GDPR Statement

Last updated: 17 June 2026

Our Commitment to Your Privacy

At Andrea Barratt Counselling, I believe that protecting your personal information is a fundamental part of the trust between us. Therapy works best when you feel safe, and that safety extends to how I handle your data. This statement explains, in plain terms, what information I collect, why I need it, and how I look after it.

What Information I Collect

When you work with me, I may collect and keep:

Your name and contact details (phone number, email address, home address)
Details about what brings you to therapy (your presenting issues and concerns)
Session notes recording our work together
Relevant medical or mental health history that you share with me
Emergency contact information
Payment and invoicing information

Why I Collect This Information

I need to collect and use your information for two main reasons under UK data protection law:

For providing therapy services: Under Article 6(1)(b) UK GDPR, processing your information is necessary for me to fulfil our therapeutic contract — in other words, I cannot offer you therapy without keeping some record of our work together.

For health-related information: Because therapy involves sensitive health data, I rely on Article 9(2)(h) UK GDPR, which permits processing for health care treatment by a health professional. The additional legal condition is DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care).

Professional Obligations and Supervision

As a qualified counsellor, I am required to discuss my clinical work in professional supervision. This is an essential part of maintaining safe, effective practice.

Your identity is protected: I do not share your name or any identifying details with my supervisor. My supervisor receives anonymised case material only — they will not know who you are. My supervisor is also bound by their own professional body's confidentiality obligations.

Who Else May See Your Information

Beyond myself, the following people or services may have limited access to some of your information:

My clinical supervisor — receives anonymised case material only (no identifying details)
My bookkeeper — has access to invoice data only for accounting purposes
Employee Assistance Programme (EAP) — where you have been referred through your employer's EAP, limited information may be shared as part of the commissioning arrangement
Website service providers — Google Analytics, Sentry, Wix, and Whereby.com process limited technical data as part of delivering their services
Statutory authorities — only where I am legally required to share information

When I Might Need to Break Confidentiality

Everything you share with me is confidential, with a few important exceptions. I may need to share information without your consent if:

There is a serious risk of harm to you or someone else
There are concerns about the safety of a child or vulnerable adult
A court orders me to disclose information

Wherever possible, I will always try to discuss this with you first before sharing anything.

How Long I Keep Your Records

I keep your therapy records for 6 years after our last session. This timeframe is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

Your records are kept as paper notes in a locked filing cabinet in a secure room. Only I have access to this cabinet. At the end of the retention period, paper records are securely shredded.

Your Rights

Under UK GDPR and the Data (Use and Access) Act 2025, you have the right to:

See your records — you can ask me for a copy of the information I hold about you
Correct errors — if anything I have recorded is inaccurate, you can ask me to put it right
Request deletion — in some circumstances, you can ask me to delete your information, though I may need to keep certain records for legal or insurance reasons
Object to processing — you can object to how I use your data in certain situations
Data portability — you can ask for your data in a format that can be transferred elsewhere

If you would like to exercise any of these rights, simply get in touch with me.

Making a Complaint

If you are unhappy with how I have handled your information, please contact me first so I can try to resolve the issue:

Email: andreabarrattcounselling@hotmail.com

Under the Data (Use and Access) Act 2025, you also have the right to complain directly to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113