Website Privacy Policy & Data Protection Notice

Data Controller: Elizabeth Viney

ICO Registration Number:  ZB397451

Website URL: www.elizabethviney.co.uk

1. Overview

This Privacy Policy explains how I, Elizabeth Viney, collects, stores, processes, and protects personal data obtained through this website and during the course of delivering psychotherapy services. I am committed to respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.

2. Information Collected via This Website

• Website Contact Enquiries: When you submit an enquiry via the website contact form or email me directly, I collect your name, email address, phone number, and any details you choose to share regarding your enquiry.

• Technical & Analytics Data: This website may collect basic technical data (e.g. browser type) via standard analytics or essential cookies to ensure web functionality.

3. Lawful Basis for Data Processing

• Contract & Legitimate Interests: Processing contact enquiries and administrative data to respond to your requests, schedule initial consultations, and manage practice operations.

• Special Category Data (Health Data): Under UK GDPR Article 9(2)(h), processing clinical notes and health-related information is necessary for the provision of health or social care treatment.

4. How Your Information Is Stored & Managed

• Electronic Enquiries & Contact Details: Initial website enquiries and basic contact details (name, email, phone) are received and stored on a password-protected, encrypted device.

• Financial & Accounting Data: Invoicing and fee records are managed using FreeAgent accounting software, which complies with UK data protection regulations.

• Clinical Session Notes: All clinical notes taken for supervision and professional reflection are handwritten on paper and strictly anonymised. Paper notes are stored separately from contact details in a locked filing cabinet. No electronic clinical notes are created or stored.

5. Retention and Disposal of Records

• Website Enquiries: Unregistered enquiries that do not result in therapy are deleted after 30 days.

• Client Records: Handwritten clinical notes and basic administrative details for active clients are retained for 5 years after our final session, in accordance with professional indemnity insurance and legal obligations. After 5 years, paper records are cross-shredded and digital administrative files are permanently deleted.

6. Confidentiality & Third-Party Disclosures

Your personal data will never be sold, rented, or shared with third parties for marketing purposes. Information is kept strictly confidential except in the following specific circumstances:

• Clinical Supervision: As required by the BACP, I engage in regular clinical supervision. Discussions are supported by my handwritten, strictly anonymised notes.

• Emergency / Clinical Will Protocol: In accordance with BACP requirements, I maintain a Clinical Will. In the event of my unexpected death or sudden incapacitation, my appointed Clinical Will Executor (a bound professional colleague) will access contact details solely to inform current clients. They do not have access to clinical notes.

• Legal & Safeguarding Obligations: Confidentiality may be broken if required by law (e.g., prevention of terrorism, money laundering) or if there is a serious risk of harm to yourself or others.

7. Artificial Intelligence (AI) Statement

I do not use Artificial Intelligence (AI) tools, automated transcription software, or automated processing systems in my practice. All clinical notes, administrative tasks, and client communications are created, managed, and stored directly by me.

8. Your Rights Under UK GDPR

You have the following statutory rights regarding your personal data:

• The right to be informed about how your data is processed.

• The right to access the personal data held about you (Subject Access Request).

• The right to request correction of inaccurate data.

• The right to request erasure or restriction of data (subject to statutory/insurance retention periods).

• The right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk if you believe your data has been handled improperly.

9. Data Breaches

In the unlikely event of an unlawful data breach involving personal data, I will notify affected individuals and the Information Commissioner's Office (ICO) within 72 hours where required by law.

10. Contacting Me

If you have any questions about this Privacy Policy or how your personal data is handled, please contact:

Elizabeth Viney

Email: therapy@elizabethviney.co.uk