Introduction

Huda Therapy & Wellbeing is committed to protecting your privacy and handling your personal information with care, respect and confidentiality. This Privacy Policy explains what personal information is collected, how it is used, how it is stored, and the rights you have in relation to your information.

Personal information is processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the professional standards of the British Association for Counselling and Psychotherapy (BACP).

Information Collected

In order to provide counselling services safely and professionally, Huda Therapy & Wellbeing may collect and hold the following types of personal information.

Personal Details

This may include:

• your name, date of birth, address, telephone number and email address.

Therapy-Related Information

Information relevant to counselling may include:

• the reasons you are seeking counselling;
• information about your emotional and psychological wellbeing;
• relevant health or medical history;
• medication details where appropriate; and
• personal circumstances relevant to the therapeutic work.

This information may include special category personal data under UK data protection law, which is subject to additional legal protection.

Clinical Notes

Brief professional notes may be made following appointments. These may include:

• session dates;
• themes discussed;
• clinical observations;
• risk assessments where necessary; and
• agreed therapeutic goals.

Emergency Contact Information

Emergency contact details may be requested where this is appropriate for safe practice.

Financial Information

Financial records may include:

• invoices;
• payment dates;
• transaction references; and
• payment confirmations received through payment providers such as Stripe, where applicable.

Huda Therapy & Wellbeing does not store full card details. Card payment information is processed securely by the relevant payment provider in accordance with their own privacy and security standards.

Website Enquiries

If you contact Huda Therapy & Wellbeing through the website, email or a contact form, the information you provide may be retained in order to respond to your enquiry.

How Information Is Collected

Most personal information is collected directly from you.

This may occur when you:

• make an enquiry about counselling;
• complete an assessment, registration or intake form;
• attend counselling sessions;
• communicate by email, telephone or online platform;
• book appointments;
• make a payment; or
• contact the practice through the website.

Personal information is not routinely collected from third parties unless you have given consent or there is a lawful reason for doing so.

Lawful Basis for Processing

Personal information is processed only where there is a lawful basis under UK GDPR.

For counselling services, the lawful basis for processing personal data is generally:

• Article 6(1)(b) UK GDPR – processing is necessary for the performance of a contract.

Where health or therapy-related information is processed, the additional lawful basis is:

• Article 9(2)(h) UK GDPR – processing is necessary for the provision of health or social care by a qualified professional.

Processing is also carried out in accordance with the relevant provisions of the Data Protection Act 2018.

How Personal Information Is Used

Personal information may be used for the following purposes:

• providing counselling services;
• communicating with you about appointments and therapy;
• maintaining appropriate clinical records;
• managing payments and invoices;
• meeting legal, ethical and insurance obligations;
• responding to enquiries; and
• managing safeguarding concerns where necessary.

Personal information is not sold, rented or used for unrelated marketing purposes without consent.

Professional Supervision

As part of safe and ethical practice, Huda Therapy & Wellbeing undertakes regular clinical supervision.

When client work is discussed in supervision:

• identifying details are removed or anonymised where possible;
• only information relevant to clinical practice is shared; and
• the supervisor is also bound by professional and ethical duties of confidentiality.

Supervision forms an important part of maintaining safe, reflective and effective therapeutic practice.

Clinical Executor

Huda Therapy & Wellbeing has appointed a Clinical Executor as part of responsible practice planning.

If the Practice Owner becomes unable to continue practising due to serious illness, incapacity or death, the Clinical Executor may access essential client information solely for the purpose of:

• notifying clients;
• supporting referrals where appropriate;
• ensuring records continue to be stored securely; and
• arranging confidential destruction of records when retention periods expire.

The Clinical Executor is bound by the same standards of confidentiality and professional responsibility.

Sharing Personal Information

Personal information will be treated as confidential and will not be shared unless there is a lawful, ethical or professional reason to do so.

Information may be shared in limited circumstances with:

• the clinical supervisor, using anonymised case material only;
• trusted third-party service providers who support the practice;
• emergency services or statutory authorities where disclosure is required by law or necessary to protect someone from serious harm; or
• the Clinical Executor if this becomes necessary due to the Practice Owner’s incapacity or death.

Third-Party Service Providers

Huda Therapy & Wellbeing uses carefully selected third-party providers to support the delivery of services. These may include:

• WebHealer
• WordPress
• Calendly
• Zoom
• Microsoft Teams
• Google Meet
• Stripe

These providers may process personal information only where necessary for the service they provide and are expected to comply with relevant data protection requirements.

International Transfers

Some third-party providers used by Huda Therapy & Wellbeing may process personal information outside the United Kingdom.

Where this occurs, reasonable steps will be taken to ensure that appropriate safeguards are in place in accordance with UK data protection law.

Further information about international data transfers can be requested by contacting the practice.

Retention of Information

Personal information is retained only for as long as necessary to meet professional, legal and insurance obligations.

Further details about retention periods can be found in the Huda Therapy & Wellbeing Data Retention Policy.

Confidentiality and Its Limits

Confidentiality is a core part of counselling practice. Information shared in therapy will remain confidential unless there is a legal, ethical or safeguarding reason requiring disclosure.

This may include circumstances where:

• there is a serious risk of harm to you or another person;
• there are safeguarding concerns relating to a child or vulnerable adult;
• disclosure is required by a court order; or
• another legal duty requires information to be shared.

Where it is safe and appropriate to do so, disclosure will be discussed with you first.

Your Rights

Under UK GDPR, you have a number of rights in relation to your personal information. These include the right to:

• be informed about how your information is used;
• request access to the personal information held about you;
• ask for inaccurate or incomplete information to be corrected;
• request erasure of information where applicable;
• request restriction of processing in certain circumstances;
• object to certain types of processing;
• receive certain information in a portable format where applicable; and
• complain to the Information Commissioner’s Office (ICO).

Please note that some information may need to be retained where this is required by law, professional guidance or insurance obligations.

Policy Review

This Privacy Policy will be reviewed annually or sooner if there are changes to legislation, professional guidance or the way Huda Therapy & Wellbeing processes personal information.