Privacy Policy
Last Updated: October 2026
Your privacy matters to me. This policy explains what personal information I collect, why I need it, how I protect it and what rights you have over it. It applies when you enquire about counselling, become a client, use my website or contact me about my services.
Who I am
I am Holly Price, a psychotherapeutic counsellor providing in-person and online counselling.
I am the data controller for my practice. This means I am responsible for deciding how your personal information is collected, used and stored.
I am registered with the Information Commissioner’s Office, registration number C1447835. I handle information in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018 as amended.
If you have questions about your information, please email me at holly@hollyprice.co.uk.
What information I collect
When you enquire
If you contact me through my website or by email, I collect the information you provide. This may include your name, email address, telephone number and a brief explanation of why you are seeking counselling.
You do not need to share a detailed personal history when making an enquiry.
When you become a client
I collect information needed to arrange and provide counselling safely and appropriately. This may include:
Your name, address, email address and telephone number.
Your signed counselling agreement.
Appointment and payment records.
GP and emergency contact details.
Your current location when attending online sessions.
Brief therapy notes and relevant correspondence.
Records of significant decisions, including safeguarding or safety decisions.
Counselling can involve sensitive information about your health, relationships, identity, beliefs or personal experiences. Some of this is classed as “special category” information under data protection law and receives additional protection.
I keep records relevant to our work and avoid collecting or recording unnecessary information.
Most information comes directly from you. Occasionally, I may receive relevant information from a professional or another person involved in an agreed referral or safeguarding response. Where appropriate and legally permitted, I will explain this to you.
Why I use your information
I use your information to:
Respond to your enquiry and consider whether my service is suitable.
Arrange and provide counselling.
Communicate about appointments.
Process payments and maintain financial records.
Keep appropriate records of our work.
Reflect on my practice in confidential clinical supervision.
Consider safety and safeguarding concerns.
Respond to complaints and requests about your information.
Meet applicable legal and professional responsibilities.
Arrange practice continuity if illness, incapacity or death prevents me contacting clients myself.
The legal reasons for using your information
Data protection law requires an appropriate legal basis for using personal information.
Enquiries and counselling: I use information where necessary to take steps towards entering into a counselling agreement at your request, or to provide the counselling we have agreed. This is the contractual basis under Article 6(1)(b) of the UK GDPR.
Practice administration and appropriate record keeping: Where information is needed outside the performance of our agreement, I rely on legitimate interests under Article 6(1)(f). These interests include maintaining appropriate records, supporting safe and accountable practice through supervision, managing complaints and protecting the practice in relation to legal claims. I consider whether the use is necessary and proportionate and balance it against your rights.
Legal requirements: Where I am legally required to use or disclose information, including maintaining relevant tax records or complying with a binding legal requirement, I rely on legal obligation under Article 6(1)(c).
Sensitive counselling information: Where necessary to provide counselling and maintain appropriate clinical records, I rely on the health or social care condition under Article 9(2)(h), together with the applicable provisions of the Data Protection Act 2018. This information is handled within my duty of confidentiality.
If information needs to be used for a different purpose, such as a particular safeguarding disclosure or legal claim, I identify and record the legal basis and any additional condition applicable to those circumstances.
Signing a counselling agreement does not waive your data protection rights. Where I ask for consent for a particular optional use, I explain that use separately and how consent can be withdrawn.
I need sufficient contact and practical information to arrange counselling and respond appropriately to urgent situations. If you are concerned about providing particular details, we can discuss why they are requested and whether an alternative arrangement is possible.
Confidentiality and sharing information
Information about our work is kept confidential, subject to the arrangements explained here and in your counselling agreement.
Clinical supervision
I receive regular clinical supervision to reflect on my work and support safe, ethical practice.
I may discuss relevant aspects of our sessions with my supervisor, avoiding your name and minimising identifying information wherever possible. My supervisor is bound by professional confidentiality.
Removing a name does not always make information completely unidentifiable, so I take care over the details I share.
Safeguarding and legal disclosures
I may share necessary information with your agreement, where required by law, or where disclosure without consent is lawfully justified to protect you or another person from serious harm.
This may include safeguarding concerns involving children or adults at risk. Decisions depend on the circumstances; not every disclosure of a crime, suicidal thought or difficult family situation is automatically reported.
Where safe, appropriate and legally permitted, I will discuss the concern with you before sharing information. I disclose only what is necessary and record the reasons for significant decisions.
Practice continuity
I have appointed a trusted colleague to manage necessary practice arrangements if serious illness, incapacity or death prevents me contacting clients myself.
They are bound by confidentiality and may access the minimum information needed to contact clients, manage appointments and arrange secure handling of records.
Other necessary recipients
Relevant information may be shared with professional advisers, my insurer or appropriate authorities where necessary to address a complaint, legal claim or legal obligation.
Financial information may be provided to my accountant where necessary for accounting and tax purposes. Therapy notes are not routinely shared for accounting purposes.
Digital service providers also process information as needed to operate the systems described below.
How information is stored and protected
Brief therapy notes are stored on my password-protected reMarkable device and backed up to reMarkable Cloud.
Signed agreements and relevant correspondence are stored in my business email account and associated systems.
Online counselling takes place through Google Meet. Joining links and calendar invitations are sent by email.
My website is hosted by Squarespace. Website enquiries are forwarded to my business email account.
My business email and calendar are provided by Google Workspace.
I use password protection and appropriate account and device security measures to protect information. My laptop uses FileVault encryption, and two-factor authentication is used on relevant accounts.
Routine clinical access is limited to me. Providers process information as needed to deliver their services, subject to the applicable terms and data protection arrangements.
Digital communication and cloud storage carry risks, including unauthorised access and service interruptions. I consider these risks and use appropriate safeguards when selecting and using systems.
Online sessions, recording and AI
We discuss privacy and safety when arranging online sessions. This includes joining from a suitable location and agreeing what happens if the connection fails.
I provide a private space at my end and will discuss any difficulties you have accessing a private space.
I do not record sessions or use transcription or AI tools to process identifiable client information.
Any proposed recording, transcription or use of personal information in an AI tool will be explained beforehand, including its purpose, provider, storage arrangements, risks and alternatives.
I obtain the informed consent required by the applicable BACP Ethical Framework before inputting personal information into AI or digital tools, and separately establish the appropriate data protection basis.
I remain responsible for professional decisions.
Information processed outside the UK
Some digital providers may process information outside the UK. Where this involves a restricted international transfer, an appropriate legal transfer arrangement must apply.
You can contact me for information about the safeguards relevant to your records.
Website information and cookies
My website is hosted by Squarespace. It uses necessary cookies to support website functionality and remember your cookie choices.
With your permission, Squarespace also uses analytics and performance cookies to help me understand how visitors use the website, including visits and pages viewed. These may involve technical information and cookie identifiers, even when your name is not collected.
Squarespace’s non-essential cookies are restricted until you accept them. You can select “Accept all”, “Decline all”, or “Manage cookies” in the cookie banner. Necessary cookies remain active.
You can review or change your choices later using the “Cookie Preferences” button on the website.
Squarespace’s activity log is disabled on my website.
Squarespace lists its standard analytics cookie durations as 30 minutes or two years, depending on the cookie. Cookies remembering consent choices last 30 days. Further information about cookie names, purposes and durations is available in Squarespace’s cookie guide.
How long I keep information
I retain information only for as long as necessary for its purpose, taking account of applicable legal, professional and insurance requirements.
Enquiries that do not lead to counselling are retained for 12 months after our last contact, unless there is a specific lawful reason to retain them longer.
Therapy notes, signed agreements and relevant client correspondence are retained for 7 years (as per my insurance specifications) after counselling ends.
Financial records are retained for the period required by applicable tax and accounting rules.
Complaints and legal claim records are retained for as long as necessary to deal with the matter and meet applicable legal or insurance requirements.
Routine correspondence that is not needed for the client record is deleted when no longer necessary. Records and backups are deleted or destroyed securely in accordance with the arrangements of the systems used.
You can ask about the retention arrangements applicable to your information.
Your rights
Depending on the circumstances and legal basis, you may have rights to:
Access your personal information.
Correct inaccurate information.
Request deletion.
Restrict how information is used.
Object to particular uses.
Receive certain information in a portable format.
These rights have conditions and exceptions. For example, deletion may not apply to information lawfully retained for necessary healthcare purposes or legal claims. I will explain any relevant limitation.
You can object to processing based on legitimate interests by emailing holly@hollyprice.co.uk. You can object to direct marketing at any time.
Where an optional use relies on consent, you can withdraw that consent without affecting the lawfulness of earlier use.
To exercise your rights, contact holly@hollyprice.co.uk. I may request proportionate information to verify your identity or someone’s authority to act for you.
I will respond within the applicable legal timeframe and explain any lawful extension or limitation.
I do not make decisions about your access to counselling solely through automated systems.
Concerns and complaints
If you have concerns about how your information is handled, please email holly@hollyprice.co.uk. You do not need to use legal language.
My data protection complaints procedure explains what happens next.
I will acknowledge a complaint within 30 days, investigate and respond without undue delay, keep you informed and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office:
Website: ICO complaints information
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this policy
I will review this policy when my services, systems or relevant requirements change.
Updates will be published on my website. Significant changes affecting our work will be explained to you, and any new agreement or consent required will be obtained before introducing them, wherever possible.
You can request a copy of this policy or an accessible format by emailing holly@hollyprice.co.uk.