​Updated in line with the Data (Use and Access) Act changes taking effect 19 June 2026.

​

This privacy notice explains how I collect, use, store and protect personal information in my therapy practice.

 

I am Sarah Olds, a psychotherapist and ADHD Coach. I am the data controller for personal information I collect through my practice, which means I am responsible for deciding how personal information is used and for keeping it safe.

​

If you have any questions about this notice, please contact me at:

Email: saraholdscounselling@gmail.com

Phone: +44 7418365043

Website: saraholdscounselling.co.uk

​

Information I collect

Depending on the nature of your enquiry or our work together, I may collect:

•  your name and contact details

•  your date of birth

•  your GP details

•  emergency contact details, where appropriate

•  relevant health, mental health or wellbeing information

•  information about your personal history, relationships, work, identity and reasons for seeking therapy

•  brief clinical notes

•  attendance, payment and appointment information

Some of this information may be classed as special category data under UK data protection law. I only collect information that is necessary for providing therapy safely, ethically and professionally.

​

How I use your information

I use your personal information to respond to enquiries, arrange appointments, provide therapy, keep appropriate clinical records, manage payments and invoices, communicate with you about sessions, meet legal and professional responsibilities, manage risk or safeguarding situations where necessary, and maintain insurance and accounting records. I do not sell your personal information.

 

Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information. Depending on the reason for processing, I may rely on contract (where information is needed to arrange and provide therapy), legitimate interests (where I need to run my practice safely and keep appropriate records), or legal obligation (where I need to keep or share information to comply with the law). Where I process special category data such as information about health or mental health, I identify an appropriate condition under Article 9 UK GDPR before beginning that processing.

​

Confidentiality

Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.

There are some limits to confidentiality. I may need to share information if:

•  I believe there is a serious risk of harm to you or someone else

•  there is a safeguarding concern involving a child, vulnerable adult or person at risk

•  I am required to do so by law, court order or legal process

•  disclosure is necessary to prevent or detect a serious crime

•  there is a medical emergency and information is needed to protect life

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, or undermine the purpose of the disclosure.

​

Supervision

Like other ethical therapists, I use clinical supervision to support safe and effective practice. In supervision, I may discuss aspects of client work. I aim to minimise identifying detail where possible and appropriate. My supervisor is also bound by confidentiality and professional standards.

​

Clinical notes and records

I keep brief clinical notes to support safe and ethical therapy. These are factual, proportionate and relevant to the work. Clinical records may include session dates, brief themes discussed, relevant risk or clinical information, agreed actions, and contact and administrative information. I do not aim to keep a full transcript of sessions.

​

Notes are stored securely and in a password-protected format within the Kiku system. You have the right to view your notes at any time. Please contact me directly to make this request.

​

How long I keep information

I keep information only for as long as necessary:

•  enquiry information may be deleted if we do not begin therapy, usually within 6–12 months

•  client records are kept for up to 7 years after therapy ends, in line with professional standards

•  if the work involved a child or young person, a different retention period may apply

•  financial records are kept for the period required for tax and accounting purposes

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons.

​

Where your information is stored

Your information may be stored in the following systems:

•  Practice management/client records: Kiku (wearekiku.com/privacy-notices)

•  Email: Gmail

•  Online sessions: Zoom, Google Meet

•  Payments: BACS bank transfer and/or Stripe

•  Scheduling: Calendly

•  Messaging/phone sessions: Textmagic, WhatsApp.

I use appropriate technical and organisational measures to keep information secure, including password protection, device security and restricted access. Where I use external providers, they may process data on my behalf, and I aim to use reputable providers with appropriate data protection and security arrangements.

​

Online therapy

If we work online, sessions will take place using Zoom or Google Meet. I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted. Online platforms may process technical information such as IP address or device information. Please check the privacy notice of the platform we use if you would like more detail.

​

AI tools, transcription and recording

I do not record, transcribe or use AI tools to process therapy sessions unless a client has explicitly requested this and given their prior consent. Where a client requests it, I may use AI tools to record, transcribe or summarise sessions for that client’s benefit. Consent can be withdrawn at any time. I may also use AI tools for general practice administration, writing, planning or education, but I do not put identifiable client material into AI tools for any other purpose without the client’s knowledge and consent.

 

Recording of sessions is not permitted. If you wish to discuss this or request permission to record, please contact me ahead of starting your counselling.

​

Insurance providers

I am an authorised provider for Bupa, AXA, Aviva and WPA. If you are using insurance, I may need to share limited information (such as attendance and session dates) with your insurer. I will share only what is required and relevant.

​

Who else information may be shared with:

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with: my clinical supervisor; professional advisers such as an accountant, insurer or legal adviser; my professional body if required in relation to a complaint or ethical matter; safeguarding services, emergency services or your GP where there is serious risk or safeguarding concern; a court or legal authority if required by law; or trusted digital service providers who process data on my behalf. Where I share information, I aim to share only what is relevant and necessary.

​

Your rights

Under UK data protection law, you have the right to:

•  be informed about how your data is used

•  access a copy of your personal information

•  ask for inaccurate information to be corrected

•  ask for information to be deleted in some circumstances

•  restrict or object to certain processing

•  raise a data protection concern or complaint

Some rights are not absolute. I may need to retain certain information for legal, professional, safeguarding, insurance or complaint-related reasons. If you wish to exercise any of these rights, please contact me. I will respond within one month.

Data protection concerns and complaints

​

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me at saraholdscounselling@gmail.com. I will acknowledge your complaint within 30 days and take appropriate steps to investigate it and tell you the outcome without undue delay.

​

Please include: your name, what your concern is about, what you would like me to look into, and how you would prefer me to respond.

If you are not satisfied with my response, or would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office at www.ico.org.uk or on 0303 123 1113.

​

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use. The latest version will be available on my website and on request.

​

Sarah Olds  • 19 June 2026