Privacy Policy

I take your privacy and confidentiality seriously and am committed to handling personal information securely, respectfully and in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

This Privacy Policy explains what personal information I collect as a practitioner, why I collect it, how I use and protect it, how long I keep it and your rights.

Who I am

I am David Harford, a self-employed psychotherapist, counsellor and clinical supervisor and the Data Controller for the personal information I hold in connection with my practice.

I am:

• an Accredited Member of the British Association for Counselling and Psychotherapy (BACP)
• a UKCP-registered Psychotherapist
• a member of UKATA and STAA
• registered with the Information Commissioner’s Office (ICO)

My professional practice is also informed by the ethical and professional standards of the organisations with which I am registered or hold membership. Pasted text

Information I collect

In the course of providing psychotherapy, counselling and clinical supervision, I may collect and hold information including:

• your name and contact details
• emergency contact details
• relevant personal, demographic and health information
• information you provide during initial assessment
• correspondence between us
• contracts, agreements and consent records
• appointment information
• records of payments and financial transactions
• brief case notes relating to our therapeutic or supervisory work

Some of the information you provide during therapy or supervision may be particularly sensitive and may include information about your physical or mental health, relationships, sexuality, beliefs or other aspects of your private life.

I only collect information that is relevant to providing these services safely and professionally and meeting my professional, legal and administrative responsibilities. Pasted text

Why I use your information

I may use your personal information to:

• respond to enquiries about my services
• assess whether I am able to offer appropriate support
• arrange and provide therapy or supervision sessions
• communicate with you about appointments and our work together
• maintain appropriate professional records
• manage payments and financial records
• undertake my own clinical supervision
• meet my professional and ethical obligations
• protect your vital interests or those of another person where necessary
• comply with legal or regulatory requirements
• establish, exercise or defend legal claims where necessary

Lawful bases for processing

Depending on the circumstances, I rely on one or more lawful bases under UK data protection law.

Contract: where processing is necessary to take steps at your request before beginning therapy or supervision, or to provide the professional service we have agreed.

Legal obligation: where I need to process or retain information to comply with a legal requirement.

Legitimate interests: where processing is reasonably necessary for the safe and professional operation of my practice, provided those interests are not overridden by your rights and interests.

Vital interests: in exceptional circumstances where processing is necessary to protect someone’s life.

Consent: where I have specifically asked for your agreement to a particular use of your information.

Sensitive and health information

Information about physical or mental health and certain other types of sensitive information are classed as special-category personal data under UK data protection law.

Where I process special-category information, I do so only where I have both an appropriate lawful basis and an appropriate condition for processing this type of information.

Such information is treated with particular care and confidentiality and is only used where relevant to our therapeutic or supervisory work, my professional responsibilities or the safety of you or another person. Pasted text

How information is stored

Paper assessment records are kept in a locked filing cabinet within my locked therapy room at Eskmills.

I use Dropbox temporarily to store PDF scans of initial assessment forms. Original paper forms are retained securely as described above.

I use Gmail for day-to-day email correspondence.

I maintain a Google Calendar, accessible only by me, containing an anonymous appointment schedule and very brief non-identifying notes. I may access this calendar on my phone using Business Calendar Pro. My phone is protected by biometric security.

I take reasonable technical and organisational measures to prevent unauthorised access to client and supervisee information. Pasted text

Case notes

I keep brief case notes relating to my therapeutic and supervisory work.

These notes are kept separately from information which directly identifies you and are recorded anonymously.

Anonymous case notes and appointment-calendar information are normally deleted after one year. Pasted text

Online therapy and supervision

I may provide therapy and supervision sessions online.

I normally use Microsoft Teams, although WhatsApp video or Zoom may be used where this is preferred or more appropriate.

Therapy and supervision sessions are not routinely recorded.

Exceptionally, a recording may be made for an agreed purpose such as supervision, clinical research or where a client or supervisee specifically requests a recording of their session.

Any recording will be discussed in advance and will only be made with the client’s or supervisee’s express agreement. The purpose of the recording, how it will be used, who may have access to it and how long it will be retained will be agreed as appropriate before recording takes place. Pasted text

Artificial intelligence

I do not use artificial intelligence systems to process client or supervisee information or as part of my practice.

Client and supervision sessions, correspondence, case notes or other confidential client or supervisee information are not submitted to generative AI systems for analysis, transcription, summarisation or other processing. Pasted text

My own clinical supervision

Clinical supervision is an important part of safe and ethical psychotherapy practice.

I discuss my therapeutic work with an appropriately qualified professional supervisor. Client information used in my own supervision is normally anonymised so that the client is not identified.

Identifying information would only be disclosed where there is an appropriate professional, legal or safeguarding reason for doing so, or where you have specifically agreed to a wider use of your information. Pasted text

Confidentiality and disclosure

Information you provide during therapy or supervision is treated as confidential.

There are limited circumstances in which I may need to disclose information without your consent. These may include situations involving an imminent or serious risk of harm to you or another person, safeguarding concerns, or where disclosure is required by law.

Depending on the circumstances, this could involve contacting emergency services, police, social work or another appropriate authority.

Where circumstances allow, I would normally seek professional consultation or my own clinical supervision and discuss the situation with you before making such a disclosure. However, there may be circumstances where this is not possible or appropriate. Pasted text

Professional executor

I maintain a professional or “clinical will” arrangement so that, in the event of my death or serious incapacity, an appropriate person can access the information necessary to contact clients and supervisees and manage outstanding professional responsibilities.

Access under this arrangement would be limited to what is necessary for that purpose and would remain subject to professional confidentiality and data protection requirements. Pasted text

Payments and financial records

Clients and supervisees normally pay by bank transfer to my Mettle business account, although I also accept cash.

I use FreeAgent for business accounting. Relevant financial information is processed for accounting and tax purposes, including information required for Making Tax Digital and reporting to HM Revenue & Customs.

Clinical information and case notes are not included in accounting records.

Financial records are retained for the periods required by applicable tax and accounting requirements. Pasted text

Sharing your information

I do not sell personal information.

Where necessary, personal information may be processed through service providers I use to operate my practice, including:

• Google, for Gmail and calendar services
• Dropbox, for temporary secure storage of assessment-form scans
• Microsoft Teams, Zoom or WhatsApp where used for online sessions
• Mettle and FreeAgent for banking and financial administration

These providers operate under their own privacy and security arrangements.

I may also disclose information where required by law or where necessary for safeguarding, protecting vital interests, meeting my professional obligations or establishing, exercising or defending legal claims. Pasted text

International processing

Some technology providers I use may process or store personal information outside the UK.

Where personal information is transferred internationally, I take appropriate steps to use services which provide appropriate safeguards for personal information in accordance with UK data protection law.

How long I keep information

I do not keep identifiable client and supervisee information for longer than reasonably necessary.

My appointment calendar and anonymous case notes are normally retained for one year.

Other therapy and supervision records are normally retained for no more than two years after our work ends, unless there is a particular professional, legal, regulatory or insurance reason why information needs to be retained for longer.

Financial and accounting records may need to be retained for longer periods to comply with tax and accounting requirements.

At the end of the relevant retention period, information is securely deleted or destroyed as appropriate. Pasted text

Professional guidance

My record keeping, confidentiality and information-handling practices are informed by the ethical and professional guidance of the professional organisations with which I am registered or hold membership, including BACP and UKCP.

Clients and supervisees may also seek general guidance about professional standards from the relevant professional body.

Security

I take reasonable technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

This includes physical security for paper records, access controls for electronic information and appropriate security on the devices and online services I use.

If a personal data breach occurs, I will assess it and notify the Information Commissioner’s Office and affected individuals where required by law. Pasted text

Your rights

Depending on the circumstances, you have rights under UK data protection law including the right to:

• be informed about how your personal information is used
• request access to personal information I hold about you
• ask me to correct inaccurate or incomplete information
• ask me to delete your personal information in certain circumstances
• ask me to restrict the way I use your information in certain circumstances
• object to certain uses of your personal information
• receive certain information in a portable format where the right to data portability applies
• withdraw consent at any time where I rely on consent

These rights do not apply in every circumstance. There may be professional or legal reasons why particular information needs to continue to be retained or processed.

Data protection requests and complaints

If you wish to exercise your data protection rights or have concerns about how I have handled your personal information, please contact me directly in the first instance.

I will acknowledge a data protection complaint within 30 days, investigate it appropriately and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

You may also seek general guidance about professional standards from my relevant professional bodies, including BACP or UKCP. Complaints concerning professional conduct may be subject to the separate complaints procedures of the relevant professional body. Pasted text

Changes to this policy

I may update this Privacy Policy from time to time to reflect changes in my practice, professional guidance, the services I use or my legal obligations.

The latest version will be published on my website with the date it was last updated.

Contact

For questions about this Privacy Policy, to exercise your data protection rights or to raise a concern about how your information has been handled, please contact me using the contact details provided on this website.