Privacy Policy
Rebecca Wilkinson Counselling

1. Introduction
Welcome to Rebecca Wilkinson Counselling (“I”, “Me” “My”). Your privacy is fundamental to me. This
Privacy Policy explains how I collect, use, share and protect your personal data, in line with the UK
General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the Privacy and Electronic
Communications Regulations 2003.
This notice covers:

• Who I am and how to contact me
• What personal data I collect and why
• My lawful bases for processing
• How and with whom I share your data
• How long I keep it
• Your rights and how to exercise them
• How I secure your information
• Use of cookies on my website
• Privacy Policy

2. Data Controller
Name: Rebecca Wilkinson Counselling
Responsible person: Rebecca Wilkinson
ICO registration no: ZB889860
Email: hello@rebeccawilkinsoncounselling.co.uk

3. Personal Data I Collect
a) Client & Therapy Records
Identity & contact details (name, address, email, phone)
Referral information (e.g. GP or other professional notes)
Clinical notes, session records, risk assessments, safeguarding disclosures

b) Website & Marketing
Enquiry form data (name, email, phone, message)
Cookies and analytics (IP address, pages visited, time spent)
Newsletter/email subscription preferences

4. Lawful Bases for Processing
Contractual necessity: to arrange and deliver counselling sessions.
Legal obligation: to comply with clinical record-keeping, safeguarding and tax rules.
Legitimate interests: for website maintenance, service improvements and marketing (you can object at
any time).
Explicit consent: before sending newsletters or non-essential cookies.
Special category data (sensitive health information) is processed under Article 9(2)(h) GDPR (provision of
health or social care).

5. How I Use Your Data
Purpose:

• To arrange appointments, respond to enquiries and deliver therapy
• To keep accurate clinical records and notes, manage safeguarding concerns
• To send administrative communications (appointment reminders, invoices)
• To evaluate and improve my services and website usability

If you decide not to proceed with therapy, I’ll delete your initial enquiry data within 30 days unless
you ask me to keep it longer.

6. Sharing & Disclosing Your Data
I’ll never sell your data. I may share it with:
Approved processors under data-processing agreements (e.g. our web host if using the contact
form, practice-management software, JotForm for online form filling).
Professional advisers/regulators(e.g. my accountant, ICO, HMRC) if legally required.
Safeguarding bodies(e.g. children or adult services) if there’s a risk to you or others.
Before sharing, I ensure all third parties meet strict security and confidentiality standards.

7. International Transfers
All personal data is stored and processed within the UK or EEA. If I ever transfer data elsewhere, I
ensure adequate safeguards are in place (e.g. Standard Contractual Clauses).

8. Data Retention
Enquiry data: deleted within 30 days if no therapy takes place.
Active therapy records: kept securely for the duration of our contract.
Closed therapy records: retained for 5 years (adult clients) or until a client’s 25th birthday (for
minors), then securely destroyed.
Website analytics: aggregated data retained for up to 26 months.

9. Your Rights
Under GDPR you have the right to:

• Access your data and receive a copy
• Rectify inaccurate information
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Withdraw consent at any time (for cookies or marketing)
• Portability of your data in a structured format

To exercise any right or ask questions, email me at:
hello@rebeccawilkinsoncounselling.co.uk

10. Data Protection Complaints
If you have concerns about how I handle your personal data, please contact me in the first instance at
hello@rebeccawilkinsoncounselling.co.uk.
I will acknowledge your complaint and investigate it appropriately. I will keep you informed of the outcome
and any actions taken.
If you remain dissatisfied, you have the right to complain to the Information Commission (ICO).

11. Security Measures
I take appropriate technical and organisational measures, including:
Encrypted devices and back-ups
Secure, password-protected practice-management software
Locked filing cabinets for any paper records
Regular software updates and antivirus protection

12. Cookies & Website Tracking
My site uses:
Essential cookies for basic functionality (session-based, no consent needed).
Analytics cookies(e.g. Google Analytics) to understand site usage. We only place these
with your consent via our cookie banner. You can withdraw consent at any time by deleting
cookies or adjusting your browser settings.
Please see full cookie policy for further information.

13. Changes to This Policy
I may update this policy occasionally (e.g. when regulations change). The “Last updated” date
at the top will reflect significant revisions. Please check back periodically.