Privacy & Policies

Policy : Privacy & Confidentiality Policy

Michelle Windsor Counselling

Purpose

This policy outlines how client confidentiality is protected and the circumstances under which information may be shared. It reflects my commitment to ethical, safe, and respectful counselling practice.

1. My Commitment to Confidentiality

As a qualified counsellor working under professional ethical standards ( ACC and BACP), I take your privacy seriously. Everything you share in therapy is treated as private and confidential. This applies whether we meet face-to-face or online.

2. What Confidentiality Covers

Confidentiality applies to all personal information shared by clients, including:

Name, address, contact details, and personal history
Issues discussed during sessions
Session notes, assessments, and records
Any communication (email, text, phone) related to therapy

I will not disclose this information to anyone without your explicit, written permission — except in the specific cases outlined below.

3. Exceptions to Confidentiality

There are legal and ethical limits to confidentiality. I may need to share information if:

You disclose a serious risk of harm to yourself or someone else
You share information about a child or vulnerable adult at risk
You are involved in or disclose acts covered by legal obligations to report (e.g. terrorism, drug trafficking, serious crime)
A court of law legally requires me to disclose information
My supervisor needs to support me in working ethically and safely (your identity remains protected in supervision)

Wherever possible, I will discuss this with you before breaching confidentiality unless doing so would increase the risk.

4. Record Keeping and Storage

I keep brief, factual notes about each session. These help guide our work and meet insurance and ethical requirements.
Notes and personal information are stored securely, either in a locked cabinet (paper records) or in password-protected, encrypted digital files.
Your information is not shared with anyone else unless you give permission or I am required to by law.
Records are kept for 7 years after the end of therapy (or until a client turns 25 if they were under 18 when therapy began), in line with insurance guidance.

5. Online & Remote Counselling

When working online, I take extra steps to maintain confidentiality:

I use secure, encrypted platforms
Sessions are held in a private, soundproof space within my home (my dedicated counselling office)
You are encouraged to find a private space too and use headphones if needed
I do not record sessions unless we both agree and provide written consent

6. Client Consent and Review

You will be given this a written counselling agreement before starting therapy. By signing the agreement, you confirm that you understand and accept these confidentiality terms.

This policy is reviewed annually or sooner if changes in law or ethical standards require it.

Privacy

Policy : Data Protection & GDPR Policy

Michelle Windsor Counselling

Purpose

This policy sets out how personal data is collected, stored, used, and protected in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It ensures transparency, client safety, and legal compliance in the handling of sensitive information.

Michelle Windsor Counselling recognises its legal and ethical duty to protect the personal and sensitive data of its clients. All counsellors must comply with UK data protection laws and the standards set out in the ACC Code of Ethics and/or the BACP Ethical Framework. Data is collected solely for counselling, administrative, supervision, safeguarding, and legal purposes. It will only be accessed by authorised individuals and will not be shared without consent unless legally required.

1. Who I Am

Michelle Windsor Counselling is a private counselling practice based in the UK. As a sole trader, I (Michelle Windsor) am the Data Controller and responsible for complying with data protection legislation.

2. What Personal Data I Collect and Why

I collect only the information necessary to provide safe, ethical, and effective therapy. This includes:

Contact details: name, phone number, email address, home address (for safety and communication)
Emergency contact details (for safeguarding and crisis situations)
Date of birth (for identification, age-appropriate care, and legal requirements)
GP details (only used in a crisis or safeguarding situation)
Relevant health information (e.g. mental health history, medication)
Session notes: brief factual notes of what is discussed in sessions
Assessment forms: such as intake questionnaires or optional screening tools (e.g. SAST, CORE-10)
Payment records (for accounting and tax purposes – these do not include card or bank details)

3. Lawful Basis for Processing

Under UK GDPR, I process personal data using the following lawful bases:

Contractual necessity: to deliver a counselling service you’ve requested
Legal obligation: for record-keeping, safeguarding, and tax compliance
Vital interests: where needed to protect your life or someone else’s
Legitimate interest: to maintain effective and safe therapeutic records
Explicit consent: for storing sensitive data and conducting therapy

4. How Data is Stored and Protected

I take your privacy seriously. Data is stored securely in the following ways:

Paper records (e.g. contracts, notes): stored in a locked filing cabinet in my home office
Digital files: stored on an encrypted, password-protected device and backed up securely
Emails and texts: used only for administrative purposes and stored on a password-protected phone and email account
Online forms: if used, are hosted on GDPR-compliant platforms

I do not share your data with any third party unless required by law or with your written consent.

5. How Long I Keep Your Data

Client records are retained for 7 years from the end of therapy (or until age 25 for under-18s), in line with insurance and professional guidance. After this time, all data is securely shredded or deleted.

6. Your Rights Under GDPR

As a client, you have the following rights:

To be informed about how your data is used
To access the data I hold about you
To request correction of inaccurate information
To request deletion of your data (this may be limited by legal/insurance obligations)
To restrict processing of your data in certain situations
To object to how your data is processed (e.g. for marketing – though I do not engage in this)

Requests should be made in writing and will be responded to within 30 days, where legally and ethically possible.

7. Data Breach Procedure

In the unlikely event of a data breach (loss, theft, or unauthorised access), I will:

Inform you as soon as possible
Notify the Information Commissioner’s Office (ICO) within 72 hours, if required
Take immediate steps to contain the breach and prevent further access

8. Complaints

If you are concerned about how your data is handled, please speak to me first so I can address your concerns. You also have the right to contact the Information Commissioner's Office (ICO) directly:
www.ico.org.uk

Review

This policy is reviewed annually or in response to legal or professional changes.

Policy : Clinical Notes & Record Keeping Policy

Michelle Windsor Counselling

Purpose

This policy explains how client records are created, maintained, stored, and destroyed in line with legal, ethical, and professional standards. It ensures that all documentation at Michelle Windsor Counselling protects client confidentiality and supports effective and accountable therapeutic practice.

1. Types of Records Kept

I keep the following types of records as part of my counselling practice:

Client contact details (name, phone, email, address, GP, emergency contact)
Signed counselling agreement and informed consent form
Brief session notes – factual, non-interpretive summaries of themes discussed, risk indicators, and significant changes
Assessment tools (e.g. SAST, LASA, CORE-10) if used, and your responses
Any correspondence relevant to the therapeutic process (e.g. emails arranging sessions)

I do not audio- or video-record sessions unless explicitly agreed in writing, and this would only occur for supervision or training purposes with full client consent.

2. Purpose of Note-Keeping

Clinical notes serve the following purposes:

To support continuity of care
To monitor therapeutic progress and maintain accountability
To help with clinical supervision and ethical decision-making
To meet professional insurance and legal requirements

Notes are not detailed transcripts. They are brief and factual, avoiding judgmental or diagnostic language.

3. How Records Are Stored

Records are securely stored to protect your confidentiality:

Paper records (e.g. signed contracts, handwritten notes) are kept in a locked filing cabinet in my secure home office
Digital records (e.g. electronic notes or assessments) are stored on password-protected, encrypted devices or GDPR-compliant cloud storage
Any emails or text messages are used only for administrative purposes and are stored on a password-protected phone and/or email account

Access to records is limited to me as the sole practitioner, except where legal requirements or serious risk demand disclosure.

4. How Long Records Are Retained

Client records are retained for:

7 years after the final session (for adults)
Until age 25 if the client was under 18 when therapy began
This is in accordance with the requirements of professional insurance providers and ethical guidance.

After this period, records are securely destroyed by shredding (paper) or permanent digital deletion.

5. Client Access to Records

You have the right to:

Request a copy of the data I hold about you
Ask for inaccurate information to be corrected
Request deletion of some or all of your data (within legal and insurance limits)

Requests will be responded to within 30 days, subject to any legal exemptions.

6. Sharing of Records

I will not share your records with any third party without your written consent, except:

If legally required (e.g. court order)
If necessary to protect you or someone else from serious harm
If I am working jointly with another professional and we’ve agreed to a shared care plan (with your permission)

7. Use in Supervision

I discuss client work anonymously with my clinical supervisor to support good practice. Notes may be referred to during supervision but are never shared directly.

8. Policy Review

This policy is reviewed annually or in response to changes in legal, ethical, or professional requirements.