The Hughes Practice — therapy for real life

Home · Privacy Notice

Privacy Notice

Last updated: August 2026

Your privacy is important to me. I take the security and confidentiality of your personal information seriously and will only collect and use information that I need in order to provide counselling, manage my practice and meet my legal and professional responsibilities.

I comply with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as my professional and ethical responsibilities as a counsellor.

This privacy notice explains how I collect, use, store and protect your personal information from the point at which you first contact me, throughout therapy and after therapy has ended. It explains:

I am happy to discuss any aspect of this privacy notice with you.

Who is responsible for your information?

I am the data controller for the personal information I hold about you. This means that I am responsible for deciding how and why your personal information is collected and used.

I am a member of the British Association for Counselling and Psychotherapy (BACP) and work in accordance with its Ethical Framework.

What information do I collect?

Depending on our contact and the nature of our work together, I may collect:

Contact and administrative information

This may include:

Information relevant to counselling

In order to provide counselling safely and appropriately, I may collect information about:

Some of this information may constitute special category data, including information concerning your physical or mental health.

I aim to collect only information that is relevant and necessary for providing counselling and fulfilling my professional and legal responsibilities.

How I collect your information

I may collect information:

If you provide information about another person, such as an emergency contact, you should ensure that they are aware that you have provided their information to me.

My lawful basis for using your information

Data protection law requires me to have a lawful basis for processing personal information. The lawful basis I rely on will depend on the nature and purpose of the information being processed.

Where you are considering or receiving counselling from me, I may process information where this is necessary for the provision and management of counselling services and our contractual relationship.

I may also process information where I have a legitimate interest in doing so, for example to manage my practice, maintain appropriate records, deal with professional or legal matters, and protect myself and my clients from potential harm or legal claims.

Where I process information concerning your physical or mental health, this is special category data and requires an additional legal condition under Article 9 of the UK GDPR. I will only process such information where an appropriate Article 9 condition applies.

I will document the lawful bases and special-category conditions relevant to my practice and review these as necessary.

You are not generally required to provide personal information simply because I ask for it. However, some information is necessary for me to provide counselling safely and appropriately. If you choose not to provide information that I reasonably need, this may affect my ability to provide counselling to you.

When you first contact me

When you first contact me about counselling, I may collect information such as your name, contact details and a brief description of what you are looking for from therapy.

I use this information to:

If you decide not to proceed with counselling, I will delete information that I no longer need within 6 months, unless I have a legitimate reason or legal obligation to retain it for longer.

Online assessment and pre-therapy forms

I may ask you to complete an online pre-therapy or assessment form before your first session.

I use Google Forms through my Google Workspace account to collect this information. Information submitted through the form is stored within my Google Workspace environment and is accessible only to me, subject to the security and processing arrangements of Google.

I do not use the information you provide through the form for advertising, profiling or automated decision-making.

The form is intended to help me understand your circumstances and prepare appropriately for our work together. It is not monitored continuously and should not be used to contact me in an emergency.

While you are receiving counselling

I will keep appropriate records of our work together. These may include:

I will keep these records confidential and will only access or use them for legitimate purposes connected with your counselling, the management of my practice, my professional responsibilities or where I am legally required or permitted to do so.

Confidentiality

The content of counselling sessions is confidential.

There are, however, circumstances in which confidentiality may need to be limited. These may include situations where I have serious concerns about your safety or the safety of another person, safeguarding concerns involving a child or vulnerable person, or where disclosure is required or permitted by law.

Wherever possible, I will discuss any proposed disclosure with you beforehand. There may be circumstances where I cannot do this, for example where doing so would increase the risk of harm or where I am legally prevented from doing so.

The limits of confidentiality are also explained as part of my counselling agreement.

Email, telephone and text communication

I may use email, telephone and, where agreed, text messaging to communicate with you about appointments and other practical matters relating to your counselling.

I ask that you avoid sending detailed or sensitive therapeutic information by text message or email where possible.

I will not routinely use text messages as part of your clinical record. Where a message contains information that is relevant and necessary to your counselling record, I may transfer the relevant information to your clinical record and delete the original message where appropriate.

Routine administrative emails may be deleted when they are no longer required. Emails containing information that forms part of your counselling record will be retained as part of that record where necessary.

How I store and protect your information

I take reasonable technical and organisational measures to protect your information from loss, misuse, unauthorised access, alteration or disclosure.

My electronic records are stored using password-protected devices and accounts. I use Google Workspace for my practice email and cloud storage and use appropriate account security measures, including two-step verification.

Access to your information is restricted to me unless there is a legitimate reason for another person or organisation to have access.

Any paper records I hold are kept securely and are not left where they can be accessed by other clients or members of the public.

I regularly review the information I hold and aim to retain only information that is necessary for legitimate purposes.

Third-party organisations and service providers

I use a small number of trusted service providers to help me operate my practice. Where these organisations process personal information on my behalf, I take reasonable steps to ensure that appropriate data protection arrangements are in place. These may include:

Google Workspace / Google

I use Google Workspace for my practice email, document storage and online forms. Depending on the service used, Google may process personal information on my behalf as a service provider. Google provides contractual and technical data protection arrangements for Google Workspace.

This website

This website is hosted by GitHub Pages, which may log standard technical information such as IP addresses. The site also loads fonts from Google Fonts, and the contact page embeds a Google Map showing the location of my counselling room; both may involve your browser contacting Google's servers. When you send a message through the contact form, your details are delivered to me using Google (Google Apps Script, within my Google Workspace account) and are used only to respond to your enquiry.

I will only use third-party services that are appropriate for the services they provide and will take reasonable steps to ensure that your information is handled securely. I will not sell your personal information or provide it to another organisation for its own marketing purposes.

When I may share your information

I will not normally share information about you with another person or organisation without your knowledge and, where appropriate, your consent.

There are circumstances where information may need to be shared without your consent. These may include:

Where information needs to be shared, I will aim to disclose only information that is relevant and necessary for the purpose. Wherever it is safe and appropriate to do so, I will discuss this with you first.

Supervision

As part of my professional practice, I receive professional supervision.

I may discuss aspects of my work with my supervisor in order to ensure that I am working safely and appropriately. I take care to protect your confidentiality and, wherever possible, information is discussed in a way that does not identify you.

My supervisor is bound by their own professional and confidentiality obligations.

How long I keep your information

I will retain your counselling records for 6 years after the end of our therapeutic relationship. This is to allow me to meet my professional responsibilities and, where necessary, to respond to legal or regulatory matters.

At the end of the relevant retention period, records will be securely deleted or destroyed.

If you ask me to delete your information before the end of the retention period, I will consider your request in accordance with UK data protection law. There may be circumstances where I am legally or professionally required to retain some information.

I will periodically review records and will not keep personal information for longer than is necessary for the purposes for which it was collected, subject to my legal and professional obligations.

Your rights

Under the UK GDPR and Data Protection Act 2018, you have a number of rights in relation to your personal information. Depending on the circumstances, these include the right to:

These rights are not absolute and there are circumstances where I may be legally entitled or required to retain or withhold certain information.

If you would like to exercise one of your rights, please contact me at anna@thehughespractice.co.uk. I will normally respond to a valid request within the time period required by data protection law.

Complaints about how I use your information

If you have any concerns about how I collect, use or store your personal information, please contact me in the first instance. I will take your concerns seriously and will try to resolve them appropriately.

You also have the right to complain directly to the Information Commissioner's Office (ICO) if you believe that your personal information has been handled unlawfully. Information about making a complaint is available from the ICO at https://ico.org.uk/make-a-complaint/

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to my practice, the services I use or data protection requirements. The most recent version will be made available to clients and/or on my website.