Privacy policy

 
At Leah’s Pathway to Healing, I am committed to protecting your personal information and respecting your privacy. I am a sole trader, and ‘Leah’s Pathway to Healing’ (LPTH) is my trading name. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). I am registered with the Information Commissioner’s Office (ICO), Registration No: ZC195305.

 
As the ‘Data Controller’, I determine the purposes and means of processing your personal data. This privacy policy tells you what I will do with your personal information from initial point of contact through to after your counselling has ended, including:

 

• Information I collect

• How I collect your information

• How I use your information

• My lawful basis for processing your personal data 

• Data storage and security

• Data retention

• Sharing your information

• Your data protection rights

• Complaints and exercising your rights

I may update this policy from time to time. The latest version will always be available at https://leahspathwaytohealing.co.uk/privacy-policy. If you have any questions, concerns, or requests regarding this privacy policy or how your personal information is handled, please feel free to contact me at leah@leahspathwaytohealing.co.uk.

 
Information I Collect

 
I may collect and process the following personal information:

 

• Personal data: Name, address, phone number, email address, date of birth, GP and other healthcare professional details, emergency contact details, gender, financial information (e.g. payment details, billing records, and payments made on your behalf by third parties), profile information (including your personal background, occupational, educational or family circumstances, or other information you choose to provide), and feedback and testimonial data (e.g. reviews, survey responses, and opinions you provide about the service, which may include personal data and, where you choose to include it, special category data).

• Special category data: Health data (e.g., medical history, diagnoses, medications), racial or ethnic origin, religious or philosophical beliefs, sex life, political opinions, sexual orientation, genetic, and biometric data (where used for identification)

• Criminal offence data: Information relating to criminal convictions, alleged offences, investigations, or proceedings, where relevant to the services provided.

• Website data: My website uses cookies to enhance functionality and improve user experience. For more details on the cookies used and how to manage them, please refer to my Cookie Policy [https://leahspathwaytohealing.co.uk/cookie-policy].

Some of the information described above may include personal data relating to third parties, where relevant to the services I provide.

 
Children under 13: I do not knowingly collect or process personal data from children under 13 without parental consent (Article 8 GDPR). This means that, in most cases, any notes or records relating to data subjects under the age of 13 (for example, counselling sessions involving themes of parenthood) will not contain information that could identify the minor. However, as an online counselling service, Section 9 of the Data Protection Act 2018 provides that the Article 8 requirements do not apply where it is in the best interests of the child to rely on their own consent or where another lawful basis for processing applies, such as public task or legitimate interests.

 
How I collect your information

 
Directly from you: I collect information that you provide directly to me through forms and other relevant documentation; during assessments, consultations, and sessions; through my website's contact form; and when you contact me via third-party directories or platforms where my services are advertised. You may provide information to me by text message, email, telephone, or other methods of communication.

 
From others: In some circumstances, I may collect information about you from someone connected to you, such as a family member, a person acting on your behalf, or another professional involved in your care, where it is appropriate to do so.

 
How I use your information

I use the personal information I collect for the following purposes:

 

• Providing counselling services: To assess whether my counselling services are suitable (including an initial assessment), provide counselling, review progress, and keep relevant therapeutic records.

• Managing appointments and communication: To arrange, reschedule, or cancel sessions, communicate with you about appointments or enquiries, and record attendance at sessions.

• Managing payments and records: To manage fees, collect and process payments, issue invoices or receipts, and maintain financial and administrative records to meet legal and HMRC requirements.

• Professional supervision: To discuss aspects of the therapeutic work in supervision, with identifying details removed wherever possible.

• Communication with other professionals and organisations: To make or receive referrals, coordinate support, or communicate as part of legal processes, with your consent or where required by law.

• Safeguarding and legal obligations: To share information to protect your safety or the safety of others, or when required by law.

• Website functionality: To improve my website’s security, functionality, and user experience, which may include cookies and occasional fixes by a website developer.

• Seeking advice on professional, ethical, and legal issues: Where relevant, to seek guidance on ethical or legal matters, usually anonymised except where law or safeguarding requires disclosure.

• Professional development and accreditation: To prepare anonymised case studies for training or accreditation purposes, only with your consent.

• Collecting feedback and publishing anonymised testimonials: To help others understand my services and for the purposes of improving and developing them.

My lawful basis for processing your personal data

The GDPR states that I must have a lawful basis for processing your personal data. There are different lawful bases depending on the stage at which I am processing your personal data and the type of personal data being processed. I have explained these below:

 

• Prospective clients: Prior to entering a counselling contract, I process your personal data under Article 6(1)(b) UK GDPR as necessary to take steps at your request before entering into a contract(s). This includes responding to enquiries, arranging and conducting an initial consultation, and assessing suitability for my services.

• Current clients: If you are receiving counselling, I process your personal data under Article 6(1)(b) UK GDPR as it is necessary for the performance of our contract(s). Where applicable, I also process personal data under Article 6(1)(c) UK GDPR to comply with legal obligations.

• Former clients: Even after your counselling has ended, certain contractual obligations may continue. Where necessary, I retain and process your personal data to fulfil those continuing obligations under Article 6(1)(b) UK GDPR (contract). I may also process personal data for legitimate interests (Article 6(1)(f) UK GDPR) and/or to comply with legal obligations (Article 6(1)(c) UK GDPR).

• Special category data: Special category data is more sensitive than other types of personal data and requires additional protection under the UK GDPR. I process this special category data only where necessary for the provision of health treatment (in this case, counselling) under Article 9(2)(h) UK GDPR and where it is necessary to fulfil our counselling agreement (the contract between you and me as your health professional).

• Criminal offence data: I may process personal data relating to criminal offences (Article 10 GDPR) only when necessary for safeguarding, as required by law, or to provide counselling under our contract (Article 6(1)(b) GDPR).

• Website users: I rely on legitimate interests (Article 6(1)(f) GDPR) to support website functionality, improve user experience, and process enquiries for counselling services.

• Testimonials and feedback: I may process and publish anonymised or de-identified feedback and testimonials to help improve and develop my services and to help others understand my services. Where this involves personal data, I rely on consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f) GDPR), where appropriate.

I take the security of personal data seriously and apply appropriate safeguards to protect its confidentiality, integrity, and availability. Personal information may be stored in the following ways:

 

• Paper: Paper records are securely stored to prevent unauthorised access. Once no longer needed, paper records are securely destroyed, either through cross-cut shredding or safe disposal methods.

• Electronic: Electronic records are stored on password-protected devices or secure systems. Where available, additional security measures such as encryption are used. Once no longer needed, electronic records are permanently deleted using secure deletion methods where possible to prevent recovery.

Information in relation to the European Economic Area (“EEA”): To provide my services to you, I may transfer your personal data to third parties (such as Microsoft) who may process and/or store your personal data outside of the European Economic Area (“EEA”). Where this is the case, all reasonable steps and safeguards will be taken (for example, relying on an adequacy decision, Standard Contractual Clauses (“SCCs”), Data Transfer Agreements (“DTAs”)) to ensure that your personal data is processed securely.

 
Data Retention

The following retention periods are general guidelines for my practice and may be reviewed on a case-by-case basis, in line with my obligations as Data Controller, to ensure personal data is only kept for as long as necessary for its intended purpose. For a full overview of my data retention policy, please submit a formal written request to me.

 

• Information on Clients and Third Parties: Retained for 7 years after the last communication or session, in line with professional guidelines and the Limitation Act 1980 (Section 5). This includes information on clients, as well as third parties, which may include emergency contacts, law enforcement personnel, or other relevant professionals involved in your care.

• Client Enquiries: Retained for 3 months after the last communication if the enquiry does not lead to therapeutic work or a formal counselling agreement.

Sharing Your Information

Your personal information is treated as strictly confidential and may be shared in the following circumstances:

 

• With Your Explicit Consent: For example, if you request or provide permission for me to share information with a third party (e.g., a GP, specialist, or other professional). This may include, but is not limited to, confirming attendance or sharing other relevant information. As part of my professional development, I may also be required to complete case studies or reflective exercises on my work. In such cases, I will always seek your explicit consent before including any information that could identify you.

• Supervision: As part of ethical practice, I discuss aspects of my work in supervision. However, your identity (where possible) will remain anonymous, and any details shared will be non-identifiable.

• When Ethically or Legally Required: If I am ethically and/or legally obligated to share your information (e.g., if required by a court order), I will limit the information disclosed to what is necessary and inform you where possible.

• Therapeutic Will: In the event of my death or incapacity, I may have a therapeutic executor who could access your contact details and session records to ensure your data is managed appropriately and securely.

• Professional Guidance: Your data may also be shared with my professional body (British Association for Counselling and Psychotherapy), legal advisors, or insurers, particularly in cases involving ethical dilemmas or to ensure compliance with relevant guidelines and laws.

• Payments and Accounting Services: I may share personal information with third parties where necessary to process payments, maintain financial records, manage my accounts, and comply with legal or financial obligations. This may include sharing information such as your name and payment records with payment providers, banks, and accounting services. I also use an accountant and their firm to support my business administration, including receiving postal correspondence on my behalf, and they may have access to limited information, such as names and return addresses, where this is necessary for these purposes.

• Third-Party Software and Service Providers: I use third-party software and service providers to help manage my practice, deliver my services, and facilitate the administration and operation of my business. These providers process information as necessary to provide the services I use. These may include: Black Moon Hosting: Used to host my website (https://blackmoonhosting.com/privacy-policy-2); Microsoft: Used for aspects of my practice, including Outlook, Teams, OneDrive, Forms, and other Microsoft tools (https://www.microsoft.com/en-gb/privacy/privacystatement); Apple: Used in connection with my practice phone, including iCloud services for storage and syncing of information, and where applicable, communication services such as iMessage or FaceTime (https://www.apple.com/uk/legal/privacy/en-ww/); Vodafone: Provides my mobile phone service, which may be used for telephone calls and text messaging with you (https://www.vodafone.co.uk/privacy); and WhatsApp: May be used for communication with you, where appropriate (https://www.whatsapp.com/legal/privacy-policy).

Your Rights

Under the UK GDPR, you have specific rights regarding your personal data. These include:

 

• Right to Access: You can request a copy of the personal information I hold about you

• Right to Rectification: If you believe the information I hold is inaccurate or incomplete, you can ask for corrections

• Right to Erasure: You can request that I delete your personal data, subject to legal or professional obligations

• Right to Restrict Processing: You can ask me to limit how I use your personal information in certain situations

• Right to Data Portability: You may have the right to request that your information be transferred to another service provider in a structured, commonly used format

• Right to Object: You have the right to object to how your data is processed, including for legitimate interests

Complaints and Exercising Your Rights

If you have any concerns or complaints about how your personal data has been handled or processed, please contact me directly using the details provided above. I will address your concerns in a timely and professional manner.

 
If you are not satisfied with my response, or if you wish to exercise your data protection rights, you may also contact the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection at www.ico.org.uk.

 

• Name: Leah Lines

• Trading Name: Leah’s Pathway to Healing

• Telephone Number: 07826075450

• Email Address: leah@leahspathwaytohealing.co.uk