Privacy Notice
Practice Details
Practice Name: HollyTree Wellbeing Services
Counsellor: Holly Webb
Email: hollytreewellbeing@gmail.com
BACP Membership Number: 396453
ICO reference: ZB606405
Effective Date: July 2026
Review Date: July 2027
My Commitment to Your Privacy
Protecting your privacy and maintaining your trust is fundamental to my counselling practice.
I am committed to handling your personal information fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all other applicable data protection legislation. As a registered member of the ICO and the British Association for Counselling and Psychotherapy (BACP), I also adhere to the BACP Ethical Framework for the Counselling Professions, which includes strict requirements regarding confidentiality, record keeping and professional conduct.
Whether you are contacting me for yourself, your child or a young person in your care, I will always treat your personal information with the utmost respect and confidentiality.
What Information I Collect
Depending on the nature of the counselling service, I may collect and process the following information:
Your name, address, telephone number and email address.
Your child's or young person's personal details where applicable.
Date of birth.
Emergency contact details.
GP details.
School, college or other educational setting (where relevant).
Relevant medical, developmental or mental health information.
Information shared during assessments and counselling sessions.
Session notes and clinical records.
Risk assessments and safeguarding information where appropriate.
Appointment history.
Payment and invoicing information.
Correspondence relating to appointments and counselling.
I only collect information that is relevant and necessary to provide a safe, ethical and effective counselling service.
How I Collect Your Information
Most personal information is collected directly from you when you:
Contact me to enquire about counselling.
Complete referral, Gor consent forms.
Attend assessment or counselling sessions.
Communicate with me by email, telephone or text message.
With your knowledge and, where appropriate, your consent, I may also receive relevant information from other professionals involved in your care or your child's care, such as GPs, schools or other healthcare professionals.
Why I Collect Your Information
Your personal information is collected to:
Provide safe and effective counselling.
Assess your needs and plan appropriate therapeutic support.
Maintain accurate counselling records.
Communicate with you regarding appointments and the counselling service.
Meet safeguarding responsibilities.
Comply with legal, ethical, professional and insurance requirements.
Protect the health, safety and wellbeing of clients where necessary.
Legal Basis for Processing Your Information
Under UK GDPR, I process personal information because it is necessary to provide counselling services and fulfil my professional and legal responsibilities.
Counselling records include information about health and emotional wellbeing and are therefore classified as Special Category Personal Data, which receives additional legal protection under UK data protection law.
Confidentiality
Everything discussed during counselling is treated as confidential.
There are, however, some circumstances where confidentiality may need to be broken. These include situations where:
There is a safeguarding concern involving a child or vulnerable adult.
There is a serious risk of harm to you or another person.
Disclosure is required by law or by a court.
Information is required to prevent or detect a serious crime.
Wherever possible, I will discuss any proposed disclosure with you before sharing information unless doing so would increase the risk of harm.
Professional Clinical Supervision
As a requirement of my membership of the British Association for Counselling and Psychotherapy (BACP), I attend regular professional clinical supervision.
Supervision supports safe, ethical and effective practice. Client work may be discussed with my clinical supervisor; however, wherever possible, identifying information is removed or anonymised. My supervisor is also bound by professional confidentiality and ethical standards.
Clinical Executor
In the event of my death, serious illness or permanent incapacity, I have appointed a Clinical Executor.
The Clinical Executor is a suitably qualified professional who is bound by the same duties of confidentiality. Their role is to ensure that clients are informed where appropriate and that counselling records continue to be managed securely and in accordance with legal, ethical and professional requirements.
How Your Information Is Stored
I take appropriate technical and organisational measures to protect your personal information.
Electronic records are securely stored using password-protected and encrypted systems with two-factor authentication where available.
Paper records, signed documents and children's artwork are stored securely in locked storage when not in use.
Access to personal information is restricted to authorised persons only.
Who I May Share Information With
Your information will never be sold or shared for marketing purposes.
Information will only be shared where:
You have provided your informed consent.
There is a safeguarding concern.
There is a serious risk of harm.
Disclosure is required by law.
Disclosure is necessary for legal proceedings.
Disclosure is required by my professional indemnity insurer or legal advisers.
Client work is discussed during professional clinical supervision using anonymised or pseudonymised information wherever possible.
Only the minimum information necessary will be shared.
Third-Party Service Providers
To support the safe and effective delivery of my counselling practice, I use a small number of carefully selected third-party providers who may process personal information on my behalf.
These providers are only used where necessary to deliver my services and are expected to maintain appropriate security and confidentiality standards.
The providers I currently use are:
Squarespace – to host and maintain my website.
Google Drive – for the secure electronic storage of practice documents and counselling records. Access is protected using password security and two-factor authentication (2FA).
If I introduce additional service providers in the future (for example, an online booking system, payment provider or video consultation platform), this Privacy Notice will be updated accordingly.
International Transfers
Some of the third-party providers I use, including Google Workspace and Squarespace, may process or store personal information outside the United Kingdom.
Where this occurs, I ensure that appropriate safeguards are in place to protect personal information in accordance with UK data protection legislation.
How Long I Keep Records
Records are retained only for as long as necessary, in accordance with UK data protection legislation, professional guidance issued by the British Association for Counselling and Psychotherapy (BACP), and the requirements of my professional indemnity insurer.
Adult client records (including counselling agreements and session notes) are retained for 7 years after counselling ends, unless a longer retention period is required by law or my professional indemnity insurer.
Child and young person client records are retained until the client's 25th birthday, or 26th birthday if they were 17 when counselling ended, unless a longer retention period is required by law or my professional indemnity insurer.
Initial enquiries where counselling does not commence are retained for 12 months from the date of enquiry.
Financial records (including invoices and accounting records) are retained for 6 years in accordance with HMRC requirements.
Appointment records are retained as part of the client record and are kept for the same retention period as the counselling record.
Safeguarding records are retained as part of the client record and are kept for the same retention period as the counselling record, unless legal or safeguarding requirements require a longer retention period.
When records are no longer required, paper records are confidentially shredded and securely disposed of, and electronic records are permanently deleted using secure methods. Records are retained only for as long as necessary to meet legal, professional and insurance requirements.
Your Rights
Under UK GDPR you have the right to:
Be informed about how your information is used.
Request access to your personal information.
Request correction of inaccurate information.
Request restriction of processing in certain circumstances.
Object to processing where applicable.
Request erasure of personal information where legally possible.
Receive certain information in a portable format where applicable.
Not be subject to automated decision-making or profiling. I do not use automated decision-making or profiling in my practice.
Some rights may be limited where I have legal, ethical or professional obligations to retain records.
Data Breaches
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, I will investigate the breach promptly and, where required by law, notify the Information Commissioner's Office (ICO) and any affected individuals without undue delay.
Cookies
My website may use cookies to improve your browsing experience and to help the website function effectively.
Further information can be found in my separate Cookie Policy.
Contacting Me
If you have any questions about how your personal information is used, or if you wish to exercise any of your data protection rights, please contact:
Name: Holly Webb
Email: hollytreewellbeing@gmail.com
Complaints
If you have concerns about how your personal information has been handled, I encourage you to contact me first so that I have the opportunity to resolve the matter.
You also have the right to complain to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Policy Review
This Privacy Notice is reviewed annually and updated whenever necessary to reflect changes in legislation, professional guidance or working practices.
Version: 1.0
Next Review: July 2026