Privacy Policy
Last updated 14 August 2026
GDPR Statement
Legal Basis for Collection and Processing of Personal Data
In accordance with the UK General Data Protection Regulation (UK GDPR) and the BACP Ethical Framework for the Counselling Professions (points 10, 55–57), I am committed to protecting your personal information through transparent, lawful, and ethical data processing practices.
As your counsellor or supervisor, I collect, store, and process personal data under the legal basis of contract (to fulfil our counselling or supervision agreement), legitimate interests (to practice safely, ethically, and professionally), and legal obligation (e.g. supervision, HMRC reporting).
This statement outlines the data I hold, storage methods, sharing practices, retention periods, and your rights.
Why I Process Your Data – Lawful Basis
Under the UK GDPR, I must have a valid legal reason (known as a “lawful basis”) to process your personal information. Because counselling and supervision involve sensitive health information, I need to meet two separate legal requirements:
Article 6 – General Personal Data
I process your personal data under Article 6(1)(b) UK GDPR. Processing is necessary for the performance of the therapeutic or supervisory contract between us. This means I need to process your information to provide the counselling or supervision service you have engaged me for. Without this information, I could not offer you safe and effective therapy or supervision.
Article 9 – Special Category Health Data
I process your health-related data under Article 9(2)(h) UK GDPR. Processing is necessary for the provision of health or social care treatment by a health professional.
The additional condition required under UK law is found in the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care). This condition applies because:
I am a qualified counsellor and supervisor providing health related treatment
I am bound by a professional obligation of confidentiality under the BACP Ethical Framework (2018 & 2025)
The processing is necessary for me to provide you with counselling or supervision safely and effectively
Note-Keeping and Access to Records
Session notes, correspondence, consent forms, contracts, assessments, and related records are kept solely for clinical purposes and professional development.
You may request access to your records informally or formally under your subject access rights (Article 15 UK GDPR). I will respond within one month, free of charge for the first request.
Personal Information Collected
Relationships and progeny
Occupation
Address
Telephone / SMS number (with permission for SMS/voicemail)
Email
Counselling history
GP and next-of-kin details
Relevant health information, medical conditions, and medication
Assessment information (physical symptoms, sleep, mood/emotions, neurodivergence, anxiety, relationships, self-harm/suicidality/risk/safeguarding, addictions, sexuality/sexual health, trauma, cognitions, concentration, OCD, nutrition, life circumstances, identity, culture/spirituality)
Reasons for therapy
Brief session summaries
Your health and therapy-related information is classified as “special category data” under Article 9(1) UK GDPR and receives enhanced legal protection.
As a Supervisor
To provide effective supervision, I also collect the following about supervisees:
Supervisee practice details
Supervisee contact details and registrations
Information about registration with ICO (for GDPR)
Professional body/bodies you are registered with, along with registration(s) or membership number(s)
Insurance company information
Details about whether you hold an up-to-date DBS Certificate
Information about qualifications, training, CPD, and ongoing development
Details will be held on client work and supervision work, but information discussed and recorded in supervision will be anonymised.
I collect information directly from you during initial contact, assessment or intake sessions, and throughout our therapeutic or supervisory work. I do not collect information from third parties unless you give explicit consent, or in exceptional circumstances where it is necessary to protect safety.
Storage Methods
Paper:
All clinical and supervision records including notes, consent forms, contracts, assessments, and client codes are stored securely in locked filing cabinets.
Electronic:
No clinical or supervision records are held electronically. No session notes, therapy records, or supervision records are stored on computers, devices, or cloud services.
Session booking and administrative emails are deleted once no longer needed (e.g. after printing contracts or confirming appointments), in line with data minimisation (Article 5(1)(c)).
No personal data is stored on my website. Signed contracts exist as the authoritative paper record only.
Processing, Sharing, Professional Obligations and Supervision
Data may be processed as follows:
As a BACP Accredited member, I am required to discuss my clinical work in professional supervision. This is an essential part of maintaining high standards of care and ensuring that I am working ethically and effectively. Your identity is protected in supervision. My clinical supervision (as a counsellor) includes anonymised discussion (using initials only) with a qualified supervisor for ethical practice and development (BACP requirement). I do not share your name or any identifying details with my supervisor. My supervisor receives only anonymised case material and is bound by their own professional body’s confidentiality obligations.
Supervision (as supervisor): I discuss supervisees’ client work in supervision sessions. Details are held on client work and supervision work, but information is anonymised where possible. Your name and identifying details are not shared unless necessary for safeguarding or legal reasons.
HMRC/Accounting: Name and payment details shared solely for tax compliance as a UK taxpayer.
How long I keep your data
I retain your information for different periods depending on its type:
Therapy records - 7 years after our last session. In line with the limitation act 1980 and standard professional indemnity insurance requirements
Financial records (invoices, receipts)- 6 years. Legal requirement under HMRC rules
Clinical Will
In the event of my death or incapacitation, your name and contact details may be shared with my Therapeutic Executor (a qualified counsellor/supervisor) to assist with notifying my clients and supervisees' and arranging onward support or referral if needed.
Arrangements are in place to ensure that a designated professional colleague can:
Securely access my client and supervisee records
Contact you to let you know what has happened
Arrange onward referral if appropriate
Ensure your records are stored or destroyed in accordance with this policy
Emergencies
Contact details may be shared with emergency services or your GP if your health is at imminent risk.
I will always try to discuss this with you first, unless doing so would itself put someone at risk. If I ever need to break confidentiality, I will share only the minimum information necessary and only with the appropriate people.
There are rare legal exceptions where disclosure may occur without informing the client first, primarily driven by statutory obligations that override ethical norms to prevent serious harm or crime. These are mandated by UK law. Legal mandates prohibiting client notification include:
Terrorism-related disclosures and statutory obligations may require disclosure without prior consent or notification in exceptional cases (e.g. Terrorism Act 2000, court orders). Under the Terrorism Act 2000 (section 19).
Drug trafficking: The Misuse of Drugs Act 1971, and Proceeds of Crime Act 2002 Money laundering, the Proceeds of Crime Act 2002. Under specific circumstances, I may also break confidentiality in relation to a violation of any abuse of a minor in accordance with The Children’s Act 1989/2004 and any associated legislation.
Data Retention and Erasure
Paper records are retained for five years of post-therapy (or from age 18 for minors) to support continuity of care and legitimate interests (BACP guidance), then securely destroyed by shredding.
Supervision records are retained for five years after the last supervision session, in line with professional and BACP guidance.
Emails are permanently deleted immediately after any necessary action (e.g. printing signed contracts, noting appointments), per storage limitation (Article 5(1)(e)).
Signed contracts exist as the authoritative paper record only.
Your Rights Under UK GDPR
Right to be informed (this document)
Right of access (subject access request)
Right to rectification of inaccurate data
Right to withdraw consent (where applicable; note this may impact service delivery and I may decline whilst the information is needed for me to practise lawfully and competently)
Right to erasure (“right to be forgotten”), subject to exemptions for legal and professional obligations
To exercise any of these rights, please contact me in writing. I aim for full transparency in data practices.
Data Protection Complaints
If you have any concerns or complaints about how I collect, store, use, or otherwise process your personal data or session notes, please contact me in writing at: jessica@freebird-counselling.co.uk
I will acknowledge your complaint within 30 days and will investigate it promptly, providing you with a clear response and any actions taken without undue delay.
If you remain dissatisfied with my response, you may refer your complaint to the Information Commissioner’s Office (ICO) at: https://ico.org.uk
Under the Data (Use and Access) Act 2025, you also have the right to complain directly to the Information Commissioner's Office (ICO) if you are not satisfied with my response:
Website: ico.org.uk
Telephone: 0303 123 1113
Jessica Clare Hunter
ICO registration: ZC213944.
This page explains how Jessica Hunter Freebird Counselling collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.
I am Jessica Hunter, a qualified and accredited counsellor and supervisor in private practice.
I am registered with the Information Commissioner’s Office (ICO) under registration number ZC213944.
Contact: jessica@freebird-counselling.co.uk
Website: https://freebird-counselling.co.uk/
Contact
Qualified integrative and psychotherapeutic counsellor working with adult individuals and couples
© 2026. All rights reserved.
Connect
Bupa registered
Provider no: 30050269