Privacy Policy

1) Who I am

This is the privacy policy of Anna Murphy Counselling. I am Anna Murphy, a qualified counsellor in private practice. I am registered with the Information Commissioner’s Office (ICO) registration number ZC015540

If you have any questions about how I handle your personal data or to exercise any of your rights, please contact me at anna@murphycounselling.co.uk

2) What personal data I collect

If you work with me, I may collect and process the following types of personal data:

Contact and identity information:

Your name, address, telephone number and email address

Emergency contact details

Health and counselling-related information:

The reason you are coming for counselling (your presenting issues)

Relevant medical and mental health history

Information about your current circumstances, relationships and background

Session notes about our counselling work together

Risk assessments where appropriate

Administrative information:

Appointment records

Invoices and payment information

Correspondence between us

Website enquiry information:

Your name, telephone number and email address when you submit my contact form

The content of your message

Important:

Health and counselling-related information is classified as ‘special category data’ under article 9(1) of the UK GDPR. This means it has enhanced legal protection because of its sensitive nature. I take particular care to protect this information.

3) How I collect your data

I only collect personal data directly from you:

when you contact me by telephone, email or via my website contact form

during our initial telephone assessment and intake process

throughout our counselling work together during sessions

through any correspondence between us via email, telephone etc

I do not collect personal data about you from third parties unless you have explicitly given me consent to do this or if a referral is made through an Employee Assistance Programme (EAP) or similar.

4) Why I process your data – lawful basis

Under UK GDPR I must have a lawful basis for processing your personal data. My lawful bases are:

For general personal data (Article 6 basis)

Article 6 (1)(b) UK GDPR – processing is necessary for the performance of the therapeutic contract between us. When you engage me as your counsellor, we enter into a contract for therapy services. I need to process your personal data to fulfil that contract.

For special category health data (Article 9 basis)

Article 9 (2)(h) UK GDPR – processing is necessary for the provision of health or social care treatment by a health professional. As a qualified counsellor I am providing a health-related service and processing your therapy-related information is essential to that care.

The additional condition required under DPA 2018 is Schedule 1 Part 1, paragraph 2 (health or social care). This processing is carried out by a qualified counsellor subject to a professional obligation of confidentiality under the ethical framework of the BACP.

5) Professional obligations and CPD

I am required by the BACP to attend regular clinical supervision. This is an essential part of maintaining high standards of practice and ensuring I provide you with the best possible care.

When I discuss my therapeutic work with my supervisor:

Your name and any identifying details are NOT shared with my supervisor.

I use anonymised or pseudonymised case material only – which means I change or remove details that could identify you

My supervisor is a qualified professional bound by the same confidentiality obligations as I am

My supervisor is bound by their own professional body’s ethical framework

Supervision helps me reflect on my practice, gain professional support and ensure I am working safely and effectively.

6) Clinical Will – what happens to your records if I am unable to practise

I have appointed a clinical trustee – a trusted colleague who is also a qualified counsellor bound by professional confidentiality requirements.

In the event of my death, serious illness or incapacity that prevents me from continuing to practise:

My clinical trustee will access my client records securely

They will contact you to inform you of the situation

They will offer you the option to retrieve your records, have them transferred to another counsellor of your choice, or have them securely destroyed

Your records will be handled with complete confidentiality throughout this process

My clinical trustee will not read the content of your counselling notes unless strictly necessary to contact you or manage the records appropriately.

This arrangement ensures your confidentiality is protected and you are not left without information if I am suddenly unable to practise.

7) Who I share your data with

I take your confidentiality seriously. I will never sell your personal data.

The following parties may have access to your data in specific circumstances:

Clinical supervisor: my supervisor receives anonymised case material only. Your name and identifying details are not shared.

External accountant: my accountant has access to invoice data only (your name and amounts paid) for accounting purposes. They do not have access to your counselling records.

Employee Assistance Programme (EAP): If you were referred to me through an EAP, limited information may be shared with the commissioning organisation as part of that arrangement. This is typically limited to confirmation of attendance and session numbers, not the content of our work.

IT Support: external IT support may have incidental access to my systems during maintenance. They are bound by confidentiality arrangements and do not access your records unless strictly necessary for technical purposes.

Third party services on my website:

I use the following third-party services which may process your data:

Google Analytics – to understand how visitors use my website

WordPress – the platform my website runs on

WebHealer – the website builder service

WhatsApp – for online therapy sessions

Each of these services is bound by a data processing agreement. I can provide links to their privacy policies on request.

8) International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

Google Analytics (Google LLC, USA)

WordPress (Automattic Inc, USA)

WebHealer (WebHealer Ltd, UK – no international transfer)

WhatsApp (WhatsApp Ireland Limited)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision. You can request a copy of the relevant transfer safeguards by contacting me.

9) How long I keep your data

I keep your data for the following periods:

Counselling records: 7 years after our last session. This is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

Financial records (invoices, receipts): 6 years. This is a legal requirement set by HMRC.

Website enquiries (non-clients): 12 months then securely deleted

My counselling records are held in a locked filing case and digitally. Electronic records are stored securely and password protected. They are destroyed securely at the end of the retention period.

10) Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed: you have the right to know how I collect and use your personal data. This privacy policy fulfils that right.

Right of access: you can ask me for a copy of the personal data I hold about you. This is known as a Subject Access Request. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search for your data and respond within one month.

Right to rectification: If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure: in certain circumstances, you can ask me to delete your personal data. However this right may not apply where I am required to retain records in line with the Limitation Act 1980, professional indemnity insurance requirements or other legal obligations.

Right to restrict processing: You can ask me to limit how I use your data in certain circumstances

Right to data portability: Where technically feasible and where I process date based on your consent or our contract, you can ask me to transfer your data to another organisation

Right to object: you can object to certain types of processing, including processing for direct marketing purposes

Rights relating to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that significantly affect you. I do not use automated decision-making in my practice.

To exercise any of these rights, please contact me at anna@murphycounselling.co.uk

I will respond to your request within one month. There is no fee for most requests, although I may charge a reasonable fee if a request is manifestly unfounded or excessive.

11) Data protection complaints – your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. If you are unhappy with how I have handed your personal data, please let me know so I can try to resolve the issue.

To make a complaint:

Email me at anna@murphycounselling.co.uk

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response:

You may escalate your complaint to the Information Commissioner’s Office (ICO, the UK’s independent regulate for data protection

Website: ico.org.uk

Telephone 0303 1231113

Address ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12) Confidentiality exceptions

Everything you share with me in counselling is confidential. However there are specific circumstances when I may need to share information without your consent:

Risk of serious harm: If I believe there is an immediate risk of serious harm to you or to another person, I may need to share information with appropriate services to help keep people safe.

Safeguarding concerns: If I become aware of a child protection issue or concerns about a vulnerable adult, I have a legal and ethical duty to report this to the appropriate authorities.

Legal requirements: If I receive a court order requiring me to disclose information, I am legally obliged to comply.

Other legal requirements: law (e.g. terrorism, money laundering, drug/human trafficking)

Whenever possible I will discuss my concerns with you first, before sharing information, unless doing so would itself put someone at risk. I will always aim to share only the minimum information necessary.

13) Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how I handle your personal data, I will inform you directly.

The ‘last updated’ date at the bottom of this policy shows when it was most recently revised.

I am registered with the ICO.

My registration reference number is ZC015540.

Last updated: 11th June 2026

Email: anna@murphycounselling.co.uk Website: https://murphycounselling.co.uk/