Privacy Policy

Privacy Notice

Charlotte Sharpe Counselling & Psychotherapy

ICO Registration Number: ZA655767

Date Revision History

27/02/2023 1.0

14/03/2024 1.1

11/05/2026 2.0

1. Introduction

Your privacy and confidentiality are extremely important to me. This Privacy Notice explains how I collect, use, store and protect your personal information in relation to the counselling, psychotherapy, peer support, and psychoeducational group services that I provide, in accordance with:

UK General Data Protection Regulation (UK GDPR)
Data Protection Act 2018
Privacy and Electronic Communications Regulations 2003

I am registered with the Information Commissioner's Office (ICO).

2. Data Controller

Charlotte Sharpe
Email: info@charlottesharpe.co.uk
Website: https://www.charlottesharpe.co.uk

I am the Data Controller responsible for your personal data.

3. What Information I Collect

I only collect information that is necessary for providing safe and effective therapy. To provide a professional and safe service, I collect information about you that includes personal and sensitive ‘special category’ data. This is largely collected directly from you, but it may also be provided to me by referring agencies such as your GP.

Personal Data

Name
Date of birth
Address
Telephone number
Email address
Emergency contact details
GP details
Payment information

Special Category (Sensitive) Data

Presenting difficulties
Medical and mental health history
Medication information
Relationship and family information
Information relating to children (where relevant)
Session notes and outcome measures

This information is collected directly from you or from a referrer (with your knowledge).

Peer Support & Group Work

Where I facilitate peer support or psychoeducational groups, the type of information collected may vary depending on the nature of the group and the organisation through which the group is delivered.

For some independently facilitated groups, I may collect:
• Name
• Email address
• Telephone number
• Emergency contact details (optional)
• GP details (optional)

This information is used for group administration, communication, attendance management, and safeguarding follow-up where necessary. For groups delivered in partnership with a charity or external organisation, participant contact details may be collected and held by the organising organisation and shared with me solely for the purpose of facilitating the group. In these circumstances, safeguarding procedures and risk escalation processes may be managed under the organisation’s safeguarding framework. Following group sessions, I may keep brief facilitator records containing factual observations, safeguarding actions, group themes, and reflective notes to support safe and ethical practice. These records are proportionate to the nature of the group work and do not contain detailed psychotherapy process notes.

4. Lawful Basis for Processing

Under UK GDPR, I rely on the following lawful bases:

Performance of a contract – to provide therapy services
Provision of health care (Article 9(2)(h)) – for processing special category data necessary for therapeutic work
Legitimate interests – for record retention, insurance, and practice administration
Legal obligation – where required by law (e.g. safeguarding, court orders)
Consent – for newsletters, testimonials, or sharing information with third parties where appropriate

You may withdraw consent at any time where consent is the lawful basis.

5. How I Use Your Information

To respond to enquiries
To assess suitability for therapy
To provide counselling services
To manage appointments, including payments and invoices
To maintain clinical records
To comply with legal and professional requirements
To facilitate peer support and psychoeducational groups
To manage safeguarding and wellbeing concerns within group settings.

6. Confidentiality

Confidentiality is central to therapeutic work. Information will not be shared without your consent unless:

There is serious risk of harm to you or others
A child or vulnerable adult is at risk
Required by law or court order
Where there is a legal duty to disclose, including in relation to terrorism, serious crime, or safeguarding concerns.

As required by the British Association for Counselling and Psychotherapy Ethical Framework, I attend supervision. All supervision discussions are anonymised.

If you were referred to me via your GP, or require a report for further sessions via your insurer, with your consent, I may write to them with an assessment and /or discharge summary. Reports will be sent securely via a password-protected document or Royal Mail recorded delivery.

In the event of my death or sudden incapacity, my appointed Therapeutic Executor (a qualified therapist adhering to the same ethical framework) will access your contact details, on a lawful basis of legitimate interests and professional obligation, only to advise you of the situation and ensure ongoing data security and appropriate onward arrangements.

For group-based services, participants are asked to respect the confidentiality and privacy of other group members. However, as group sessions involve multiple participants, confidentiality between participants cannot be absolutely guaranteed.

7. Record Keeping & Retention

I am committed to taking all reasonable steps to protect any personal, sensitive and identifiable information that I hold about you. The ways in which your data is stored, and the timeframes for retention and deletion at each stage of your engagement/ treatment pathway are outlined below:

Clinical Notes

Initial appointment information and identifying demographic information are stored separately. They are also stored separately from clinical and process notes.
Anonymised using a client code
Stored securely (locked cabinet or password-protected device)
Retained for 7 years after therapy ends
Securely destroyed thereafter

Process Notes

Brief reflective notes
Contain no identifying information
Destroyed after supervision or within 2 months

Facilitator Records (Group Work)

For peer support or psychoeducational groups, I may retain brief facilitator records following sessions. These may include:

General group themes
Group atmosphere and engagement
Factual safeguarding or wellbeing observations
Actions taken or follow-up required
Brief facilitator reflections

These records are proportionate to the nature of the group work, stored securely, and retained only for as long as necessary in line with professional, safeguarding, and insurance requirements.

For independently facilitated groups, participant contact details are generally retained for up to three months after the final group session for administrative and safeguarding purposes, unless there is a legal or professional obligation to retain them longer.

For groups delivered on behalf of an external organisation or charity, participant data retention may also be subject to that organisation’s own privacy and safeguarding policies.

Email Retention

I use Gmail for email correspondence and Google Calendar for managing appointments, which are anonymised with a code.

Referral emails where therapy does not proceed are deleted after one month.
Administrative emails are deleted at the end of the month following our final session. Any clinically relevant information is recorded within clinical notes and retained in line with record-keeping requirements.

Although Gmail uses encryption, please note that email is not a fully secure method of communication. Sensitive information is best discussed during sessions.

Payment

If you choose to pay me by electronic bank transfer, then I may hold a record of this transfer through my bank. This data is secured by the bank’s security systems; I do not store full bank details. Payment records are retained in line with HMRC requirements.

8. Website & Cookies

My website is hosted by Wix.

When you visit the site:

Standard website usage data may be collected (e.g. pages visited, duration) to help optimise use of the website. Where required, consent is obtained via the cookie banner before non-essential cookies are used.
This information does not directly identify you.
Lawful basis: Legitimate interests (website functionality and improvement).

If you complete a contact form, your details are temporarily processed via Wix before being transmitted to me securely.

Wix may store data on servers outside the UK. Appropriate safeguards are in place.

You can manage cookies via the website cookie banner.

Wix Privacy Policy can be found here.

9. Third-Party Services

Newsletter – Mailchimp

If you subscribe to my newsletter:

Your name and email address are stored by Mailchimp.
Lawful basis: Consent.
You may unsubscribe at any time via the link in emails.
Therapy clients are not automatically added.

Mailchimp may process data outside the UK with appropriate safeguards. Mailchimp privacy policy can be found on their website.

Feedback & Testimonials – Typeform

If you choose to provide feedback or a testimonial:

Participation is entirely voluntary.
Lawful basis: Consent.
Testimonials are published only with explicit written permission.
You may choose to remain anonymous.

Typeform may process data outside the UK with appropriate safeguards. Typeform privacy policy can be found on their website.

10. Data Security

I take appropriate measures to protect your information:

Password-protected devices
Secure email account
Locked filing cabinet for paper records
Limited access to information
Regular review of data protection practices

11. International Transfers

Some third-party providers (Wix, Gmail, Mailchimp, Typeform) may store or process data outside the UK. Where this occurs, appropriate safeguards such as Standard Contractual Clauses are in place in line with UK GDPR.

12. Your Rights

Under UK GDPR you have the right to:

Access your personal data - You have the right to ask me for copies of your personal information.
Request correction of inaccurate data - You have the right to ask me to rectify personal information you think is inaccurate. You also have the right to ask me to complete information you think is incomplete.
Request erasure (where legally permissible) - You have the right to ask me to erase your personal information in certain circumstances.
Restrict processing - You have the right to ask me to restrict the processing of your personal information in certain circumstances.
Object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Request data portability - You have the right to ask that I transfer the personal information you gave me to another organisation, or to you, in certain circumstances.

Requests can be made via email to info@charlottesharpe.co.uk and will be responded to within one month.

13. Complaints

In the unlikely event of a data breach, I will act in accordance with ICO guidance. If you have concerns about how your data is handled, please contact me in the first instance. You have the right to lodge a complaint at any time with the UK supervisory authority, Information Commissioner's Office:

Website: https://www.ico.org.uk
Helpline: 0303 123 1113

14. Review of This Policy

This Privacy Notice is reviewed periodically to ensure continued compliance with UK GDPR and professional standards.