Privacy Policy

Last updated: 21st September 2026

This privacy notice explains how I collect, use, store, and protect personal information in my therapy practice.

I am Sarah Pearson, a counsellor working online and by telephone. I am the data controller for personal information I collect through Sarah Pearson Counselling.

This means I am responsible for deciding how personal information is used and for keeping it safe. If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:

Email: sarahjpearsoncounselling@gmail.com
Phone: 07522 891907
Website: https://www.sarah-pearson-counselling.co.uk
ICO Registration Number: ZB871411

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

Information I Collect

When you contact me, including through my website, I may collect:

Your name
Your email address
Your phone number
The information you choose to share in your enquiry
Any preferences around contact, availability, or therapy format

If we arrange an initial call or begin therapy, I may also collect:

Your address
Your date of birth
Emergency contact details, where appropriate
Relevant health, mental health, or wellbeing information
Information about your personal history, relationships, work, identity, family, circumstances, and reasons for seeking therapy
Brief clinical notes
Attendance, payment, and appointment information
Correspondence between us

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion, or other sensitive areas where these are relevant to therapy. I only collect information that is necessary for providing therapy safely, ethically, and professionally.

How I Use Your Information

I use your personal information to:

Respond to enquiries
Arrange initial calls and appointments
Provide therapy
Keep appropriate clinical records
Manage payments, invoices, and appointments
Communicate with you about sessions
Meet legal, professional, and ethical responsibilities
Manage risk, safeguarding, or emergency situations where necessary
Maintain insurance, tax, and accounting records
Respond to data protection requests or complaints

I do not sell your personal information.

Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information. For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR.
• Contract: Where information is needed to arrange and provide therapy.
• Legitimate interests: Where I need to use information to run my practice safely, respond to enquiries, keep appropriate records, and protect both you and me.
• Legal obligation: Where I need to keep or share information to comply with the law.

Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.

Special Category Data

Because counselling involves processing sensitive information, such as information about physical or mental health, I must also have an appropriate condition under Article 9 UK GDPR.

For special category information processed as part of providing counselling, I rely on Article 9(2)(h) UK GDPR — processing necessary for the provision of health or social care or treatment.

Where I ask for your explicit consent for a separate and optional use of your information, I will explain what I am asking for and how you can withdraw that consent.

Confidentiality & Its Limits

Therapy is confidential, and I handle your personal information with care. I do not normally disclose your personal information to others. I may disclose information where there is a lawful, professional, ethical or safeguarding reason to do so. When sharing is required, I will always restrict it to the minimum information necessary.

There are limited circumstances where confidentiality may need to be broken:

Risk of Harm: If I believe there is a serious risk of harm to you or another person.
Safeguarding: If a child, vulnerable adult, or person at risk is identified as being at risk of harm.
Legal Requirement: If I am required to disclose information by law, a court order, or another legally enforceable requirement.
Prevention or Detection of Crime: If disclosure is necessary to prevent or report serious criminal activity.
Medical Emergency: If urgent disclosure is required to protect life in a medical emergency.
Clinical Supervision: I discuss my casework with a qualified clinical supervisor as part of my professional standards. Your identity is kept pseudonymised/protected as far as possible.

Where safe and appropriate to do so, I will always aim to discuss any necessary disclosure with you before sharing your information. However, I may be unable to inform you beforehand if doing so would increase risk, compromise safeguarding, or defeat the legal purpose of the disclosure.

Who I May Share Your Information With

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate, and lawful:

• My clinical supervisor
• Professional advisers, such as my insurer, or legal adviser
• My professional body, if required in relation to a complaint or ethical matter
• Safeguarding services, emergency services, or your GP, where there is serious risk or safeguarding concern.
• A court or legal authority, if required by law
• An appointed clinical executor if I die or become unable to contact clients myself.
• Trusted digital service providers who process data on my behalf.

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it, and an appropriate transfer mechanism or other safeguard is in place where required.

Record Keeping

I keep personal information only for as long as necessary to fulfill the purposes outlined in this notice, meet legal and insurance requirements, and maintain appropriate clinical records:

Clinical & Session Records: Retained in line with my insurance provider (Holistic Insurance Services) and professional guidelines before being securely deleted or destroyed:
Adults: Retained for 5 years from the date therapy ends.
Clients Under 18: Retained for 5 years after the client's 18th birthday (until their 23rd birthday), or 5 years after therapy ends, whichever is later.
Enquiries: Enquiry communications from individuals who do not proceed to start therapy are deleted after 1 month.
Financial Records: I keep payment and invoicing records for as long as required by law and HMRC for tax and accounting purposes. After this period, the records will be securely deleted.

Data Storage & Security

I take appropriate technical and organisational precautions to protect your personal data against unauthorised access, loss, or misuse:

Clinical Notes & Electronic Files: Session notes and clinical documents are stored electronically on encrypted, password-protected devices. Notes use unique client reference codes rather than names to ensure confidentiality.
Personal & Contact Details: Personal identifiers (such as names, contact details, and signed agreement forms) are stored securely in password-protected digital files accessible only to me (or in locked physical storage where paper records are used).
Digital Correspondence: Emails, website enquiries, and digital communications are hosted on accounts secured with strong passwords and two-factor authentication (2FA).

Online & Telephone Sessions

For online or telephone counselling:

Sessions are conducted using secure, encrypted communication tools.
Both therapist and client agree to participate from a private, quiet space where confidentiality can be maintained.

Recording, Transcripts & AI Tools

I do not record sessions.
I will not use an AI tool, transcription tool or recording software to process therapy sessions without prior written consent.

Website Cookies & Analytics

My website uses cookies and analytics to gather basic technical information about page visits, including where visitors have come from, and to improve website performance. You can manage your cookie preferences using the cookie banner on my website or through your browser settings.

Clinical Executor / Clinical Will

In the event of my unexpected illness, incapacity, or death, a designated Clinical Executor (a qualified counsellor bound by professional confidentiality) will be granted access to client contact details solely for the purpose of notifying active clients and offering support with referrals.

Your Data Rights & ICO Contact

Under UK data protection law, depending on the circumstances and the lawful basis being relied upon, you may have the right to:

request access to your personal information;
ask for inaccurate information to be corrected;
request deletion of your information;
request restriction of processing;
object to certain processing, particularly where I rely on legitimate interests;
request transfer of information you have provided to me in certain circumstances; and
withdraw consent at any time where I am relying on consent.

These rights are not absolute and there may be circumstances where I am legally permitted or required to continue holding or processing information.

Data protection concerns and complaints

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.
Please include:
• Your name
• What your concern is about
• What you would like me to look into
• How you would prefer me to respond

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you about the outcome without undue delay.
If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office via their website at https://ico.org.uk.