Your privacy, in plain English

I am the data controller for everything described here. That means the decisions about what is collected and why are mine, and so is the responsibility for them.

Alison Woodward, Psychotherapeutic Counsellor, Registered Member MBACP, practising at Chapter House, 11 Preston Road, North Shields, NE29 0LU. You can reach me at alison@alisonwoodward.com or on 07355 371467. There is no data protection officer: this is a one-person practice, and I deal with these questions myself.

Contact details. When you enquire or book, I keep your name, email address and phone number, simply so I can reply to you, confirm appointments, and reach you if something changes.

Appointment records. I keep a record of the sessions you attend, with dates, times, fees and payments, because I need it to run the practice properly and to meet ordinary accounting obligations.

Nothing extra. I don’t ask for information I don’t need, and I never collect anything for marketing purposes.

Data protection law asks me to name the grounds I rely on. In plain terms: I need your details to do the thing you have asked me to do, and I need to keep proper records of it.

To arrange and provide your sessions. Booking, confirming, moving and invoicing an appointment is the contract between us, so I rely on that (UK GDPR Article 6(1)(b)).

To answer an enquiry. If you write to me and never become a client, there is no contract yet. I rely on my legitimate interest in replying to someone who has asked me a question (Article 6(1)(f)), and I keep it only as long as set out below.

To meet obligations I cannot opt out of. Fees, payments and invoices have to be kept for tax and accounting purposes (Article 6(1)(c)).

For anything about your health. What you tell me in a session, and the brief notes I make from it, are what the law calls special category data and need a second, stricter condition. I rely on the one written for exactly this situation: the provision of health care and treatment by a professional who owes you a duty of confidence (Article 9(2)(h), with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018). That duty is the BACP Ethical Framework I work to, and it is not something I can set aside because it would be convenient.

Where I do ask for consent, for example to text you a reminder, it is a genuine choice: refusing it changes nothing about the counselling you receive, and you can withdraw it at any time.

Clinical notes. Deleted automatically 90 days after they are written. I can extend that for a note I still need while we are working together, and when I do, the clock simply starts again.

Enquiries. Deleted automatically after 90 days. If an enquiry becomes a booking, the client record that follows has its own life, described below.

Conversations with the assistant on this site. If you are signed in, they are kept for 30 days and then deleted. If you are not signed in, they are never stored at all.

Appointments, invoices and payments. Kept while you are a client and then for the period my professional insurance and HMRC require, which is the reason these cannot simply be deleted on request.

Email. Messages between us stay in the practice mailbox, and a copy is held in the practice system so your correspondence sits alongside your record. Ask me to clear it and I will, unless it is part of something I am obliged to keep.

When you send an enquiry, create an account or book a session, what you type is sent to and stored on servers I use to run the practice. It does not stay on your device.

A small number of companies process it on my behalf. The records themselves are held in a Supabase database hosted in London. The site is served by Vercel. The practice mailbox, which is where email between us actually lives, is hosted by Hostinger. Each acts only on my instructions, and none of them uses your information for their own purposes. Access to the practice system is restricted to me, through my own account.

Assistant. If you use the assistant on this site, what you type is sent to Anthropic to produce a reply, and is not used to train anything. It has no access to clinical notes, and no access to anybody’s account but your own.

Visitor numbers. I use Vercel’s privacy-friendly analytics to see how many people visit which pages. It sets no cookies, does not follow you between sites, and does not build a profile of you. I cannot tell from it who you are.

Paper materials, where they exist, are kept in locked storage.

What you share with me stays between us. I don’t discuss clients with family, friends or other professionals, and I take care to protect your privacy even in small, everyday ways, like how I answer the phone.

Like every ethical therapist, I work within a small number of limits, and I’d rather you knew them from the start:

• If I believed you, or someone else, were at serious risk of harm, I might need to involve another service to keep you or them safe. Wherever humanly possible, I would talk with you first.
• In rare situations the law requires disclosure, for example a court order or certain serious offences. These situations are genuinely uncommon.
• I discuss aspects of my work in regular clinical supervision, as all BACP practitioners do, always without identifying details.

We go through all of this together, clearly and unhurriedly, in your first session, and you’re welcome to ask about it at any point.

After sessions I write brief, factual notes to support the work. They are encrypted before they are stored, which means that even someone with access to the database cannot read them without a key that is held separately.

Notes are deleted automatically 90 days after they are written. I can choose to extend an individual note if the work is ongoing and it is still needed, but nothing is kept indefinitely, and anything not extended is destroyed on schedule.

Only I can read them. They are never visible to anyone else with an account on this site.

Under UK data protection law (UK GDPR), you can at any time:

• ask for a copy of the information I hold about you;
• ask for anything inaccurate to be corrected;
• ask for your information to be deleted, subject to the retention obligations above;
• withdraw any consent you've given, without needing to give a reason;
• raise a concern with the Information Commissioner's Office (ico.org.uk) if you feel your information has been mishandled.

Just ask, in person, by email or by phone. There’s no form to fill in and no charge.

This site uses no advertising or tracking cookies of any kind. The only storage it uses is the essential, local kind that makes the site work, such as remembering that you’re signed in to your account on this device.

Privacy shouldn’t feel like small print. If anything here is unclear, or you’d like to know more before getting in touch, please just ask.