Introduction 

The General Data Protection Act came into force on May 25th 2018 and in compliance with this, I need to let you know the personal details I collect from you, if you are, or were to become a client, as well as how I store, hold, process and destroy them. 

As a client, when you attend an initial consultation with me, we begin by setting a working agreement that explains my commitment to client confidentiality and data protection, as well as when confidentiality may be breached. You will need to sign this agreement before we commence therapy. 

I will collect personal details from you, as listed below:  

• Name (in the case of under 18s I will also take a parent or guardian’s name) 

• Date of birth 

• Address 

• Contact number (for under 18s I will take a parent or guardians contact number too) 

• Email address 

• Contact details for an emergency contact for use if something were to happen to you on my premises 

• Contact details for your GP, for use with your permission 

• Details of any relevant mental or physical health issues and medication 

Storage of Personal Details 

The above personal details are stored electronically, accessed only by me. They are stored separately from any case notes (brief summaries of counselling sessions).  

Case notes (brief summaries of counselling sessions) are also stored electronically, accessed only by me. 

I keep an electronic diary to manage my appointments. 

I use a mobile phone for the receipt of client phone calls and text messages. I do not hold your number in my contacts under your full name, and my phone is password protected.  

I use a password protected laptop for receipt of client emails. This email account is separate from my personal email account.  

My website does not store any of your personal information.  

Deletion of your Personal Details  

I will keep your personal details for one month after counselling has ended in case we have any outstanding administrative issues, or you choose to return. They are then deleted. 

Your case notes (summaries of sessions) are kept for 2 years in case you choose to return, and are then deleted. 

Any text messages (sent and received) and any emails (sent and received) will also be deleted one month (or earlier) after counselling has ended.  

Sharing of Personal Details 

Supervision: In line with the requirements of my professional body, the British Association for Counselling and Psychotherapy, my work is regularly supervised by a qualified supervisor. Their role is to ensure that I work ethically and professionally. You are referred to by your first name only in supervision, and conversations between my supervisor and me are confidential. 

Therapeutic Will: I have appointed a Therapeutic Executor to attend to my clients in the event of my demise. This Executor is a qualified therapist who is also a member of the British Association for Counselling and Psychotherapy, and therefore committed to client confidentiality. They would contact you to let you know of my demise, and to offer you support where appropriate. My Executor is also responsible for the deletion of all case notes and personal details in this event. 

Exceptions to Confidentiality: If I have reason to believe that you or someone else is at risk of serious harm, I will break confidentiality. I would endeavour to discuss this breach with you first, so that we can come to an agreement about who needs to be informed. However, if an agreement is not reached and I still believe that you or someone else is at risk, I will discuss the situation with my supervisor and decide how to proceed. Where a threat of terrorism, money laundering or drug trafficking is disclosed, I am obliged by law to inform the authorities.

How to raise a Data Protection Concern

If you have any questions, concerns, or complaints about how I handle, store, or process your personal data (including session notes or contact information), you have the right to raise this directly with me.

To submit a formal data protection complaint, please contact me in writing via email at rob@routestowellness.co.uk or by post to The Exeter Wellbeing Hub, 45 Queen Street, Exeter, EX4 3SR.

• Acknowledgement: I will formally acknowledge your complaint within 30 days of receiving it.

• Resolution: I will investigate your concern thoroughly and provide a full written response or progress update without undue delay, and at the latest within three months.

• Escalation: While you retain the right to escalate any data issues to the Information Commissioner’s Office (ICO) at any time, the law expects that you attempt to resolve the matter through my internal complaints procedure first. If you remain dissatisfied with my final response, you can contact the ICO via their website (ico.org.uk) or by calling 0303 123 1113.

Note: In accordance with UK law, a secure administrative record of any data protection complaints will be safely retained for six years from the date of resolution

Recognised Legitimate Interests and Saefguarding

Under the Data (Use and Access) Act, certain processing activities are classified as Recognised Legitimate Interests. This means I am legally permitted to process or share specific data without your prior consent or a formal balancing test if it is strictly necessary for:

• Safeguarding: Protecting vulnerable individuals, including children or adults at risk of significant harm.

• Emergencies: Responding to an immediate crisis, threat to life, or medical emergency.

• Crime Prevention: Assisting in the detection, investigation, or prevention of a serious crime (such as a direct request from law enforcement).

This aligns with my professional ethical framework regarding the limits of therapeutic confidentiality.

Requesting Access to your Records (Subject Access Requests)

You have the right to request a copy of the personal data and session records I hold about you.

• Proportionality: When responding to a request, I will conduct a reasonable and proportionate search of my digital and physical files to locate your information.

• Clarification ("Stop the Clock"): If your request is broad, or if I require further specific information from you to identify the exact records you need, I may contact you to clarify your request. By law, the statutory one-month response deadline will be paused ("stopping the clock") from the day I request this clarification and will resume once you provide the necessary details

International Data Transfers

Some of the digital tools and platforms I use to manage my practice, process payments, or secure backup records may store data on servers located outside of the United Kingdom (for example, in the United States or the European Economic Area).

Where data is transferred outside the UK, I ensure it complies with the statutory Data Protection Test. This means your data is only transferred to jurisdictions or providers whose data protection laws and practices have been assessed as "not materially lower" than the standards established within the UK, or where robust standard contractual clauses and encryption safeguards are actively enforced.

Cookies and Website Analytics

My website uses low-impact cookies strictly for statistical and performance analytics (such as understanding which pages are visited most frequently) to help me improve my online presence. In accordance with updated ePrivacy rules, these analytics cookies do not track your personal identity and do not require your explicit opt-in consent before running. However, you retain an absolute right to object. You can adjust your browser settings to reject all cookies or use the opt-out link provided on the site at any time free of charge.

Your Rights 

In accordance with GDPR, you have the following rights: 

• To be informed of the information that I store about you 

• To ask to see the information that I hold about you (please provide one month’s notice) 

• To ask that I rectify any information that you deem inaccurate, unnecessary or incomplete (if I need to keep a record to comply with legal requirements than I may decline this request) 

If you have any questions about any aspect of this privacy policy, my contact details are as follows: 

Mobile:           07563 013256 

Email:              rob@routestowellness.co.uk 

Counselling is confidential. Sometimes you may wish to let someone know you are seeing a counsellor but that is your decision. 
 
In between counselling sessions I will never telephone you unless you are happy for me to do so. If we meet outside of the counselling room I will not acknowledge you unless again you are comfortable with that. 
 
Times when confidentiality may need to be broken are within the Counselling Agreement and we will discuss this in the initial consultation in full.