Privacy Notice for Mandy Keene
This Privacy Notice was last reviewed in December 2020.
Changes to privacy notice:
This privacy notice may be updated from time to time, so please check occasionally for any updates.
I value your right to privacy. As such I will only use the personal data that you entrust me with for the purpose which it was given to me. Personal information is defined as any information that can be used to identify a living individual. I adhere to the current UK data protection legislation, including the Data Protection Act 2018, General Data Protection Regulation (EU/2016/679 - GDPR), Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and, the ethical guidelines regarding protecting client privacy and confidentiality set by the British Association for Counselling and Psychotherapy (BACP). Your privacy is very important to me and you can be confident your personal information will be kept safe and secure and will only be used for the purpose it was given to me.
This privacy notice covers the following points:
What personal data I collect
The purposes of processing your personal data
The legal basis for processing your personal data
How I store your personal data
Who I share your personal data with and why?
How long your personal data is retained
Your rights around the use of your personal data
How to contact the authority if you have concerns
What personal data do I collect?
When you initially make contact with me, I will collect some basic contact information, including:
Your name
The name and age of a child or young person you are applying on behalf of
Your preferred contact information, i.e. your email address or a telephone number
The reason that you are seeking counselling
These details will be used to determine whether I am in a position to help you address the reasons you are seeking counselling and potentially arrange an initial conversation.
These details will also be used throughout the counselling relationship to communicate with you in relation to appointments.
When you begin your counselling journey with me, I will collect additional personal data as part of my registration process and to ensure that the arrangement and work together can be carried out. This information includes:
Details relating to your general physical health, e.g. level of fitness, amount of alcohol you consume on a weekly basis
Details relating to your current emotional state
Details regarding your sexual orientation, preferred gender pronoun *
Details regarding your nationality *
Age(s) of and relationship of significant others, e.g. parents, siblings, children, partner *
Please note, some of the above personal data (marked with an asterisk (*)) is collected on an optional basis, as it is not essential to carry out the counselling work but can be helpful within it.
You will also be required to sign a Working Agreement (contract) for the type of counselling appointment you undertake, which will also contain
Your signature
Your address
The name, address and contact telephone number of your GP surgery
The name, contact telephone number or email and relationship to you of an emergency contact
Once the counselling work has begun, a record of your sessions will also be kept, in addition to the above-mentioned personal data. This means I will take brief notes during your sessions, to help the counselling agreement run smoothly and serve to aid memory about the work, as is standard professional practice. These notes are available to you to view at any time upon request and are anonymised as much as practically possible to protect your privacy.
(Additional information regarding supervision can be found in the section “Who I share your personal data with and why”.)
The purposes of processing your personal data
As might reasonably be expected, the Data Protection Act 2018 and GDPR both state that personal data can only be collected and used if there is a legal reason for doing so.
The below table will hopefully help show you which legal condition I am relying upon when using your personal data.
| What data | What it is used for | Legal condition | Legitimate Interests |
|---|---|---|---|
| Name and/or contact details | Communications - e.g. initial enquiry, booking appointments etc. | Performance of contract | N/A |
| Issuing invoices for payment | Performance of contract | N/A | |
| Appointment reminders by SMS/email | Explicit consent | N/A | |
| Execution of my professional will | Explicit consent | N/A | |
| Emergency contact name and/or contact details | Communication should an emergency with you arise during a counselling appointment | Legitimate Interest | To aid in meeting my safeguarding requirements. |
| Health information, e.g. details relating to current emotional state | Assessment whether suitable service can be offered | Performance of contract | N/A |
| Session notes | Performance of contract | N/A | |
| Details relating to sexual orientation and nationality | Provision of counselling service | Legitimate Interest | To aid in the counselling work, so the performance of the contract. |
| Details of significant others | Provision of counselling service | Legitimate Interest | To aid in the counselling work, so the performance of the contract. |
| Name and/or contact details of other therapists | Referrals | Explicit Consent | N/A |
How I store your personal data
How I store your personal data depends on the type of record that I hold the personal data on.
Paper records, such as signed working agreements or session notes will be stored in secured filing cabinets contained in areas with access restrictions.
Electronic records, such as your contact details, are stored in a number of different systems, including those listed in the section “Who I share your personal data with and why”. As far as is reasonably practical, these systems have been carefully selected on grounds of the security they enforce. All systems are set up with unique username and strong password combinations and utilise access controls to restrict unauthorised access.
Who I share your personal data with and why?
Confidentiality is at the heart of my counselling practice. As such, I do my best to ensure that your personal data is kept safe and secure. However, there are instances when your personal data may need to be shared with third parties. Below is a list of third parties that you can expect your personal data to be shared with, and in what situation.
Please note, where links have been included, I cannot accept responsibility for the content contained within their web pages.
| Recipient of data | Reason for sharing data | Type of data shared |
|---|---|---|
| Email provider | I currently use Protonmail, which is a secure email provider. You can find details of their privacy notice here: |
Whatever personal data you include in an email; including information such name and contact information and, in the case of the initial enquiry, details regarding the reason that you are seeking counselling. |
| Website provider | If you have contacted me via the counselling@unit12 website, SquareSpace are the website provider and you can find details of their privacy notice here: squarespace.com/privacy If you are looking for information about the cookies this website uses, please refer to the cookie policy at cau12.com/cookie-policy. |
Name, contact information and reason for seeking counselling if supplied using the website’s Contact Form. |
| Video call software |
We use Zoom for all of our remote counselling sessions. Zoom is a secure and encrypted service and is free for you to access and download. You can find Zoom’s privacy notice on www.zoom.us/privacy |
Your name as you enter it when you join the Zoom meeting. |
| Counselling supervisors | Under the BACP Ethical Framework our counsellors are required to attend regular sessions with a trained Supervisor. During supervision sessions, your privacy and confidentiality will be protected by only referring to you by your first name. Any other details relating to your therapy will be anonymised as much as possible. |
- First name only - to protect your privacy. - General details relating to your therapy sessions. - Specific details relating to your therapy sessions should an emergency or issue relating to your safety arise. |
| Emergency services |
In the event that an emergency took place during a counselling session, or if a safeguarding issue was raised, I might be required to contact one of the emergency services and provide them with your personal data. Please note, where possible, I will always seek to get your consent prior to contacting the emergency services. |
- Name and contact details – to help the emergency services identify you. - Details relating to your safety or a serious crime that you have disclosed, should it be a legal requirement to do so. |
| GP Surgery |
In the event that, during a counselling session, I was concerned about your wellbeing or safety, I may ask for your consent to contact your GP on your behalf. |
Your name and contact information would need to be shared to help the surgery identify you. |
| Other contacts or services, e.g. parents/carers, social workers, schools, local authorities etc. | In cases where the client is a child or young person, if they were to disclose information relating to a safeguarding concern, it may be necessary to contact their parent/carer, or if they are in care, the organisations relating to their care. Please note, depending on the concern raised, consent from the child would be sought in advance. |
- Name and contact information. - Details relating to the safeguarding concern that has been disclosed. |
| Other therapists |
Should I not be able to provide the help needed, I may ask for your consent to refer your contact information to another therapist. |
- Name and contact information. - General information relating to the reason you are seeking counselling. |
| Executors of a will and related service providers | In the unforeseen event of my death or incapacity to work, your personal data will be handled by the executor of my professional will, in order to inform you. | Name and contact information. |
Your rights relating to your personal data
Your personal data belongs to you. As a client, you entrust your personal data to me, so that I can provide you with the therapeutic help that you are seeking, but you retain certain rights over your data and how it is used.
Below are a list of your rights and how you can exercise them.
The right to be informed
In a nutshell, this is your right to know how and why your data is being collected and used by me. I hope that this privacy Notice provides you with that information. Should anything be unclear though, please do not hesitate to contact me by email on mandyak@protonmail.com
The right of access
You have a right to know what data I hold on you. As the controller of your data, I am required to respond to any request that you make to see the data I hold within 30 days of you making such a request. This is commonly referred to as a Data Subject Access Request. If you would like to see the data, I hold on you, please email mandyak@protonmail.com or speak to me directly if you have started your counselling work with me already.
Please note, while it may sound contradictory, to properly protect your privacy, I may be required to request additional personal data to verify your identity before providing the personal data to you if you email me with a data subject access request. This is in an effort to stop other people claiming to be you from getting access to your personal data.
The right to rectification
You have the right to ensure that any personal data that you have provided me with is correct. As such, if your circumstances change, for example you get a new contact telephone number, or wish to change your preferred method of contact from telephone to email, please do provide me with the up-to-date information and I will correct my records immediately.
Please note, there may be circumstances where I am not required to follow up on you exercising your right for rectification. Full details about this right can be found here:
ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected
The right to erasure
This right allows you to ask me to delete the personal data I hold on you. However, there are certain instances when I would not be able to honour your request, including those were I am under legal obligations to retain the data, for instance the HMRC requirement for our financial records to be held for 5 financial years.
Also, please note, while you are actively engaged with the counselling work, I would not be able to delete the personal data that I hold on you, as this is required by us to fulfil our side of the working agreement.
The right to restrict processing
Related to your right to erasure, you have a right to restricting how I use the personal data that you have provided me with. This right is closely linked to your right to erasure, and also has some restrictions as to when it can be exercised.
If you would like more information about this right, you can find some here:
ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data
The right to data portability
Should you wish to move from using me, to another therapist, you have the right to request that I make the personal data we hold on you available in a format that easily accessible and machine-readable. Specifically, this right applies to data we hold electronically.
Should you wish to exercise this right, please do contact me via email at mandyak@protonmail.com
The right to object
Another right that is similar to both the ‘right to erasure’ and the ‘right to restrict processing’ is your right to ask me to stop using your data at any time.
This again does only apply in certain circumstances and you can find additional information here:
ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data
Rights in relation to automated decision making and profiling
I do not profile you or make any automated decisions regarding you in any way. As such, while this is a right you have, it does not apply to the services I provide.
How to contact the authority if you have concerns
If you have any concerns around the use of your personal data, I would, prefer it is you would address these with me first. You can either contact me by email at mandyak@protonmail.com or, if you are a current client, you can speak to me directly.
However, if you do not feel that I am providing you with a satisfactory response, you are also entitled to lodge a complaint with the Information Commissioner’s Office (ICO), which is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. You can contact the ICO via their website: ico.org.uk
My contact and registration details
Name: Mandy Keene
You can contact me by email at mandyak@protonmail.com or Telephone: 07519 494279
I am registered with The British Association of Counselling & Psychotherapy (BACP). My registration number is 377692. I am registered with the Information Commissioner’s Office, registration number: ZA509365.