GDPR Privacy Notice

About this notice

Under UK GDPR and the Data Protection Act 2018 you have a right to know what information I collect, how I use it and the circumstances in which it may be shared.

I am Janine McCorry, the data controller for Calm the Chaos Counselling. My ICO registration number is ZA844848.

Before your first appointment you will be given a copy of this privacy notice along with the Therapy Agreement.

Your personal data

Information kept includes:

Contact and identity details: name, address, email, phone, date of birth
Emergency and medical contacts: GP details and an emergency contact, where you choose to provide them
Counselling records: Notes about our sessions, your goals, relevant history, risk information and records of my decisions. these may contain sensitive personal data (see below).

Sensitive Personal Data (Special Category Data)

Some of the information collected may be sensitive personal data, including ethnic origin, religious beliefs and physical and mental health. I use this data only to provide you with a counselling service. Sensitive personal data is stored as part of, but separate to, your clinical notes. Your clinical notes are pseudonymised: they carry a unique code instead of your name, and the information that links the code to you is kept separately. All documents are password protected.

Why I process your information and my lawful basis

Lawful bases under UK GDPR Article 6:

Contract (6(1)(b)): to provide counselling to you under our therapy agreement, including arranging sessions, keeping records and handling payment.
Legal obligation (6(1)(c)): where I am required by law, for example to keep financial records or to disclose information when the law compels me to.
Legitimate interests (6(1)(f)): for limited administrative purposes, such as keeping appropriate records and managing my practice, where this does not override your rights and interests.

Special category data, Article 9:

Health or social care (9(2)(h)): processing is necessary for me to provide you with counselling, and I am bound by professional confidentiality under the law and the BACP Ethical Framework.
Explicit consent (9(2)(a)): where you have agreed to something specific, such as my contacting your GP. You can withdraw this at any time.
Vital interests (9(2)(c)): where disclosure is necessary to protect someone's life and you cannot give consent.
Legal claims (9(2)(f)): where I need to establish, exercise or defend legal claims, for example if a complaint is made.

Data	Why it is kept
Name, date of birth, occupation	Basic information about yourself that helps me to get to know you.
Address, email address and telephone number	I use this as a way of contacting you about our sessions. Address is also kept in case I felt you were at risk and needed to request a police safety check.
Emergency contact	In case anything happens to you within our session, for instance if you become suddenly ill and I needed to contact someone.
GP Details	If I felt you were at risk than I may need to contact your GP. Where possible, and if appropriate, I will discuss this with you first.
Session Notes	Standard professional procedure requires summary notes of each session, which help me remember what was discussed
Sensitive Personal Data ("Special Category Data")	Helps me to get to know you and make an initial assessment of your circumstances, including any history of depression and anxiety

Confidentiality and its limits

What you tell me is confidential. I will only share information about you without your consent in limited circumstances, including:

where I believe there is a serious risk of harm to you or someone else;
where the law requires disclosure (for example, certain safeguarding duties, terrorism legislation, or a court order);
in the circumstances set out in my working agreement.

Where possible and safe, I will tell you before I share anything. I discuss my work in supervision, but I do this anonymously and do not share your identifying details.

Who I share your information with

I will not share any information about you with other organisations or people, except in these situations:

Consent: I may share your information with other professionals whom you have asked or agreed I should contact.
Serious harm: I may share your information with the relevant authorities if I have reason to believe that this may prevent serious harm to you or another person.
Clinical executor: as required by my professional body, I have plans in place should I suddenly or unexpectedly be unable to practise. These are detailed in my clinical will, which is held by Professional Clinical Wills. Professional Clinical Wills confidentially holds minimal contact details (your first name, telephone number and email address) for the purpose of contacting you if I am unable to do so.
Compliance with the law: for instance, if I am required to by a court of law.
Insurers or professional bodies: BACP and Holistic Insurance (if a complaint or claim is made).

The tools I use

I use the following providers to run my practice. They process data on my behalf.

Bilateral Base (remote EMDR). Used to hold remote EMDR sessions only. I do not store client names, contact details, session notes or any other client information in it. Appointments are booked using initials only. Bilateral Base may process certain information during a session, such as connection data. Bilateral Base states that the personal data it holds is stored on servers in Dublin, Ireland, within the EU.

Microsoft Teams (online counselling sessions). Used to hold video sessions only. I do not store client information in Teams. Microsoft may process certain information when you join a session, such as your display name and connection data. Sessions are never recorded or transcribed.

Gmail (administrative communication). Used for scheduling appointments and sending documents. Email is not a fully secure channel, so please avoid sending sensitive information by email where possible. When returning your personal information record form, I encourage you to password protect it and send me the password in a separate email. Google stores email data in its global data centres, which may be outside the UK, and I cannot choose where. Google’s privacy policy explains how it handles data. I keep the content of emails to administrative matters only and do not discuss therapy or your personal circumstances by email.

Microsoft OneDrive (storage of client notes and contact details). OneDrive data is stored in Microsoft’s data centres, which may be outside the UK, and I cannot choose where for my account type. Microsoft’s privacy statement explains how it handles data. My files are protected by multi-factor authentication, password protection on documents, and BitLocker encryption on my PC. I use a Microsoft 365 Classic subscription.

My mobile phone. Your telephone number may be kept in my mobile phone under your initials only. The phone is password protected. My contacts are synced to Google.

Your identifiable information is kept separately from your session notes, and the two are linked by a unique code.

How I keep your information secure

I keep client notes and contact details on my PC, which is protected by multi-factor authentication and has its drive encrypted using BitLocker. Documents containing client information are password protected. My files are stored in Microsoft OneDrive, which also acts as a backup. I may also store a client's contact details on my mobile phone, under their initials only. The phone is password protected. My Gmail account is protected by multi-factor authentication.

If there were a breach affecting your personal data and it posed a risk to you, I would tell you and report it to the Information Commissioner's Office as the law requires.

How long I keep it for

For legal reasons I keep a record of your full name, dates of sessions and a brief description of the therapy, including any identified risks or unusual reactions for 5 years after the end of therapy. This is the period my insurer requires. After this they are destroyed by deletion.

The following will be shredded or deleted within 3 months of our work finishing:

Your phone number from my mobile phone
Emails regarding appointment arrangements
Personal Information Record form
Therapy Agreement

If I am unable to practise, my clinical executor will manage or securely delete records in line with my clinical will.

Artificial Intelligence

I do not use artificial intelligence (AI) tools in my work with clients. I do not enter any information about you or our sessions into AI tools, and I do not use AI to transcribe, summarise or analyse sessions. I have checked that AI features are switched off in the digital tools listed above. If this changes in future, I will tell you in advance and will not use AI with your information without your informed consent.

Your rights

Under UK GDPR you have the right to:

be informed about how your data is used;
access your records and receive a copy;
have inaccurate data corrected;
ask for your data to be erased, in some circumstances;
restrict or object to processing, in some circumstances;
data portability, in some circumstances;
withdraw consent where I rely on it.

To use any of these rights, contact me at calmthechaoscounselling@gmail.com. I will respond within one month. In some cases I may need to withhold information, for example if disclosure would risk serious harm or reveal details about another person, and I will explain if so.

Data protection accountability and complaints

If you wish to complain about how your data is handled, please contact me first. I am Janine McCorry, the data controller at Calm the Chaos Counselling.

Tel: 07392 766305

Email: calmthechaoscounselling@gmail.com

If your complaint is not resolved to your satisfaction, you can contact the Information Commissioner's Office at https://ico.org.uk/concerns/handling/ or on 0303 123 1113.

Changes to this notice

I review this notice at least once a year and whenever my tools or practice change. The current version will always be available from me on request.