Private Policy

1. Who we are

This privacy policy explains how Heather Oglesby Counselling collects, uses, stores, and protects your personal information. I am Heather Oglesby, and I am the data controller for all personal information processed through this practice.

If you have any questions about this policy or how your data is handled, please contact me at heatheroglesbycounselling@gmail.com
________________________________________

2. What personal data we collect

I collect and process the following types of personal information:

Contact and identity information:

• Your name, address, telephone number, and email address

• Emergency contact details (if you choose to provide them)

Therapy-related information:

• The reason you are seeking therapy (your presenting issues)

• Information about your mental and emotional health

• Relevant medical history that you share with me

• Your GP's details (if you choose to provide them)

• Brief session notes recording our therapeutic work together

Administrative information:

• Invoices and payment records

• Appointment dates and times

• Our therapeutic contract

Website enquiries:

• Your name and email address when you submit our contact form

• The content of your message

Important: Much of the information I collect about you — particularly information relating to your mental health, emotional wellbeing, and any physical health conditions you share with me — is classified as special category data under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection, and I take particular care to keep it secure and confidential.
________________________________________

3. How we collect your data

I collect your personal information directly from you:

• When you first contact me to enquire about therapy (by phone, social media or email)

• During our initial consultation and assessment

• Throughout our therapeutic work together, during sessions

• When you provide updates or additional information between sessions

• Through any email or telephone communication we have

I do not collect information about you from third parties without your knowledge and consent.
________________________________________

4. Why we process your data — lawful basis

Under data protection law, I must have a lawful basis for processing your personal information. I rely on the following legal grounds:

For general personal data (Article 6 UK GDPR):
I process your personal data under Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services to you. Processing your personal data is essential for me to fulfil that contract.

For special category health data (Article 9 UK GDPR):

Because therapy involves processing sensitive health-related information, I also rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care) is also met. I am a qualified counsellor/psychotherapist and a member of NCPS. I am bound by a duty of confidentiality under BACP's Ethical Framework for the Counselling Professions. This professional obligation ensures your sensitive information is handled with the highest standards of care.
________________________________________

5. Professional obligations and CPD

As a member of NCPS, I am required to attend regular clinical supervision. This is an essential part of maintaining safe and effective practice, and it supports the quality of therapy I provide to you.

When I discuss our therapeutic work with my supervisor:

• Your name and any identifying details are not shared with my supervisor

• I use anonymised or pseudonymised case material only — this means I discuss the therapeutic themes

and my clinical approach without revealing who you are

• My supervisor is a qualified professional bound by the same confidentiality obligations as I am

• My supervisor is also bound by their own professional body's ethical framework

Clinical supervision helps me reflect on my practice, ensures I am working safely and ethically, and ultimately benefits the therapy I provide to all my clients.
________________________________________

6. Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor — a trusted fellow therapist — who will act on my behalf if I become suddenly unable to practise due to serious illness, incapacity, or death.

If this situation arises, my Clinical Executor will:

• Contact you to inform you that I am no longer able to continue our work together

• Offer you information about finding another therapist if appropriate

• Handle your records in accordance with this privacy policy and my professional obligations

• Ensure the secure storage or destruction of your records in line with the retention periods set out in this policy

My Clinical Executor is bound by professional confidentiality and will only access the minimum information necessary to carry out these duties. They will not read your detailed session notes unless absolutely necessary for the proper handling of your records.
This arrangement ensures continuity of care and proper data protection even in unexpected circumstances.
________________________________________

7. Who we share your data with

Your personal information is kept confidential. I do not share your data with anyone except in the limited circumstances described below.

Third-party service providers:

I use the following third-party services in the running of my practice, and they may process limited amounts of your data:

• Wix — website hosting and building platform; may collect certain technical data about visitors including basic analytics

• Zoom — video platform for online therapy sessions

Each of these services is bound by their own privacy policies and data protection obligations. I have reviewed their practices to ensure they meet appropriate standards. Links to their privacy policies are available on request.

Clinical supervision:
As explained in section 5, I discuss my therapeutic work with my supervisor using anonymised material only. Your name and identifying details are not shared.

I never sell your personal data.

Other disclosures:
I may be required to share information in the limited circumstances described in section 12 (Confidentiality exceptions).
________________________________________
8. International data transfers

Some of the third-party services I use may transfer your personal data outside the United Kingdom:
• Zoom (Zoom Video Communications Inc) — USA

The United States does not currently have a UK adequacy decision, which means it is not automatically recognised as providing an equivalent level of data protection to the UK.
Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards. These are legal mechanisms approved under UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025 to ensure your data remains protected when transferred internationally.

You can request a copy of the relevant transfer safeguards or additional information from me at any time by contacting Heather at heatheroglesbycounselling.co.uk
________________________________________

9. How long we keep your data

I keep your personal information only for as long as necessary. The retention periods are:

Therapy records - 7 years after our last session - In line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Financial records (invoices, payment records) - 6 years - Legal requirement under HMRC rules

Website enquiries (if you do not become a client) - 12 months - To respond to your enquiry and for a reasonable follow-up period

How records are stored:
Your therapy records — including session notes and any written clinical material — are kept as paper records only. These are stored in a locked filing cabinet in a secure room at my practice premises. Only I have access to these records.

How records are destroyed:
At the end of the applicable retention period, paper records are destroyed by secure shredding. Financial records held electronically are permanently deleted.
________________________________________

10. Your rights under UK GDPR
You have the following rights regarding your personal data. I have explained each one in plain language:

Right to be informed You have the right to know how your data is being used. This privacy policy fulfils that right.

Right of access (subject access request) You can ask me for a copy of the personal information I hold about you. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information. I will respond within one month.

Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure (right to be forgotten) In some circumstances, you can ask me to delete your personal data. However, this right does not apply where I am required to keep records for professional or legal reasons — for example, to comply with the retention periods set out in this policy or for professional indemnity insurance purposes.

Right to restrict processing You can ask me to limit how I use your data in certain circumstances — for example, while a complaint is being investigated.

Right to data portability You can ask me to provide your data in a commonly used electronic format so you can transfer it to another service. This right applies to data you have provided to me and which I process based on our contract.

Right to object You can object to certain types of processing. This is unlikely to apply to therapy records, which are processed under our contract and for healthcare purposes.

Rights related to automated decision-making You have the right not to be subject to decisions based solely on automated processing. I do not use automated decision-making in my practice — all decisions about your therapy are made by me personally.

To exercise any of these rights, please contact Heather at heatheroglesbycounselling.co.uk
I will respond to your request within one month. There is no fee for most requests, although I may charge a reasonable fee if a request is clearly excessive or repetitive.
________________________________________

11. Data protection complaints — your right under the Data (Use and Access) Act 2025

If you have concerns about how I have handled your personal data, you have the right to make a data protection complaint directly to me.

To make a complaint:

• Contact me by email at heatheroglesbycounselling@gmail.com

I take all complaints seriously and will respond promptly. I aim to resolve any concerns within 30 days.

If you are not satisfied with my response:
You have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator:

• Website: ico.org.uk

• Telephone: 0303 123 1113

• Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
________________________________________

12. Confidentiality exceptions

Everything you share with me in therapy is treated as confidential. However, there are rare and specific circumstances where I may need to share information without your consent:

• Risk of serious harm: If I believe there is a serious and imminent risk that you may harm yourself or someone else, I may need to contact appropriate services to help keep you or others safe.

• Safeguarding concerns: If I become aware of concerns about the safety of a child or a vulnerable adult, I have a legal and ethical duty to report this to the appropriate authorities.

• Court order: If a court of law orders me to disclose information, I am legally required to comply.
In almost all cases, I will try to discuss the situation with you first and involve you in any decisions about sharing information. The only exception would be if doing so would itself put someone at risk of harm.

If I ever need to break confidentiality, I will only share the minimum information necessary and only with the people who need to know.
________________________________________
13. Changes to this policy

I review this privacy policy annually and whenever my practices change significantly.
If I make any significant changes that affect how your personal data is handled, I will inform you directly — for example, by email or at your next session.

The date at the top of this policy shows when it was last updated.