────────────────────────────

Your privacy matters

This notice explains how The Quiet Within collects, uses, stores and protects personal information when you contact the practice, visit the website or receive counselling. It is written in plain language and is intended to help you understand your rights and how your information is handled.

1. Who is responsible for your information?

The Quiet Within is a private counselling practice operated by Sophie Lodge. For data protection purposes, Sophie Lodge is responsible for the personal information processed by the practice.

If you have questions about this notice or how your information is handled, please contact:

Email: thequeitwithincounselling@gmail.com

Website: thequietwithin.co.uk

2. What information do I collect?

Depending on how you interact with the practice, I may collect:

• Your name, preferred name and contact details;

• Appointment and payment information;

• Information you provide when you contact the practice or enquire about counselling;

• Information you provide during an assessment or counselling sessions, including information about your wellbeing, circumstances and experiences;

• Information relevant to safety, safeguarding and risk where this is necessary for safe professional practice;

• Correspondence and records relating to your counselling;

• Technical information generated when you use the website, such as information collected through cookies or similar technologies, where applicable.

I aim to collect only information that is relevant and necessary for the purposes described in this notice.

3. How and why do I use your information?

I use personal information to:

• respond to enquiries and arrange appointments;

• provide counselling and communicate with you about your sessions;

• maintain appropriate professional records;

• consider and respond to safeguarding or safety concerns where necessary;

• process payments and keep appropriate financial records;

• meet legal, professional, insurance and regulatory responsibilities;

• manage complaints or concerns;

• maintain the security and functioning of the practice and website;

• respond to requests about your data protection rights.

4. What are my lawful bases for using your information?

Data protection law requires me to identify a lawful basis for processing personal information. Depending on the purpose, I may rely on:

• Contract: where processing is necessary to provide the counselling service you have asked for or to take steps at your request before entering into an agreement.

• Legal obligation: where I need to process or retain information to comply with a legal requirement, such as certain financial or record-keeping obligations.

• Legitimate interests: where processing is necessary for legitimate interests of the practice, provided those interests are not overridden by your rights and interests.

• Vital interests: in exceptional circumstances where processing is necessary to protect someone's life.

• Consent: where I ask for consent for a specific processing activity and consent is the appropriate lawful basis.

The lawful basis used will depend on the particular processing activity. I will not rely on consent where another lawful basis is more appropriate.

5. Health and other special category information

Information about your physical or mental health is special category personal data and receives additional protection under UK data protection law. Where I process health information as part of providing counselling, I will identify and document an appropriate Article 6 lawful basis and an Article 9 condition, together with any additional safeguards required by law.

I will only collect and use information that is relevant and necessary for safe and appropriate counselling practice.

6. Confidentiality and information sharing

Counselling is normally confidential. However, there may be circumstances in which information needs to be shared, for example where there is a serious concern about your safety or the safety of another person, a safeguarding concern, a legal requirement to disclose information, or where disclosure is otherwise permitted or required by law.

I also attend professional clinical supervision. Relevant aspects of my work may be discussed with my supervisor for the purposes of safe and ethical practice. I will take reasonable steps to protect your identity and confidentiality.

Where information needs to be shared, I will aim to discuss this with you where it is safe and appropriate to do so.

7. Who might I share your information with?

I do not sell your personal information. I may share information with appropriate third parties where necessary and lawful, for example:

• my clinical supervisor, with identifying information minimised or anonymised wherever possible;

• professional, legal, insurance or regulatory advisers where necessary;

• service providers who help me operate the practice, such as secure website, email, scheduling, payment or document-storage providers;

• emergency services or other appropriate professionals where necessary to protect life or safety;

• public authorities or other organisations where I am legally required or permitted to disclose information.

Where I use third-party service providers, I will take appropriate steps to ensure personal information is handled securely and in accordance with applicable data protection requirements.

8. Where is your information stored?

I may store information electronically using password-protected devices and appropriate digital services. I will take reasonable technical and organisational measures to protect information against unauthorised access, loss, alteration or disclosure. All paper-based documents will be kept in locked storage, which can only be accessed by myself.

Because the practice uses online services, some providers may process or store information outside the UK. Where this occurs, I will ensure that the transfer or processing is subject to appropriate safeguards required by UK data protection law.

9. How long will I keep your information?

I will keep personal information only for as long as it is necessary for the purpose for which it was collected, taking account of legal, professional, insurance and record-keeping requirements. This will usually be 6 years after our last contact in accordance with the British Association for Counselling and Psychotherapy (BACP).

The exact retention period may vary depending on the type of record. I will maintain a documented retention schedule and securely delete or destroy information when it is no longer required.

10. Your data protection rights

Subject to applicable legal exceptions, you may have rights including:

• the right to be informed about how your personal information is used;

• the right to request access to your personal information;

• the right to request correction of inaccurate or incomplete information;

• the right to request erasure in certain circumstances;

• the right to request restriction of processing in certain circumstances;

• the right to object to certain processing;

• the right to data portability in certain circumstances;

• rights relating to automated decision-making and profiling, where applicable.

Some rights are subject to conditions and exemptions, particularly where information needs to be retained or processing is necessary for legal or professional reasons.

11. How to exercise your rights

If you would like to exercise a data protection right or ask a question about your information, please contact me at sophie@thequietwithin.co.uk.

I may need to verify your identity before responding to a request. I will respond within the timeframe required by applicable data protection law.

12. Complaints about your information

If you have concerns about how I have handled your personal information, please contact me first so that I can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

13. Website cookies

The Quiet Within website may use cookies or similar technologies. The specific cookies used will depend on the website platform and any features or services enabled on the site. Information about cookies and any consent required will be provided through the website's cookie controls or cookie information where applicable. The ICO notes that website visitors should be told about cookies and, for non-essential cookies, consent may be required.

14. Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to the practice, the services I use, or legal and professional requirements. The current version will be made available on the website. I will provide updated privacy information before introducing a new use of personal information where required.

The Quiet Within • Privacy Notice