Privacy Notice

1. Introduction

At ELM Counselling, your privacy and trust are very important to me. This privacy notice explains how I collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

I am committed to maintaining confidentiality and ensuring that your personal data is handled lawfully, fairly, and transparently.

2. Who I Am

Data Controller: ELM Counselling
Counsellor: Emma Marlow
Email: emma@elm-counselling.com
Phone: 07493 051255
ICO Registration Number: ZB661985

3. The Information I Collect

I collect and process the following types of personal information:

• Contact information: name, address, phone number, and email address.
• Personal details: date of birth, GP details, emergency contact information.
• Therapy-related information: notes taken during or after sessions, relevant background history, and information you choose to share as part of the counselling process.
• Administrative information: payment records, appointment scheduling, and correspondence.

I will only collect information that is necessary for the delivery of counselling services.

4. How I Use Your Information

Your personal data is used to:

• Provide counselling services and support.
• Maintain accurate records of our work together.
• Communicate with you about appointments or relevant updates.
• Fulfil legal, ethical, and professional obligations (for example, record keeping required by professional bodies such as the BACP or NCPS).
• Manage payments and business administration.

I do not use your data for marketing purposes, nor do I share it with third parties for any form of advertising or profiling.

5. Use of Video Doorbell and Recordings

For safety, security, and safeguarding purposes, a video doorbell is installed at the entrance to the premises.

The video doorbell captures video footage and/or audio of visitors approaching or leaving the property. This recording is used solely to ensure the safety of both clients and the practitioner and to protect property.

Recordings are stored securely, accessible only to the data controller, and automatically deleted after a short retention period unless required for security or legal reasons.

Footage is not used for any monitoring of clients or sessions and is never shared with third parties, except where required by law (for example, at the request of law enforcement).

By attending appointments, visitors acknowledge that brief external footage may be captured on entry and exit.

6. Lawful Basis for Processing

Under the UK GDPR, I rely on the following lawful bases:

• Contract: To deliver counselling services you have requested.
• Legal  obligation: To meet legal and professional record-keeping requirements.
• Legitimate interests: For the running of a safe and effective counselling      practice, including security measures such as the video doorbell.
• Consent: For holding and processing sensitive information (special category data) shared during therapy sessions.

You have the right to withdraw consent at any time.

7. How Your Information is Stored

All records are stored securely:

• Paper records (if any) are kept in a locked filing cabinet.
• Electronic records are stored on password-protected and encrypted devices.
• Emails are managed via a secure, password-protected account.
• Video doorbell recordings are stored securely in a password-protected system and deleted after a limited retention period.

Records are retained for seven years after therapy ends (in line with professional guidance) and then securely destroyed.

8. Confidentiality and Sharing

Everything you share in counselling is confidential, except in specific circumstances where I have a legal or ethical duty to break confidentiality, such as:

• If you disclose that you or someone else is at serious risk of harm.
• If required by a court of law.
• If there are concerns about safeguarding children or vulnerable adults.

Where possible, I will always discuss this with you before taking action.

9. Your Rights

You have the following rights under data protection law:

• To access a copy of the personal information I hold about you.
• To request correction of inaccurate or incomplete information.
• To request deletion of your data (in certain circumstances).
• To restrict or object to the processing of your data.
• To request transfer of your data to another provider (data portability).

To exercise these rights, please contact me using the details above.

10. Complaints

If you have concerns about how your information is handled, please contact me directly so I can address them.
If you remain dissatisfied, you can contact the Information Commissioner’s Office (ICO):
www.ico.org.uk
Telephone: 0303 123 1113

11. Updates to This Notice

This privacy notice is reviewed regularly and updated as needed to reflect changes in law or practice.

Last updated: October 2025