Privacy Policy

Last updated: 17 June 2026

Who am I ?

Andrea Barratt Counselling is a private counselling practice run by me, Andrea Barratt. I am a qualified counsellor and registered member of NCPS, bound by their ethical framework and code of practice.

If you have any questions about how I handle your personal data, you can contact me at andreabarrattcounselling@hotmail.com

What personal data do I collect?

I collect and process the following types of personal information:

Contact and administrative details:

Your name, date of birth, address, telephone number, and email address
Emergency contact details
GP details

Therapy-related information:

Your presenting issues and reasons for seeking therapy
Relevant medical and mental health history
Information about your personal circumstances, relationships, and background
Session notes documenting our work together
Any correspondence between us

Special category data

Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This includes information about your mental and physical health, and the content of our therapeutic work. This data receives enhanced legal protection, and I take particular care to keep it secure and confidential.

Website enquiries

If you contact me through the contact form on my website, I collect your name, email address, and any information you include in your message.

How we collect your data

I collect personal data directly from you:

When you first contact me to enquire about therapy
During our initial consultation and assessment
Throughout our therapy sessions
Via email, telephone, or video communication
Through forms you complete as part of the intake process

I do not collect personal data about you from third parties unless you have given explicit consent, or you have been referred through an Employee Assistance Programme (EAP), in which case limited information may be shared as part of that arrangement.

Why I process your data — lawful basis

I process your personal data on the following legal bases under UK GDPR:

Article 6 basis (ordinary personal data):

Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your counsellor, we enter into a contract for the provision of therapy services. I need to process your personal data to fulfil that contract.

Article 9 basis (special category data):

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional DPA 2018 Schedule 1 condition is Part 1, paragraph 2 (health or social care). Processing is carried out by a qualified counsellor subject to the professional obligation of confidentiality under the ethical framework of NCPS.

Professional obligations and CPD

I am required by NCPS to attend regular clinical supervision. This is an essential part of maintaining professional standards and ensuring I provide you with the best possible care.

When I discuss my therapeutic work with my supervisor:

Your full name and any identifying details are NOT shared with my supervisor
I use anonymised or pseudonymised case material only
My supervisor is a qualified professional bound by the same confidentiality obligations as I am
My supervisor is bound by their own professional body's ethical framework

Supervision supports my professional development and helps me reflect on my practice. It is not a breach of your confidentiality.

Who I share your data with

Third parties with access to limited data:

Clinical supervisor — receives anonymised case material only; no identifying details are shared
External bookkeeper/accountant — has access to invoice data only (your name and payment information for financial record-keeping purposes)
EAP or referral platform — where you have been referred through an Employee Assistance Programme, limited information may be shared as part of the commissioning arrangement. This is explained to you at the point of referral

Website and technology providers:

I use the following third-party services which may process limited data:

Google Analytics — to understand how visitors use my website
Sentry — for website error monitoring
Wix — my website hosting platform
Whereby.com — for online video sessions

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

I never sell your personal data.

International data transfers

The following third-party services I use may transfer personal data outside the United Kingdom:

Google Analytics (Google LLC, USA)
Sentry (Functional Software Inc, USA)
Wix (Wix.com Ltd, Israel)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025. The USA does not currently have a UK adequacy decision.

Whereby.com may also transfer data internationally. For specific details on their data handling practices and applicable safeguards, please refer to their privacy policy.

How long do I keep your data ?

I retain your personal data for the following periods:

Therapy records

6 years after our last session

In line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Financial records

6 years

HMRC legal requirement

Website enquiries (non-clients)

12 months

Legitimate interest in responding to enquiries

After the applicable retention period, records are securely destroyed. Paper records are disposed of by secure shredding.

Your rights under UK GDPR

You have the following rights regarding your personal data. I will respond to any request within one month.

Right to be informed — You have the right to know how I collect and use your personal data. This privacy policy fulfils that obligation.

Right of access — You can request a copy of the personal data I hold about you. This is known as a Subject Access Request. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data.

Right to rectification — If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure — In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I am required to retain records to comply with professional guidelines or insurance requirements.

Right to restrict processing — You can ask me to limit how I use your data in certain circumstances.

Right to data portability — You can ask me to provide your data in a structured, commonly used format so you can transfer it to another service.

Right to object — You can object to processing based on legitimate interests. However, most of my processing is based on contract and health purposes, so this right has limited application.

Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice.

To exercise any of these rights, please contact me at andreabarrattcounselling@hotmail.com

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate and respond promptly.

To make a complaint:

Contact me at andreabarrattcounselling@hotmail.com

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are limited circumstances where I may need to break confidentiality:

Risk of serious harm — If I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services
Safeguarding concerns — If I become aware of concerns about a child or vulnerable adult being at risk of abuse or neglect
Legal requirement — If I receive a court order requiring me to disclose information

I will always try to discuss this with you first, unless doing so would itself put someone at risk.

Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make any significant changes that affect how your data is processed, I will inform you directly.