Privacy policy

Who I am

I am Kate Dawson, a self-employed counsellor and coach trading as Steady Presence Therapy. I am the data controller for the personal information described in this policy.

• Website: steadypresencetherapy.co.uk
• Email: hello@steadypresencetherapy.co.uk
• ICO registration number: [ICO REGISTRATION NUMBER]

I work as a sole practitioner, so there is no separate data protection officer. If you have any question about your information, email me directly at the address above.

This policy covers two groups of people: visitors to my website, and clients who work with me for counselling or coaching.

Visitors to this website

What I collect

This website has no contact form, no enquiry form and no account logins. Nothing you type is stored on the site itself.

• Technical data. My website is hosted and delivered by Cloudflare. Their systems process technical information such as your IP address, browser type and the pages you request, in order to serve the site and protect it from attacks.
• Aggregate usage data. I use Cloudflare Web Analytics to see how many people visit and which pages are read. This does not use cookies, does not fingerprint your device and does not follow you across other websites. I cannot identify you from it.

Cookies

This website does not set analytics, advertising or tracking cookies, so there is no cookie banner to click through. Cloudflare may set a small number of strictly necessary cookies for security and performance, which are exempt from the consent rules because the site cannot function safely without them.

Why I am allowed to do this

• Delivering and securing the website relies on my legitimate interests in keeping the site available and protected from misuse.
• Aggregate analytics relies on my legitimate interests in understanding whether the site is useful. Because the data is not cookie-based and does not identify you, it does not require your consent.

If you email me

If you email me, or message me through Instagram, I will hold your name, your contact details and whatever you choose to tell me. That will often include sensitive information about your health, your circumstances or your relationships, because that is the nature of the enquiry.

• I use your message to reply to you and, if we go ahead, to arrange an initial session. This relies on my legitimate interests in responding to people who contact me.
• Where your message contains health information, I handle it under the health and social care provision in Article 9(2)(h) of UK GDPR, and I am bound by a professional duty of confidentiality.
• Please do not send anything urgent or high risk by email or social media. I do not monitor either continuously, and neither is a crisis service.
• If you do not become a client, I delete your enquiry and my reply after 12 months.

Clients

What I collect

• Your name, contact details, and how you prefer to be contacted.
• Your GP details and an emergency contact, where you agree to provide them.
• Information from our initial assessment about why you are seeking support and your relevant history.
• Brief written notes made during or after each session.
• Health information, including mental health, which is special category data under UK GDPR.
• Records of appointments, cancellations, payments and invoices.
• For coaching clients, information about your role, your organisation and your development goals. If your employer arranges or pays for your coaching, we agree at the start what, if anything, is shared with them. I do not pass on what we discuss without your agreement.

Why I am allowed to do this

• To provide the sessions you have booked. This is necessary to perform our contract. For the health information within those records, I rely on Article 9(2)(h), which covers the provision of health and social care by a professional bound by a duty of confidentiality.
• To keep proper professional records. I am required to keep adequate records by the BACP and by my professional indemnity insurer. This relies on my legitimate interests and, where relevant, my legal obligations.
• To meet tax and accounting obligations. Payment and invoice records are kept to comply with HMRC requirements, which is a legal obligation.
• To defend or bring a legal claim, if that ever became necessary, under Article 9(2)(f).
• To act on a serious risk of harm. See the next section.

Confidentiality and its limits

What you tell me stays between us. There are a small number of situations where I may need to pass information on, and I will normally discuss it with you first wherever it is safe to do so.

• If I believe there is a serious risk to your life, or to the life or safety of someone else, including a child or an adult at risk. In those circumstances I may contact your GP, emergency services or a safeguarding team, relying on the vital interests and safeguarding grounds in UK GDPR.
• If I am required to disclose information by law or by a court order.
• Where disclosure is required under legislation covering terrorism, money laundering or drug trafficking.

I also discuss my work in clinical supervision, which is a professional requirement. My supervisor is bound by the same duty of confidentiality, and I refer to clients by first name only or anonymously so that you are not identifiable.

How long I keep information

• Session notes and client records: six years from the end of our work together, in line with BACP guidance, then securely destroyed.
• Enquiries that do not become work: 12 months.
• Invoices, payment records and other financial documents: six years from the end of the relevant tax year, as required by HMRC.

Who else handles your information

I keep the number of systems involved deliberately small. The services I currently use are:

• Namecheap for my hello@steadypresencetherapy.co.uk email.
• Cloudflare for hosting and delivering this website. Cloudflare is US based and relies on the UK Addendum to the EU Standard Contractual Clauses for any transfer of data outside the UK.
• A video calling service for online sessions. I will tell you which one before our first session.
• An encrypted cloud account, protected by two-factor authentication, for session notes. Notes refer to you by initial only.

I do not sell or rent your information to anyone, and I do not use it for advertising.

Your rights

Under UK GDPR you can ask me to:

• Give you a copy of the information I hold about you.
• Correct anything that is wrong.
• Delete information, where I am not required to keep it.
• Restrict or object to how I use it.
• Provide your information in a portable format, where that is technically possible.
• Withdraw your consent at any time, where I have relied on your consent.

There are limits. I cannot delete clinical records that I am professionally or legally required to retain, and a request to see your notes may be limited where the notes contain information about another person.

To make a request, email hello@steadypresencetherapy.co.uk. I will respond within one month.

Complaints

If you are unhappy with how I have handled your information, please tell me first at hello@steadypresencetherapy.co.uk. I will acknowledge your complaint within 30 days and respond as quickly as I can, keeping you updated on progress.

If you are not satisfied with my response, you can complain to the Information Commissioner’s Office at ico.org.uk (opens in a new tab) or on 0303 123 1113. You can go to the ICO at any point, but it is usually quicker to raise it with me first.

Security

I take the confidentiality of your information seriously.

• Records are stored in an encrypted cloud account protected by two-factor authentication.
• My email account is protected by a strong unique password and two-factor authentication.
• The website is served over HTTPS.
• I am the only person with access to client records.

Children

I work with adults only and do not provide counselling or coaching to anyone under 18.

Changes to this policy

I may update this policy from time to time. The date at the top of the page shows when it was last changed.

Contact

Steady Presence Therapy
Email: hello@steadypresencetherapy.co.uk