policies on request.

When I might need to break confidentiality

There are some circumstances when I may need to share information without your consent:

Risk of serious harm: If I believe there is an immediate risk of serious harm to you or to another person, I may need to share information with appropriate services to help keep people safe.

Safeguarding concerns: If I become aware of a child protection issue or concerns about a vulnerable adult, I have a legal and ethical duty to report this to the appropriate authorities.

Legal requirements: If I receive a court order requiring me to disclose information, I am legally obliged to comply. Other legal requirements: law (e.g. terrorism, money laundering, drug/human trafficking)

Whenever possible I will discuss my concerns with you first, before sharing information, unless doing so would itself put someone at risk. I will always aim to share only the minimum information necessary.

How long I keep your records

I keep your counselling records for 7 years after our last session. This is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

My counselling records are held in a locked filing case and digitally. Electronic records are stored securely and password protected. They are destroyed securely at the end of the retention period.

Your rights under data protection law

You have the following rights regarding your personal data:

Right to be informed: you have the right to know how I collect and use your personal data.

Right of access: you can ask me for a copy of the personal data I hold about you.

Right to rectification: If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure: in certain circumstances, you can ask me to delete your personal data. However I may be required to retain records for professional indemnity insurance requirements or other legal obligations.

Right to restrict processing: You can ask me to limit how I use your data in certain circumstances

Right to data portability: Where technically feasible and where I process date based on your consent or our contract, you can ask me to transfer your data to another organisation

Right to object: you can object to certain types of processing, including processing for direct marketing purposes

Making a complaint

If you wish to complain about how I have handled your personal information, please contact me. I take all complaints seriously and will respond promptly.

Email me at anna@murphycounselling.co.uk

You may also complain to the Information Commissioner’s Office (ICO)

Website: ico.org.uk

Telephone 0303 1231113

ICO registration number ZC015540

Last updated 11th June 2026