1. Introduction

At Akira Counselling, I respect your privacy and am committed to protecting your personal data. This privacy notice explains how I collect, use, store, and protect your personal information when you visit my website, make an enquiry, or engage in counselling sessions or workshops with me.

I operate as a sole trader registered in the UK. I am a member of the National Counselling and Psychotherapy Society (NCPS) and am registered with the Information Commissioner’s Office (ICO) as a Data Controller.

2. The Information I Collect

I may collect and process different kinds of personal data depending on how you interact with me:

Contact Information: Name, email address, phone number, and age/date of birth (to ensure clients meet the 14+ age criteria).
Young People (under 18): For young people under the age of 18 I will collect home address, enrolled education if relevant and parent/carer phone number and email address. I will only hold a young person’s phone number with parent/carer consent and this is explicitly for administration purposes. This is made clear to the young person. I hold this information to protect the wellbeing of the young person and to respond to my duty of care. I will delete their contact details as soon as therapy ceases.
Website Enquiry Form Data: When you complete an enquiry form on my website (for individual therapy or group workshops), I collect your name and email address. Please note: You are advised not to include sensitive personal details in the website enquiry form.
Special Category Data (Health Data): If you proceed with counselling, I collect sensitive personal data including therapeutic session notes and relevant background information necessary to provide safe and effective therapy.
Technical & Cookie Data: Basic information automatically collected via website cookies when you visit my website (e.g., IP address, browser type).

3. Lawful Basis for Processing Data

Under UK GDPR, I must have a lawful reason to collect and process your personal data:

Consent & Contractual Necessity: Processing your basic contact details is necessary to respond to your initial enquiry and to fulfil our therapeutic contract or workshop booking.
Legitimate Interests: Storing minimal client records to run a safe, professional therapeutic practice and handle administrative tasks.
Special Category Data (Health Data): Under Article 9(2)(h) of the UK GDPR, I process health data for the provision of health or social care treatment, bound by professional confidentiality requirements under the NCPS Code of Ethics.

4. How Your Data is Stored and Protected

I take the security of your data seriously:

Practice Management System: Session notes and personal details of active clients are stored securely using bacpac, a practice management software provided by Mayden.
Data Location: Servers for both my email provider and bacpac (Mayden) are located within Europe/UK and meet stringent data protection standards (UK GDPR compliant).
Security Measures: Access to client records is protected by strong passwords and multi-factor authentication where applicable.

5. Data Retention: How Long I Keep Information

Client Session Notes & Contact Details: I retain full client records and session notes for 5 years after counselling has ceased, after which they are securely deleted/destroyed.
Enquirers Who Do Not Proceed: If you make an enquiry via my website or email but do not proceed with counselling or a workshop, your sensitive and personal contact data will be promptly deleted and will not be retained.

6. Sharing Your Data & Third Parties

I do not sell, rent, or share your personal information with third parties for marketing purposes. Your information remains confidential, except in the following limited circumstances:

Clinical Supervisor / Clinical Will: In accordance with professional standards, I discuss my work with a qualified Clinical Supervisor. Client details remain anonymised in supervision. In the event of my unexpected incapacity or death, my Clinical Supervisor acts as my Clinical Trustee. Under my Clinical Will, my supervisor has restricted access—via bacpac—only to client contact details to inform you of the situation. My supervisor does not have access to your session notes.
Legal & Safeguarding Exceptions: Confidentiality may be broken if required by a court of law, or if there is a severe risk of harm to yourself or others (e.g., under child protection or terrorism legislation). Where possible, I will discuss this disclosure with you first.
Insurance: I hold professional indemnity insurance with Haydens Insurance, and data may be shared if required for formal legal claims.

7. Website Cookies

My website uses cookies to improve user experience and ensure the website functions correctly.

Managing Cookies: You can choose to accept or decline cookies when you visit my website. You can also disable or delete cookies at any time through your browser settings. Blocking essential cookies may affect how the website functions.

8. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access: You have the right to request a copy of the personal data and session notes I hold about you (Subject Access Request).
Right to Rectification: You can ask me to correct inaccurate or incomplete information.
Right to Erasure (The “Right to be Forgotten”): You have the right to request the deletion of your personal data. However, this right is not absolute for clinical records. Under UK GDPR Article 17(3), I am legally entitled and obligated to retain clinical session notes for the duration of my 5-year retention period for healthcare administration, professional compliance, and defence against potential legal or professional claims. Data of individuals who do not proceed with therapy will be erased promptly upon request or non-completion.
Right to Restrict Processing: You can ask me to limit how I use your data in certain circumstances.

To exercise any of these rights, please contact me directly at akiracounselling@gmail.com.