Privacy Notice

Sasha Pyatt Counselling

Introduction
Your privacy is important to me.
This Privacy Notice explains how I collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
As your counsellor, I am committed to handling your personal information with care, respect and confidentiality.
This notice applies to information collected through my website, when you contact me about counselling, and during the course of counselling.

Who I Am
I am Sasha Pyatt, a qualified Person-Centred Counsellor and Registered Member of the British Association for Counselling and Psychotherapy (MBACP).
I am the Data Controller for the personal information I process in connection with my counselling practice.
Contact details
Email: hello@sashapyattcounselling.co.uk
Website: sashapyattcounselling.co.uk
ICO Registration Number: CSN6841664

What Information I Collect
Depending on how you interact with me, I may collect and process:

Your name, address, telephone number and email address.
Your date of birth.
Emergency contact details.
Information you provide when making an enquiry or during an introductory conversation.
Information you provide during your initial assessment.
Information relating to your physical or mental health and wellbeing where relevant to counselling.
Brief clinical notes relating to our counselling sessions.
Appointment and attendance information.
Payment and accounting records.
Relevant correspondence between us.
I aim to collect only information that is necessary for providing a safe and effective counselling service.

How I Use Your Information
I use your personal information to:

Respond to enquiries and arrange an introductory conversation.
Assess whether counselling is appropriate for you.
Provide counselling safely and effectively.
Arrange and manage appointments.
Maintain appropriate clinical records.
Communicate with you about your counselling.
Process and maintain payment and accounting records.
Meet my professional, ethical and legal responsibilities.
Respond to legal or regulatory requirements where applicable.

Some information is necessary for me to arrange and provide counselling safely, manage appointments and payments, and meet relevant professional and legal obligations. If you choose not to provide information that is necessary for these purposes, I may not be able to provide counselling.

Lawful Basis for Processing
I process personal information only where I have a lawful basis to do so under the UK GDPR.
Depending on the circumstances, this may include:
Article 6(1)(b) – Contract
Processing is necessary to take steps at your request before entering into a counselling agreement and, once counselling begins, to provide the agreed counselling service.
Article 6(1)(c) – Legal obligation
Processing may be necessary where I am required to comply with a legal obligation.
Article 6(1)(f) – Legitimate interests

Where appropriate, I may rely on legitimate interests for the effective administration and management of my counselling practice, including managing appointments, maintaining appropriate business records, communicating with clients and maintaining the security of my systems, where these interests are not overridden by your rights and interests.

Special category data
Information concerning your physical or mental health is special category data under the UK GDPR.
Where I process health information for the provision of counselling, I rely on the Article 9 condition relating to the provision of health or social care, together with the applicable requirements under the Data Protection Act 2018, and an appropriate Article 6 lawful basis.
I do not use your personal information for automated decision-making or profiling.

How I Store and Protect Your Information
I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction or damage.
Client records are stored on a password-protected computer which I use for my counselling practice. I work from home and the computer is not routinely taken outside my home.
I do not store client records on the iPad I use for online counselling.
I will maintain appropriate backup arrangements for practice records. Backup copies will be stored separately from my computer and appropriately protected, including through encryption where appropriate. Backup media will be kept securely and access will be restricted to me.
I regularly review my arrangements for storing, backing up and securely disposing of personal information and will update them where necessary to maintain appropriate security.

Online Counselling
Online counselling sessions are provided using Doxy.me via an iPad.
I do not record counselling sessions.
I do not store client records on the iPad used for online sessions.
Doxy.me processes certain information in order to provide its video consultation service. Further information about how Doxy.me handles personal information is available in its own privacy information.
Who I Share Your Information With
I treat information you share with me as confidential and do not routinely share identifying information about you with other people or organisations.

I use a small number of service providers to support the administration and delivery of my counselling practice. These currently include:

Wix, which hosts and supports my website.
ImprovMX, which provides email forwarding from my practice email address to my email mailbox.
Yahoo Mail, which I use to receive and manage practice enquiries and email correspondence.
Doxy.me, which provides the secure video platform I use for online counselling.
Payment, accounting or other administrative service providers where necessary to manage payments and business records.

These providers may process personal information as part of providing their services. I take reasonable steps to ensure that appropriate data protection and security arrangements are in place when using these services.
I may also discuss relevant client material with my clinical supervisor as part of professional supervision. Wherever practical, I use anonymised or non-identifying information for this purpose.
I may share personal information where you have given your consent, where this is necessary to protect you or another person from a serious and immediate risk of harm, where safeguarding concerns arise, or where I am legally required or permitted to do so. Wherever possible and appropriate, I will discuss this with you beforehand.

International Transfers
Some of the service providers I use may process personal information outside the United Kingdom, including in countries such as the United States.
Where personal information is transferred outside the UK, I take reasonable steps to ensure that appropriate safeguards are in place in accordance with applicable data protection law. These safeguards may include an adequacy decision, appropriate contractual safeguards such as Standard Contractual Clauses, or other lawful transfer mechanisms.
The service providers I use may update their data processing arrangements from time to time. I review the privacy and data protection arrangements of relevant providers as part of managing my practice.

Confidentiality
What you share in counselling is treated as confidential.
There are some exceptions to confidentiality, including serious risk of harm, safeguarding concerns, legal requirements and certain other professional or legal obligations.
The limits of confidentiality will be explained when we begin working together, and you can ask me about them at any time.

How Long I Keep Your Information
I keep personal information only for as long as it is necessary for the purposes for which it was collected, taking into account my professional, legal and insurance responsibilities.
For clients who enter into counselling, I currently intend to retain assessment information, counselling agreements, clinical notes and relevant correspondence that forms part of the counselling record for seven years after counselling ends.
I have chosen this period as part of my professional record-keeping arrangements and will keep it under review in light of relevant legal, professional and insurance requirements.
For enquiries that do not result in counselling, I normally retain relevant information for 12 months after the enquiry, unless there is a reason to retain it for longer.
Routine correspondence and other information that is no longer needed will be securely deleted or destroyed.
Financial records will be retained for the period required by applicable tax and financial record-keeping requirements.
Where information is held in backup copies, it will be securely deleted or overwritten in accordance with my backup and deletion procedures and when it is no longer required for recovery purposes.
I regularly review the information I hold and securely delete or destroy personal information when it is no longer necessary to retain it, subject to any legal, professional or other legitimate requirement to keep it.

Your Rights
Under the UK GDPR, you may have rights in relation to your personal information, including the right to:

Request access to the personal information I hold about you.
Ask me to correct inaccurate or incomplete information.
Request restriction of processing in certain circumstances.
Request erasure of your information where applicable.
Object to certain types of processing.
Request data portability where this right applies.

These rights are subject to certain legal and professional limitations, particularly in relation to counselling and health information.
If I rely on your consent for a particular type of processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Data Breaches
I take reasonable steps to protect your personal information from loss, misuse and unauthorised access.
If a personal data breach occurs, I will assess the breach and take appropriate action in accordance with UK data protection law, including notifying the Information Commissioner's Office where legally required and informing you where appropriate.

Website and Cookies
My website is hosted using Wix.
The website may use cookies and similar technologies that are necessary for the website to function and, depending on the settings and services used on the website, may use other cookies or analytics technologies.
Information about the cookies used on the website and how they are managed will be provided through the website's cookie settings where applicable.
I do not use personal information collected through the website for automated decision-making or profiling.

Use of AI and Digital Tools
I may occasionally use generative AI tools, such as ChatGPT, for general professional reflection, learning, or to help me think through aspects of my own professional practice.
I do not use generative AI to record, transcribe or analyse counselling sessions, make clinical decisions, or assess clients.
Where I use AI in relation to my professional practice, I do not enter names, contact details, clinical records, or information that could reasonably identify an individual. Any client-related material used for reflection is sufficiently anonymised and generalised so that the individual cannot reasonably be identified.
I take care to avoid including unnecessary or distinctive details and remain responsible for maintaining confidentiality and protecting your information when using digital tools.

Data Protection Complaints
If you have concerns about how I have handled your personal information, you can contact me at hello@sashapyattcounselling.co.uk.
Further information about how I handle data protection complaints can be found in my Data Protection Complaints Procedure.

Questions or Concerns
If you have any questions or concerns about how I handle your personal information, please contact me in the first instance:
Email: hello@sashapyattcounselling.co.uk

Reviewing This Notice
This Privacy Notice may be reviewed and updated from time to time to reflect changes in my practice, the services I use, or legal, regulatory or professional guidance.