Privacy Agreement
Privacy policy – Cookie policy – Data retention – GDPR statement – Appropriate Policy – Make a complaint
These documents explain how South Coast Counselling collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.
ICO-registered
UK GDPR compliant
DUAA 2025 compliant
Updated 1 July 2026
Privacy Policy: Last updated: 1 July 2026
Who we are:
South Coast Counselling is a private therapy practice run by me, Sharron Garwood. I am a qualified counsellor, psychotherapist and clincal supervisior registered with the NCPS.
If you have any questions about how I handle your personal data, you can contact me at contact@southcoastcounselling.co.uk
I am registered with the Information Commissioner’s Office (ICO). My registration number is ZA335743.
What personal data we collect:
To provide therapy services, I collect and process the following types of personal data:
Contact and identification details
- Your name, address, telephone number, and email address
- Emergency contact details
Health and therapy-related information
- The reasons you are seeking therapy (your presenting issues)
- Information about your mental and emotional wellbeing
- Relevant medical history you choose to share
- Session notes recording key themes and observations from our work together
- Details of any medications or other treatments
- Information about your personal circumstances relevant to therapy
Health and therapy-related information is classified as special category data under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection due to its sensitive nature, and I am required to meet additional legal conditions before I can process it.
How we collect your data:
I collect personal data directly from you in the following ways:
- When you first contact me to enquire about therapy (by email, telephone, or through my website)
- During our initial consultation and intake process
- Throughout our therapy sessions as you share information relevant to your care
- Through any emails, text messages, or telephone calls between sessions
- When you complete assessment forms or questionnaires
I do not collect personal data about you from other sources unless you specifically ask me to liaise with another professional (such as your GP) and provide written consent.
Why we process your data — lawful basis:
UK data protection law requires me to have a valid legal reason (known as a “lawful basis”) for processing your personal data. Because therapy involves both ordinary personal data and sensitive health-related data, I rely on two separate legal bases:
Article 6 basis (ordinary personal data)
Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.
When you engage me as your therapist, we enter into a contract for me to provide therapy services. Processing your contact details and related information is necessary for me to fulfil that contract.
Article 9 basis (special category health data)
Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.
The additional condition I rely on is found in the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care purposes). This allows me to process your health data because I am a qualified counsellor and psychotherapist providing therapeutic care, and I am bound by a professional obligation of confidentiality under the NCPS code of ethics and practice.
Professional obligations and CPD:
As a member of NCPS, I am required to attend regular clinical supervision. This is an essential part of maintaining safe, ethical, and effective practice.
When I discuss my therapeutic work with my supervisor:
- Your name and any identifying details are not shared with my supervisor
- I use anonymised or pseudonymised case material only
- My clinical supervision is provided by a qualified professional bound by the same confidentiality obligations as I am
- My supervisor is bound by their own professional code of ethics and practice
This arrangement means that while my supervisor helps me reflect on and improve my clinical work, they would not be able to identify you from anything I share with them.
Clinical will — what happens to your records if we are unable to practise:
I am currently putting arrangements in place for a clinical will. A clinical will ensures that if I become suddenly unable to practise (due to serious illness, incapacity, or death), your records will be handled appropriately by a designated clinical executor — a fellow therapist bound by professional confidentiality.
Once these arrangements are finalised, I will update this policy and inform current clients.
Who we share your data with
I treat everything you share with me in therapy as confidential. However, I use certain third-party services to help run my practice securely:
- WriteUpp — a secure practice management system used for scheduling and record-keeping
Each third-party service I use is bound by a data processing agreement that requires them to handle your data in accordance with UK data protection law. Links to their privacy policies are available on request.
As described above, I also share anonymised case material (with no identifying details) with my clinical supervisor.
I never sell your personal data to anyone.
International data transfers:
The third-party tools I use (WriteUpp) process limited data on my behalf to deliver their services. For specific details on each provider’s data handling practices, international transfers (if any), and applicable safeguards under UK GDPR Chapter V and the Data (Use and Access) Act 2025, please refer to each provider’s own privacy policy.
You can request additional information from me at any time by contacting contact@southcoastcounselling.co.uk
How long we keep your data:
I retain your personal data for specific periods depending on the type of record:
- Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
- Therapy records (clients under 18 at the time of therapy): until the client reaches the age of 25
- Financial records: 6 years (this is a legal requirement from HMRC)
- Website enquiries from people who do not become clients: 12 months
After the applicable retention period ends, electronic records are permanently deleted.
Your rights under UK GDPR:
You have the following rights regarding your personal data:
Right to be informed You have the right to know how I collect and use your personal data. This privacy policy fulfils that right.
Right of access You can request a copy of the personal data I hold about you. This is sometimes called a “subject access request.” Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.
Right to rectification If any personal data I hold about you is inaccurate or incomplete, you have the right to ask me to correct it.
Right to erasure You have the right to ask me to delete your personal data in certain circumstances. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance requirements, or law.
Right to restrict processing You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.
Right to data portability Where technically feasible, you can ask me to transfer your data to another service provider in a commonly used format.
Right to object You have the right to object to certain types of processing, although this is unlikely to apply to therapy records processed under Article 6(1)(b) (contract) and Article 9(2)(h) (health care).
Rights related to automated decision-making You have the right not to be subject to decisions based solely on automated processing. I do not use automated decision-making in my practice.
To exercise any of these rights, please contact me at contact@southcoastcounselling.co.uk
Data protection complaints — your right under the Data (Use and Access) Act 2025:
You have the right to make a data protection complaint directly to me. If you are concerned about how I have handled your personal data, please let me know so I can try to resolve the issue.
You can submit a complaint at https://southcoastcounselling.policydiary.co.uk (Make a complaint tab) or contact me at contact@southcoastcounselling.co.uk
If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO):
- Website: org.uk
- Telephone: 0303 123 1113
- Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Confidentiality exceptions:
Everything you share with me in therapy is treated as confidential. However, there are limited circumstances where I may need to share information without your consent:
- Risk of serious harm: If I believe there is a serious risk of harm to you or to someone else
- Safeguarding concerns: If I become aware of safeguarding concerns involving a child or vulnerable adult
- Court order: If a court orders me to disclose information
I will always try to discuss this with you first, unless doing so would itself put someone at risk.
Where I am required by law to disclose information to prevent or report involvement in terrorism, I will do so; in certain circumstances I may be legally prevented from telling you that such a disclosure has been made.
Changes to this policy:
I review this privacy policy annually and whenever my practices change. If I make any significant changes that affect how your data is handled, I will inform you directly.
For the most current version of this policy, please visit https://southcoastcounselling.policydiary.co.uk
southcoastcounselling.policydiary.co.ukLast generated: 1 July 2026
(Personal therapy sessions are not designed for immediate crisis intervention. In emergency situations or if you are in crisis between sessions, please contact the NHS service on 111 or in an emergency, where there is a risk to life, call 999. You can also reach out to a crisis helpline such as the Samaritans at 116 123.)
Cookie Policy
Last updated: 1 July 2026
What Are Cookies
Cookies are small text files that websites place on your device when you visit them. They help websites remember your preferences and understand how visitors use the site. Most websites use cookies, and they are generally harmless.
Cookies We Use
Essential Cookies
These cookies are strictly necessary for the website to function properly. They enable basic features such as page navigation, secure access to certain areas, and remembering your preferences during a browsing session. Because these cookies are essential, they do not require your consent under UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
Essential cookies on this website may include:
- Session cookies that keep you logged in while browsing
- Security cookies that help protect against fraudulent activity
- Cookies that remember your cookie preferences
Statistical and Analytics Cookies
We do not currently use analytics or statistical cookies on this website. If this changes in the future, I will update this policy and ensure you have the ability to opt out.
Advertising and Tracking Cookies
We do not use any advertising, marketing, or tracking cookies on this website.
Cookie Consent Tool
We do not currently use a cookie consent banner or management tool. This is because we only use essential cookies that do not require your consent. If our cookie use changes to include non-essential cookies that require consent, we will implement an appropriate consent mechanism.
Third-Party Cookies
We do not use third-party cookies beyond those that may be strictly necessary for essential website functions. Our practice management system (WriteUpp) operates separately from this website and has its own privacy and cookie policies, which apply when you use that platform directly.
How to Manage or Opt Out of Cookies
You can control and delete cookies through your browser settings. All major browsers allow you to:
- See what cookies are stored and delete them individually
- Block third-party cookies
- Block all cookies from specific or all websites
- Delete all cookies when you close your browser
Please be aware that blocking essential cookies may affect how this website functions.
For detailed guidance on managing cookies in your browser, visit www.aboutcookies.org, which provides comprehensive information for all major browsers.
Your Rights
Under UK data protection law and the Data (Use and Access) Act 2025, you have the right to opt out of statistical cookies at any time without this affecting the core functionality of the website. Since we do not currently use statistical or analytics cookies, this right does not currently apply, but it will be fully honoured if our cookie use changes.
Updates to This Policy
I will update this cookie policy whenever our use of cookies changes. Any significant changes will be clearly communicated. You are welcome to check this page periodically to stay informed about how we use cookies.
Contact
If you have any questions about this cookie policy or how South Coast Counselling uses cookies, please contact me:
Sharron Garwood South Coast Counselling
Email: contact@southcoastcounselling.co.uk
ICO registration number: ZA335743
Data Retention Policy
Last updated: 1 July 2026
South Coast Counselling
This policy explains how long I keep your personal information, why I retain it, and how I dispose of it securely when the retention period ends.
Why I Retain Your Data
I retain your personal information for the following reasons:
- Legal obligations — UK GDPR and the Data Protection Act 2018 require me to handle your data responsibly and retain it only as long as necessary
- Professional standards — As a counsellor in private practice, I am bound by professional standards and the common-law duty of confidence
- Insurance requirements — My professional indemnity insurance requires me to retain records in case a claim arises after therapy ends
- Contractual purposes — Some records are necessary for the performance of our therapeutic contract
Retention Periods
Type of Record | Retention Period | Basis |
Client therapy records (adults) | 7 years after the last session | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
Client therapy records (clients under 18 at time of therapy) | Until the client reaches the age of 25 | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
Enquiry or contact data (non-clients) | 12 months from last contact | Legitimate interest; limited data held briefly |
Financial records and invoices | 6 years | HMRC legal requirement |
Insurance records | 7 years | Professional indemnity insurance requirements |
What I Retain
The records I keep may include:
- Session notes — Brief notes recording themes, progress, and relevant information from our sessions
- Contact details — Your name, address, phone number, and email address
- Payment records — Invoices and records of payments made
- Correspondence — Emails or other communications between us relating to your therapy
- Consent and contract records — Your signed therapy agreement and any consent forms
How Your Data Is Stored
Your records are stored securely using the following measures:
- All records are held electronically on password-protected devices
- Access is restricted to me, Sharron Garwood
- A clinical supervisor may receive anonymised case material for professional development purposes — this does not include your name or identifying details
- I do not keep paper records
Clinical Continuity Arrangements
I am currently putting arrangements in place to appoint a clinical executor who would manage client records securely in the event that I become incapacitated or pass away. Once these arrangements are finalised, I will inform clients of the details.
Your Right to Erasure
Under UK GDPR, you have the right to request that I delete your personal data. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where this is required by professional guidelines, insurance requirements, or law.
If you ask me to delete your records before the retention period ends, I will explain clearly why I need to keep them and for how long.
Secure Disposal
When the retention period ends, your records are disposed of securely:
- Electronic records are permanently deleted from all devices and backup systems
I do not retain any data beyond the applicable retention period unless there is a specific legal reason to do so.
Questions or Complaints
If you have any questions about this policy or how I handle your data, please contact me:
Email: contact@southcoastcounselling.co.uk
You can also view my full compliance documents at https://southcoastcounselling.policydiary.co.uk
If you are not satisfied with my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
ICO Registration Number: ZA335743
GDPR Statement
Last updated: 1 July 2026
Our commitment to your privacy
At South Coast Counselling, I believe that protecting your personal information is an essential part of our therapeutic relationship. Trust and confidentiality are at the heart of effective therapy, and I want you to feel confident that your information is handled with the same care I bring to our work together.
I am Sharron Garwood, and I am registered with the Information Commissioner’s Office (ICO registration number: ZA335743). This statement explains how I collect, use, and protect your personal information in plain terms.
What information I collect
To provide you with therapy, I collect and hold:
- Your name and contact details (address, phone number, email)
- Details about the concerns that bring you to therapy
- Notes from our sessions
- Relevant medical or mental health history you share with me
- Emergency contact information
- Payment and invoicing details
Why I collect your information
I need to process your personal information to provide therapy services to you. The legal basis for this is:
- Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.
Because therapy involves sensitive information about your health and wellbeing, I also rely on:
- Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional DPA 2018 Schedule 1 condition is Part 1, paragraph 2 (health or social care).
Professional obligations
As a member of NCPS, I am required to discuss my clinical work in supervision to maintain high standards of practice. Your identity is protected: I do not share your name or identifying details with my supervisor. My clinical supervisor uses anonymised case material only and is bound by their own professional confidentiality obligations.
Clinical will arrangements
I am currently putting arrangements in place to ensure your records would be handled appropriately and confidentially should I become unable to continue practising due to serious illness or death. Once these arrangements are finalised, I will inform you of the details.
Who else may see your information
Beyond myself, the following may have access to your information:
- Clinical supervisor — anonymised case material only, with no identifying details shared
- WriteUpp — the secure practice management system I use to store your records and manage appointments
- Statutory authorities — where I am legally required to share information (see below)
These third parties process limited data on my behalf to deliver their services. For specific details on each provider’s data handling practices, please refer to their own privacy policies. You can request additional information from me at any time.
When I might need to break confidentiality
Everything we discuss in therapy is confidential, with a few important exceptions. I may need to share information without your consent if:
- There is a serious risk of harm to yourself or others
- There are safeguarding concerns involving a child or vulnerable adult
- I receive a court order requiring disclosure
I will always try to discuss this with you first whenever possible.
Where I am required by law to disclose information to prevent or report involvement in terrorism, I will do so; in certain circumstances I may be legally prevented from telling you that such a disclosure has been made.
How long I keep your records
I retain your records for 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements. If you were under 18 when we worked together, I keep your records until you reach the age of 25, or for 7 years after our last session — whichever is longer.
After this period, your electronic records are permanently deleted.
Your rights
You have several rights regarding your personal information:
- Access — you can ask to see what information I hold about you
- Correction — you can ask me to correct any errors in your records
- Deletion — you can ask me to delete your information, although this right is not absolute; I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance, or legal obligations
- Restriction — you can ask me to limit how I use your information in certain circumstances
- Portability — you can request a copy of your information in a commonly used format
- Objection — you can object to certain types of processing
If you would like to exercise any of these rights, please contact me and I will respond within one month.
Making a complaint
If you have concerns about how I handle your information, I would encourage you to raise them with me first. Under the Data (Use and Access) Act 2025, you have the right to complain directly to me at contact@southcoastcounselling.co.uk or visit my compliance page at https://southcoastcounselling.policydiary.co.uk.
You also have the right to complain to the Information Commissioner’s Office:
- Website: ico.org.uk
- Telephone: 0303 123 1113
Appropriate Policy Document
South Coast Counselling — Processing of Special Category Personal Data
Prepared by: Sharron Garwood
Date: 1 July 2026
Review date: 1 July 2027
1. Purpose of this document
This document is prepared in accordance with Schedule 1, Part 4 of the Data Protection Act 2018 (DPA 2018). It demonstrates that South Coast Counselling’s processing of special category personal data is compliant with UK GDPR, the DPA 2018, and the Data (Use and Access) Act 2025. This document must be provided to the Information Commissioner’s Office (ICO) on request and retained for 6 months after the relevant processing ceases.
2. Description of special category data processed
South Coast Counselling processes the following types of special category personal data:
- Mental and emotional health information disclosed during therapy sessions
- Clinical notes and session records
- Relevant medical history, diagnoses, and medication details where shared by the client
- Safeguarding information where relevant to the client’s safety or the safety of others
3. Lawful basis and Schedule 1 condition
Article 6 lawful basis:
Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.
Article 9 special category condition:
Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.
DPA 2018 Schedule 1 condition:
DPA 2018 Schedule 1, Part 1, paragraph 2 — health or social care. Processing is carried out by a qualified counsellor/psychotherapist subject to the professional obligation of confidentiality under the NCPS code of ethics and practice.
ICO registration number: ZA335743
4. Compliance with Article 5 UK GDPR principles
Principle 1 — Lawfulness, fairness and transparency
Processing is lawful under Article 6(1)(b) and Article 9(2)(h) as stated above. Clients are provided with clear information about how their data is used via the Privacy Policy and GDPR Statement available at https://southcoastcounselling.policydiary.co.uk before therapy begins.
Principle 2 — Purpose limitation
Special category data is collected and processed solely for the purpose of providing therapeutic services. Data is not used for any other purpose without explicit consent or where required by law.
Principle 3 — Data minimisation
Only the minimum data necessary for effective therapeutic care is collected. Session notes record only what is clinically relevant and necessary for continuity of care.
Principle 4 — Accuracy
Client records are updated when new or corrected information is provided. Clients may request correction of any inaccuracies in their records.
Principle 5 — Storage limitation
Client records are retained for the following periods:
- Adults: 7 years after the last session
- Clients who were under 18 at the time of therapy: until the client reaches the age of 25
These periods are in line with the Limitation Act 1980 and standard professional indemnity insurance requirements. Records are permanently deleted at the end of the applicable retention period.
Principle 6 — Integrity and confidentiality (security)
Electronic records are held on password-protected devices with access restricted to Sharron Garwood. Third-party processors (WriteUpp) are subject to data processing agreements. Clinical supervision discussions use anonymised case material only — client identity is not disclosed.
Principle 7 — Accountability
This Appropriate Policy Document is maintained as required by DPA 2018. Processing activities are documented and reviewed annually.
5. Data access
The following parties have access to client data:
- Sharron Garwood — full access to all client records for the purpose of providing therapy
- Clinical supervisor — anonymised case material only; client identity is not disclosed
No other parties have routine access to identifiable client data.
6. Retention and erasure policy
Data type | Retention period | Basis |
Client therapy records (adults) | 7 years from last session | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
Client therapy records (minors) | Until the client reaches the age of 25 | In line with the Limitation Act 1980 and standard professional indemnity insurance requirements |
Financial and invoicing records | 6 years | HMRC legal requirement |
Professional indemnity records | 7 years | Insurance requirement |
Enquiry data (non-clients) | 12 months | Legitimate interests |
Electronic records are permanently deleted at the end of the applicable retention period.
The right to erasure under Article 17 UK GDPR is not absolute. Where retention is required by professional guidelines, insurance obligations, or law, records must be kept until the end of the applicable retention period and cannot be deleted earlier on request.
7. Safeguards
The following safeguards are in place to protect special category data:
- Processing is limited to the therapeutic purpose for which data was collected
- Data is not shared with third parties except where legally required, necessary for safeguarding, or with explicit client consent
- Clinical supervision discussions use anonymised case material — client identity is not disclosed to my supervisor
- All processing adheres to the NCPS code of ethics and practice, which establishes a professional obligation of confidentiality
- Electronic records are stored on password-protected devices with access restricted to Sharron Garwood
- Third-party processors (WriteUpp) operate under data processing agreements
- I am registered with the ICO as a data controller (registration number: ZA335743)
- Clients are informed of their rights and all processing via privacy documentation before therapy begins
- Clinical will arrangements are currently being put in place to ensure secure handling of records in the event of my incapacity or death; clients will be informed when these arrangements are complete
8. Third-party processors
The following third-party processor is used:
- WriteUpp — practice management and clinical record keeping
This processor operates under a data processing agreement and processes data on my behalf to deliver their services. Details of their data handling practices are available in their own privacy policy.
9. Review
This document is reviewed annually and updated whenever processing activities change. It will be retained until 6 months after processing of special category data ceases.
Next review date: 1 July 2027
Signed: Sharron Garwood, South Coast Counselling
Date: 1 July 2026
This document was prepared in compliance with Schedule 1, Part 4 of the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It must be provided to the Information Commissioner’s Office on request.
Complaints
I am committed to protecting your personal information and responding to any concerns you may have about how your data has been collected, used, stored or shared.
If you have a complaint regarding the handling of your personal data, please complete the form below or email me directly at [contact@southcoastcounselling.co.uk].
Your complaint will be acknowledged and investigated without undue delay. I aim to provide a full written response within 30 calendar days of receiving your complaint.
If you remain dissatisfied after my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).