Privacy Notice
Effective from: 3 November 2026
Suzanne Wood-Simmons – Counselling and Psychotherapy
Who is responsible for your information?
I am Suzanne Wood-Simmons, an independent counsellor and psychotherapist, MBACP Registered and NCPS Accredited. I am the data controller for my private counselling practice. My ICO registration number is ZA531150. Contact me at [email protected].
What information do I collect?
Depending on our work, I may collect your name, date of birth, contact and address details, communication and accessibility preferences, GP and emergency contact details, relevant health and wellbeing information, counselling goals, clinical notes, appointment records, payment details and correspondence. Some information is special-category data. Information normally comes from you, or occasionally from a referral or funding organisation.
Why do I use your information?
I use it to respond to enquiries, assess whether I can provide counselling, arrange and deliver sessions, maintain appropriate records, administer payments, fulfil professional and legal obligations, address safeguarding concerns and respond to complaints or legal claims. Essential contact and safety information is necessary to provide counselling; without it I may be unable to offer the service.
Legal bases for processing
Depending on the purpose, I rely on UK GDPR Article 6 grounds including contract, legitimate interests, legal obligation and, exceptionally, vital interests. Health and counselling information also requires an Article 9 condition. Where the statutory requirements are satisfied, processing for counselling or treatment may be covered by Article 9(2)(h) together with applicable Data Protection Act 2018 confidentiality safeguards. Other conditions may apply to specific safeguarding or legal-claim circumstances. Signing a counselling agreement is not blanket consent to all processing.
Confidentiality and supervision
I treat counselling information confidentially and discuss clinical work in professional supervision, ordinarily without identifying clients. Limited disclosures may be necessary where legally required or otherwise justified, including serious safeguarding or risk concerns. Where practicable and safe, I will discuss disclosure with you beforehand and share no more than necessary.
How information is stored
I use Kiku for appointments, client administration, clinical notes and payment records. Its published information identifies AWS hosting in Ireland. Older handwritten notes are stored in a safe, with identifying information held separately in a locked filing cabinet. I use Proton Mail, a dedicated counselling telephone and, for administration, WhatsApp and SMS. My phone is protected by device security. If the practice platform changes, including a transition to Konfidens, I will review the relevant processing arrangements and update this notice as necessary.
Online and telephone sessions
I normally use Zoom or telephone for counselling. I do not routinely record sessions or currently use AI transcription or automated clinical note-writing. Any future use would require a separate review and appropriate information. Please attend sessions from a reasonably private location.
Bupa and other funders
For Bupa-funded counselling I submit billing information through its provider portal, potentially including identifying details, session dates and relevant treatment codes. I do not routinely send detailed clinical notes. A person or organisation paying for counselling does not automatically gain access to session content or progress information.
Payments
Payments are normally by bank transfer. Names, references, amounts and dates may appear in banking records, and invoices and payments are recorded in my practice system. PayPal or another agreed provider may process transaction information where used. Financial records are retained as required by applicable tax and accounting obligations.
CCTV and Ring doorbell
For property security, CCTV and a Ring video doorbell may record visitors arriving or leaving, including visitors attending occasional face-to-face appointments. There are no cameras in the counselling room. CCTV records to an SD card and overwrites footage when full. Ring event videos are currently retained for approximately 30 days and snapshots for approximately seven days, depending on settings. My husband and I can access household security footage; he does not access counselling records. Footage is not used to assess counselling and is only disclosed where justified.
Retention
I ordinarily retain adult counselling records for seven years after the final session, unless longer retention is necessary or justified. This includes electronic and older handwritten records. Financial records follow applicable tax and accounting periods. Enquiries and administrative messages are retained only as necessary for their purposes. Security recordings follow the periods described above unless needed for a specific incident. Records are securely deleted or destroyed when no longer needed.
Who may receive information?
Depending on the circumstances, relevant service providers may include Kiku, Proton Mail, Zoom, communications providers, banks, payment processors, Bupa and authorised authorities. My professional supervisor ordinarily receives non-identifying material. I do not sell client information or share session content for advertising.
Clinical Executor
I have appointed a Clinical Executor who is a qualified and experienced counsellor familiar with professional, ethical and confidentiality responsibilities. If I die or become seriously ill or incapacitated, they may, subject to appropriate authorisation and safeguards, access the minimum necessary information to notify clients, address appointments and support referrals, continuity of care or sensitive endings. Their access is subject to professional confidentiality and data protection requirements.
International processing
Some providers may process or access information outside the UK. Where UK GDPR international transfer rules apply, appropriate legal safeguards must be in place, such as adequacy regulations or approved contractual arrangements. Please contact me for information about relevant provider safeguards.
Your rights and complaints
Depending on circumstances and legal exceptions, you may request access, correction, erasure, restriction, portability or object to certain processing, including processing based on legitimate interests. Where consent is relied on, you may withdraw it. Contact [email protected] with requests. You can also complain to the Information Commissioner’s Office at https://ico.org.uk.
Information security and candour
If a confidentiality or data protection incident occurs, I will assess it promptly, take appropriate steps to reduce harm, notify affected individuals and the ICO where required, and review how to reduce the risk of recurrence.
Changes to this notice
I review this notice periodically and update it when practices or legal requirements change. Significant changes affecting client information will be communicated where appropriate. Please read this notice alongside your counselling agreement.