Privacy policy
UK GDPR and Data Protection Act 2018
Last updated: June 2026
This Privacy Notice explains what personal information I collect, why I collect it, how it is used, stored and retained, your rights under UK data protection law, and how to raise any concerns about the way your information is handled.
Data Controller
Claire Huzzey
Integrative Counsellor and Clinical Supervisor
Email: claire@serenitycounsellingservice.co.uk
Phone: 07508524408
My website is https://www.serenitycounsellingservice.co.uk
ICO Registration Number: ZA501242
I am responsible for determining how your personal data is processed and ensuring it is handled in accordance with UK data protection law.
Who am I?
Serenity Counselling Service is a private counselling practice based in Hornchurch Essex. I am Claire Huzzey, a qualified counsellor Accredited with BACP and the NCPS.
You can contact me at claire@serenitycounsellingservice.co.uk
My website is https://www.serenitycounsellingservice.co.uk
What personal data I collect
I collect and process the following types of personal data:
Contact and identity information:
Your name, address, telephone number, and email address
Emergency contact details
Health and therapy-related information:
- Presenting issues and reasons for seeking therapy
- Session notes recording our therapeutic work together
- Relevant medical and mental health history
- GP details (where you choose to provide them)
- Information about your personal circumstances relevant to therapy
Administrative information:
- Appointment records
- Invoices and payment records
- Correspondence between us
Important: Your health and therapy-related information is classified as “special category data” under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection because of its sensitive nature, and I apply additional safeguards when processing it.
How I collect your data
I collect your personal data directly from you:
- When you first contact me to enquire about therapy (via email, telephone, or through my website, or directories)
- During our initial assessment session
- Throughout our ongoing therapeutic work together
- Through any emails, text messages, or telephone calls between sessions
- When you complete intake forms or assessments
- I do not collect personal data about you from any other sources.
Why we process your data — lawful basis
Under UK GDPR, I must have a valid legal reason to process your personal data. I rely on the following lawful bases:
Article 6 basis (ordinary personal data):
Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your counsellor, we enter into a contract for therapeutic services. I need to process your personal data to fulfil my obligations under that contract, including scheduling appointments, maintaining records of our work, and communicating with you about your therapy.
Article 9 basis (special category health data):
Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified counsellor, I am considered a health professional for the purposes of data protection law.
The additional condition required under UK law is DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes). This condition applies because I am a counsellor subject to the professional obligation of confidentiality under the BACP Ethical Framework for the Counselling Professions.
Professional obligations and CPD
I am required by BACP to attend regular clinical supervision. This is an essential part of maintaining professional standards and ensuring I provide you with safe and effective therapy.
I may discuss our therapeutic work with my clinical supervisor. When I do so:
- Your name and any identifying details are not shared with my supervisor
- I use anonymised or pseudonymised case material only
- My supervisor is a qualified professional bound by the same confidentiality obligations as I am
- My supervisor is bound by their own professional body’s ethical framework
- Clinical supervision helps me reflect on my practice, identify areas for development, and ensure I am working ethically and safely. It is a safeguard for your wellbeing as well as mine.
Clinical will
What happens to your records if I am unable to practise
I have appointed a Clinical Executor who will act on my behalf in the event of my death, serious illness, or incapacity.
If I become unable to continue practising, my Clinical Executor will:
- Contact you to inform you that I am no longer able to provide therapy
- Offer you information about alternative sources of support
- Handle your records in accordance with my data protection policies and professional obligations
- Ensure your records are either securely transferred to another practitioner of your choice, returned to you, or confidentially destroyed according to your wishes and in line with retention requirements
My Clinical Executor is a qualified professional bound by the same confidentiality obligations as I am. They will only access the minimum information necessary to carry out these duties.
Who I share your data with
I take your confidentiality seriously and keep your information within the practice wherever possible. However, I use certain third-party services which may process limited data:
- Clinical supervisor – Receives anonymised case material only (no identifying details)
- Sage – The only information processed for tax and accounting purposes is the financial transactional data visible on bank statements this includes the name or reference used during a bank transfer, the date, and the amount paid for accounting and tax purposes
- Google Analytics – Collects anonymised website usage data
- 123 reg – My website hosting provider, which may collect basic technical data
- Zoom – Video conferencing platform used for online sessions
- Writeupp – Is a secure cloud-based practice-management system, to manage client contact details, appointments, clinical records, forms and invoices. WriteUpp processes this information on my behalf, while I remain responsible for how your personal data is used and protected. Access is limited to authorised individuals only.
- Clinicalwill.app – I store basic client contact information on the encrypted web service so an appointed clinical trustee can safely contact clients in an emergency, sudden illness, or death. I only upload minimal necessary details, such as names, phone numbers, email addresses, and appointment times and not your detailed session or process notes.
Each of these services is bound by a data processing agreement or contract that requires them to protect your data. Links to their privacy policies are available on request.
I never sell your personal data to anyone.
International data transfers
Some of the third-party services I use may transfer personal data outside the United Kingdom:
Google Analytics — Google LLC, USA
Zoom — Zoom Video Communications Inc, USA
The USA does not currently have a UK adequacy decision. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.
You can request a copy of the relevant transfer safeguards by contacting me at claire@serenitycounsellingservice.co.uk
How long I keep your data
I retain your personal data for the following periods:
| Type of record | Retention period | Reason |
| Therapy records 18year old + | 7 years after our last session | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
| Therapy records Under 18 years old | Until client reaches 25 years old | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
| Financial records (invoices, receipts) | 6 years | HMRC legal requirement |
| Website enquiries (non-clients) | 12 months | Legitimate interest in responding to queries |
After the applicable retention period, I destroy records securely:
Paper records are shredded using a cross-cut shredder
Electronic records are permanently deleted using secure deletion software
Your rights under UK GDPR
You have the following rights regarding your personal data:
Right to be informed – I will tell you clearly how I collect, use and protect your data.This privacy policy fulfils that requirement.
Right of access You can request a copy of the personal data I hold about you. This is known as a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search for your data and respond within one month.
Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.
Right to erasure
in certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I need to keep records to comply with professional guidelines or insurance requirements.
Right to restrict processing
You can ask me to restrict how I use your data in certain situations, such as while I investigate a complaint.
Right to data portability
You can request your data in a commonly used electronic format so you can transfer it to another service provider.
Right to object You can object to certain types of processing, although this may not apply where processing is necessary for our contract or for legal compliance.
Rights related to automated decision-making You have the right not to be subject to decisions based solely on automated processing. I do not use automated decision-making in my practice.
To exercise any of these rights, please contact me at claire@serenitycounsellingservice.co.uk
Data protection complaints — your right under the Data (Use and Access) Act 2025
You have the right to make a data protection complaint directly to me. I take all concerns seriously and will respond promptly.
To submit a complaint
Email me at claire@serenitycounsellingservice.co.uk
I aim to acknowledge complaints within 7 days and provide a full response within 28 days.
If you are unhappy with how I have handled your complaint, you can contact the Information Commissioner’s Office (ICO) for further advice or to raise your concerns.
Website: ico.org.uk
Telephone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Confidentiality exceptions
Everything you share with me in therapy is confidential. There may be times when I need to share information without your consent, for example:
- Risk of serious harm – if I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep people safe.
- Safeguarding concerns – if I believe a child or vulnerable adult is at risk of harm, I may need to share relevant information to help protect them.
- Legal requirement – if I receive a court order requiring me to disclose information, or in certain other legal circumstances.
In all cases, I will try to discuss this with you first, unless doing so would itself put someone at risk. I will only share the minimum information necessary and will tell you what I have shared when it is safe to do so.
Get in Touch
If you’re considering counselling, and have questions regarding the Privacy Policy you are very welcome to get in touch.
I offer a free 15 minute telephone consultation where we can talk about what’s bringing you to counselling and whether I’m the right person to support you.