Privacy Policy

Effective Date: October 2026

Data Controller: Alex Carling (Trading as Alex Carling: Training & Therapeutic Services)

Website: www.counsellinginhull.co.uk

Contact Email: alex@counsellinginhull.co.uk

Telephone: 07980 291528

Address: Bespoke Centre, Zeals Garth, Hull, HU7 4WD

At Alex Carling: Training & Therapeutic Services, I am committed to respecting and protecting your privacy. This Privacy Policy explains how I collect, use, store, and safeguard your personal information when you visit my website, make an enquiry, or engage in therapeutic services with me.

As a registered member of the National Counselling and Psychotherapy Society (NCPS) and registered with the Information Commissioner’s Office (ICO), I handle all personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. The Personal Information I Collect

When you contact me or engage in therapy, I may collect and process the following information:

  • Contact & Identity Data: Full name, home address, email address, telephone number, and date of birth.

  • Emergency & Medical Details: GP contact details and a nominated Emergency Contact / Next of Kin.

  • Financial & Billing Data: Bank details, invoice history, and transaction records (where payment is made via bank transfer or invoice).

  • Clinical Data (Special Category Data): Brief written session notes, health history, and details relevant to your therapeutic work.

  • Technical & Digital Data: IP address, browser type, device information, and browsing activity collected automatically via website cookies when visiting my site.

2. Lawful Basis for Processing Data

Under UK GDPR, I must have a lawful basis to collect and process your personal information:

  • Contract (Article 6): Processing your contact details, appointment schedules, and billing information is necessary to fulfill our therapeutic agreement and manage your bookings.

  • Health or Social Care Treatment (Special Category Data - Article 9(2)(h)): Processing your clinical notes and health-related information is necessary to provide safe, professional, and ethical psychotherapy.

  • Legitimate Interests (Article 6): Processing website performance data and analytics to ensure my website functions smoothly and securely.

  • Legal Obligation (Article 6): Keeping financial records for accounting and tax compliance, or fulfilling statutory reporting duties under UK law.

3. How Your Information Is Used

Your personal information is used solely to:

  • Respond to initial enquiries and manage consultation bookings.

  • Deliver safe, ethical, and effective therapeutic services (face-to-face or online via Zoom).

  • Process invoices and payments.

  • Maintain accurate, anonymised clinical notes for practice progression.

  • Contact designated emergency contacts or health professionals if there is a severe safety concern.

4. How Your Data Is Stored & Third-Party Processors

I do not sell, rent, or trade your personal data to third parties. To run my practice and website securely, I use trusted, GDPR-compliant software processors:

  • Squarespace: My website hosting platform. Squarespace securely processes contact form submissions made via the site and collects basic digital analytics.

  • Bacpac: Secure, encrypted software used for recording and storing clinical notes.

  • Google Workspace: Used for business email communications, online calendar bookings, and encrypted cloud storage.

  • FreeAgent & Mettle (NatWest): Secure accounting software and business banking used to process invoices, record bank transfers, and manage financial records.

  • Zoom: Encrypted video platform used for conducting online therapy sessions.

5. Confidentiality & Exceptions

What you share in therapy is held in strict confidence. Information is only shared outside our sessions in the following rare circumstances:

  1. Risk of Serious Harm: If I assess that you or another person are at immediate and serious risk of harm, I may contact your GP or emergency services. Where practicable and safe, I will discuss this with you first.

  2. Statutory Legal Obligations: By UK law, I am required to disclose information to relevant authorities regarding acts of terrorism, money laundering, or drug trafficking.

  3. Clinical Supervision: In accordance with NCPS requirements, I undertake regular professional supervision. Clinical discussions are completely anonymised to ensure your identity is protected.

  4. Clinical Will: In the event of my sudden illness, incapacitation, or death, a trusted Clinical Trustee (a qualified colleague bound by strict confidentiality) will be granted access to client contact details solely to inform you and ensure continuity of care.

6. Data Retention

I keep your personal data only for as long as necessary to fulfill the purposes for which it was collected and to meet legal, accounting, and insurance requirements:

  • Adult Clinical Notes & Records: Retained for 7 years following the end of therapy, in accordance with Balens insurance guidelines, after which they are securely deleted.

  • Young Persons’ Records (Under 18): Retained for 7 years after reaching age 18 (until age 25), after which they are securely deleted.

  • Website Enquiry Forms: Contact submissions made through my Squarespace website are deleted from the website storage once processed into my secure practice management system.

  • Financial & Transaction Data: Retained for 6 years following the end of the financial tax year to satisfy HMRC accounting requirements.

7. Cookies & Website Analytics

My website is built on Squarespace and uses cookies to help the site run effectively and provide visitor metrics:

  • Essential / Functional Cookies: Required for the website to navigate and function securely. These do not require user consent.

  • Analytics & Performance Cookies: Squarespace Analytics uses cookies to gather anonymous information about website traffic, visitor numbers, and how pages are navigated.

  • Cookie Management: You can accept or decline non-essential analytics cookies at any time using the cookie banner on my website, or by adjusting your web browser settings.

8. Social Media

I maintain professional social media pages for mental health education. Messages sent via social media platforms (such as Facebook or Instagram) are not fully secure. If you contact me on social media, I will request that we move our communication to secure email.

9. International Data Transfers

Some of the digital tools I use (such as Squarespace, Google Workspace, and Zoom) store data on servers located outside the UK/EEA (e.g., in the US). Where international transfers occur, your data is protected using UK-approved legal safeguards, such as Standard Contractual Clauses (SCCs) or the UK Extension to the EU-US Data Privacy Framework.

10. Your Statutory Rights Under UK GDPR

You have specific statutory rights regarding your personal data:

  • Right of Access: You have the right to request a copy of the personal information and clinical notes I hold about you (a Subject Access Request).

  • Right to Rectification: You can request that I correct any inaccurate or incomplete personal information.

  • Right to Erasure ('Right to be Forgotten'): You can request the deletion of your personal data, subject to legal and insurance retention obligations (e.g., Balens 7-year note retention rule).

  • Right to Restrict Processing: You can ask me to pause or restrict how your data is used under certain circumstances.

To exercise any of these rights, please email me at alex@counsellinginhull.co.uk.

11. How to Raise a Concern

If you have any questions, concerns, or complaints about how your personal data is handled, please contact me directly so I can address the issue promptly.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):