Data Protection

Data Protection statement

Lorna Ellen Counselling Privacy Policy

Our contact details

Name: Lorna Dungey                              

Address: 46 Kirkstall Road, Urmston, M410QP

Phone Number: 07918 655251

E-mail: lornaellencounselling@gmail.com

Web: www.lornaellencounselling.com

Information I collect
I may collect and use the following information.
When you contact me, I may collect:
• your name
• your email address
• your phone number
• the information you choose to share in your enquiry
• any preferences around contact, availability or therapy format

If we arrange an initial call or begin therapy, I may also collect:

​

• your address

• your date of birth
• your GP details
• emergency contact details, where appropriate
• relevant health, mental health or wellbeing information
• information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy
• brief clinical notes
• attendance, payment and appointment information
• correspondence between us
Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.
I only collect information that is necessary for providing therapy safely, ethically and professionally.

​

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

​• respond to enquiries
• arrange initial calls and appointments
• provide therapy
• keep appropriate clinical records
• manage payments, invoices and appointments
• communicate with you about sessions
• meet legal, professional and ethical responsibilities
• manage risk, safeguarding or emergency situations where necessary
• maintain insurance, tax and accounting records
• respond to data protection requests or complaints
I do not sell your personal information.

Under UK GDPR, I need a lawful basis for using personal information.
For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR.
For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.
• contract: where information is needed to arrange and provide therapy
• legitimate interests: where I need to use information to run my practice safely,
respond to enquiries, keep appropriate records and protect both you and me
• legal obligation: where I need to keep or share information to comply with the law

​

Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.
Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

​

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

(f) We have a legitimate interest.

Data is collected on contact forms sent by you.  We will not pass on data to a third party, except in the instances set out in the signed contract under confidentiality, whereby I am obliged to inform someone if I feel that you are at risk of harm to yourself or to others.

​

How we store your personal information

Your information may be stored in the following systems:
• Website / contact form: Wix
• Email: Gmail
• Online sessions:  Google Meet
• Payments / invoicing
• Cloud storage or backup: [insert provider, if used]
• Phone / messages: SMS, WhatsApp

​

I may use digital tools for general practice administration, writing, planning or education.
Where I do, I aim to avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.

​

When you visit www.lornaellencounselling.com, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools.
My website is hosted by Wix. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security.
You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law.

​

Sharing your information

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:
• my clinical supervisor
• professional advisers, such as an accountant, insurer or legal adviser
• my professional body, if required in relation to a complaint or ethical matter
• safeguarding services, emergency services or your GP, where there is serious risk or
safeguarding concern
• a court or legal authority, if required by law
• an appointed clinical executor if I die or become unable to contact clients myself
• trusted digital service providers who process data on my behalf
Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

​

Your information is securely stored.

We keep name, email address, phone number and minimal notes on sessions for 7 years. We will then dispose your information by deleting the files.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at lornaellencounselling@gmail.com if you wish to make a request.

​​

I keep brief clinical notes to support safe and ethical therapy. These are usually factual, proportionate and relevant to the work.
Clinical records may include:
• session dates
• brief themes discussed
• relevant risk, safeguarding or clinical information
• agreed actions or important decisions

​

How to complain

​

If you have any concerns about our use of your personal information, you can make a complaint to us at lornaellencounselling@gmail.com

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.
Please include:
• your name
• what your concern is about
• what you would like me to look into
• how you would prefer me to respond
I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.
If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

​