Privacy Policy

1. Introduction

Acorn Counselling Scotland is committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This privacy notice explains what information I collect, why I collect it, and how I keep it safe across both my face-to-face and online/phone therapy practices.

2. Information I Collect

I may collect and process the following personal data:

Contact details: Name, address, email address, and phone number.
Personal background & emergency info: Date of birth, GP details, and an emergency contact.
Session & clinical notes: Brief, factual summaries of the focus of our sessions to aid your therapeutic care.
Technical data: If we meet online, data such as your IP address or connection logs generated by secure communication platforms.

3. Lawful Basis for Processing Data

Under UK GDPR, I process your data under the following legal bases:

Contract performance: To provide the counselling services you have booked.
Legitimate interest: To manage administrative enquiries and securely store records after therapy ends.
Explicit consent: For processing sensitive health/special category data related to your therapy.

4. Confidentiality, Boundaries, and Sharing

Counselling is strictly confidential. I will not share your data with third parties unless:

There is a severe safeguarding or legal concern (e.g., risk of serious harm to yourself or others, child protection issues, or terrorism/court orders).
I discuss anonymised aspects of my clinical work with my professional supervisor.
For Online Therapy: Neither party is permitted to record video, audio, or text sessions unless explicitly agreed upon in writing beforehand.

5. Data Security and Platform Practices

I implement strict technical and organizational measures to keep your data secure:

Face-to-Face Records: Hard copy notes or paper intake forms are stored in a locked filing cabinet.
Digital Records: Electronic notes, emails, and contact details are stored on password-protected, encrypted devices.
Online/Video Therapy: Remote sessions are conducted via secure, end-to-end encrypted video platform - Microsofts Teams.
Client Privacy Online: For remote sessions, clients are requested to ensure they are in a private, quiet, and uninterrupted space where they cannot be overheard.

6. Data Retention

Under UK GDPR, I process your data under the following legal bases:

Contract performance: To provide the counselling services you have booked.
Legitimate interest: To manage administrative enquiries and securely store records after therapy ends.
Explicit consent: For processing sensitive health/special category data related to your therapy.

7. Your Data Rights

You have the right to request access, correction, or deletion of your personal data. If you have any concerns or wish to make a complaint, you can contact me directly, or raise the issue with the Information Commissioner's Office (ICO).