Legal
Privacy Policy
Last updated: 1 November 2026
This is sample text for the Willow Counselling template. Replace it with a privacy policy that reflects how your practice collects and uses personal data. It is not legal advice.
Who we are
Willow Counselling is a private counselling and psychotherapy practice run by Eleanor Hart. For the purposes of UK data protection law, Willow Counselling is the data controller for the personal information described in this policy. This means we decide how and why your information is used, and we are responsible for looking after it.
You can contact us using the details below:
Address: 12 Example Street, London
Email: hello@example.com
Phone: 020 7946 0123
What information we collect
We only collect the information we need to offer you safe and effective support. This may include:
Contact details you give us, such as your name, email address and phone number, including when you use the contact form on this website.
Information you share when you get in touch or during an introductory call, such as what has brought you to therapy and how you would prefer to meet.
Brief session notes, kept to support continuity of care. These are factual and do not record everything that is said.
Appointment and payment records, such as session dates and invoices.
GP or emergency contact details, if you choose to provide them.
Some of this information, particularly anything about your mental or physical health, is classed as special category data under UK GDPR. We give it extra protection.
How and why we use your information
We use your information to respond to enquiries, arrange and provide therapy, keep appropriate records, take payment and meet our professional and legal obligations.
Under UK GDPR, we must have a lawful basis for using your personal information. We rely on:
Contract: to arrange and provide the sessions you have asked for.
Legitimate interests: to respond to enquiries and run the practice responsibly, in ways you would reasonably expect.
Legal obligation: for example, keeping financial records for tax purposes.
For health information, we also rely on the condition for health or social care in Article 9(2)(h) of UK GDPR, together with Schedule 1 of the Data Protection Act 2018. In some situations we may ask for your explicit consent, and we will always tell you when we do.
We will never use your information for marketing without your permission, and we do not sell it to anyone.
Confidentiality and its limits
What you share in sessions is treated as confidential. There are, however, a small number of situations where confidentiality may need to be broken:
Clinical supervision: like all accredited therapists, I discuss my work with a qualified supervisor. This is done without sharing your name or any details that could identify you.
Risk of serious harm: if I believe you or someone else is at serious risk of harm, I may need to contact your GP, the emergency services or another appropriate person.
Legal requirements: I may be required by law to share information, for example in relation to safeguarding children, terrorism or a court order.
Wherever possible, I would talk to you first before sharing anything.
How long we keep your information
We keep session notes and related records for seven years after our work together ends, in line with guidance from professional bodies and insurers. Financial records are kept for six years to meet HMRC requirements. Enquiries that do not lead to therapy are deleted within six months. After these periods, information is securely deleted or destroyed.
Who we share it with
We do not share your information unless it is needed to provide our service, or we are required to by law. We use a small number of trusted service providers who process data on our behalf, such as:
Website hosting and the contact form on this site
Email and secure video calling
Online booking and payment systems
Accountancy services
These providers may only use your information to provide their services to us, and must keep it secure. Where a provider stores data outside the UK, we make sure appropriate safeguards are in place.
Your rights
Under UK data protection law, you have the right to:
Access the personal information we hold about you
Ask us to correct information that is inaccurate or incomplete
Ask us to delete your information, where there is no good reason for us to keep it
Ask us to restrict how we use your information
Object to us using your information in certain ways
Ask for your information to be transferred to you or another organisation, where this applies
To make a request, please email hello@example.com. We will respond within one month. Some rights are limited, for example where we must keep records for legal reasons.
Cookies and analytics
This website may use cookies and similar technologies so that it works properly and to help us understand how it is used. Any analytics are reviewed in an aggregated way and are not used to identify you.
Template note: please update this section to reflect the cookies, analytics and embedded tools your website actually uses, and add a cookie banner if your setup requires one.
How to complain
If you have a concern about how your information is handled, please contact us first at hello@example.com, and we will do our best to put things right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. You can find out more at ico.org.uk.