Last updated: 19 June 2026

I am Susan Neale, a sole trader providing in-person and online counselling services. I am a registered member of the British Association for Counselling and Psychotherapy (BACP) and work in accordance with the BACP Ethical Framework.

This statement explains what personal information I collect, why I collect it, how I keep it secure, how long I keep it, and what rights you have under UK data protection law.

Contact details and business address

• Business correspondence address: Susan Neale, Kingswood Practice, Burford House, 29 Worthing Road, Horsham, West Sussex, RH12 1SL.
• Email: susanneale4@gmail.com
• BACP membership number: 402325
• ICO registration number: ZB590148

Types of personal data I collect 

I collect and process personal data only where this is necessary to provide safe, ethical and professional counselling services, to manage my practice, and to meet legal, professional and insurance requirements.

• Identity and contact data: your name, age, telephone number, email address and correspondence details. 
• Emergency and GP contact data: the name and contact details of a trusted person and/or your GP, used only where clinically or ethically necessary, for example in a crisis or safeguarding situation. 
• Administrative and financial data: appointment records, attendance, fees, payment records and related correspondence. 
• Digital and technical data: information generated when using online services, such as email, online meeting names, IP addresses, timestamps and technical connection information. 
• Special category data: information about your health, psychological history, personal circumstances, family and relationship history, lifestyle context and clinical material discussed in counselling sessions.
• Clinical notes: brief notes made for the purposes of safe, ethical and reflective counselling practice.

Lawful basis for processing 

Under Article 6 of the UK GDPR, I usually rely on the following lawful bases:

• Contract or pre-contract steps: to respond to enquiries, arrange counselling, provide sessions and manage the counselling agreement.
• Legal obligation: to meet tax, accounting and data protection obligations.
• Legitimate interests: to manage my practice, respond to concerns or complaints, maintain appropriate professional records, and protect my legal position where necessary. 
• Vital interests or safeguarding necessity: in exceptional circumstances where there is an imminent risk of serious harm to you or another person. 

Because counselling involves health-related and other sensitive information, I also need a separate condition for processing special category data under Article 9 of the UK GDPR. I rely primarily on Article 9(2)(h), which permits processing necessary data for the provision of health or social care or treatment by a professional subject to duties of confidentiality. Where necessary, I may also rely on conditions relating to safeguarding, vital interests, or the establishment, exercise or defence of legal claims.

Confidentiality, storage and online security 

Counselling is confidential, subject to the limits set out below. I take reasonable and proportionate steps to keep your information secure.

• Clinical notes are brief and are stored separately from directly identifying contact details wherever practicable. Paper records are kept securely in a locked filing cabinet. 
• Electronic information is protected by appropriate security measures such as password protection, device security and secure account access.
• Online sessions are conducted through a password-protected online meeting account. I do not record audio or video therapy sessions, and clients must not record sessions without explicit written agreement. 
• You are responsible for attending online sessions from a private and secure space and for taking reasonable steps to protect your own device and internet connection. 

I will keep your information confidential unless one of the following applies: 

• I am legally required to disclose information, for example by a court order or statutory requirement.
• I believe there is an imminent risk of serious harm to you or another person. 
• There is a safeguarding concern involving a child or vulnerable adult. 
• You explicitly ask me to share information with a third party, such as your GP, and provide consent in writing. 
• Disclosure is necessary to respond to a complaint, professional conduct matter, insurance issue or legal claim. 

Supervision

To maintain ethical and safe practice, I discuss my counselling work with a qualified supervisor. Client material is anonymised or pseudonymised as far as possible. My supervisor is also bound by professional confidentiality. 

Clinical will and professional executor 

I have a clinical will in place. If I become suddenly incapacitated or die, a designated professional colleague, acting as my clinical executor, may be given access to the minimum information needed to contact current clients, inform them of the situation and support continuity of care. The clinical executor is bound by professional confidentiality and will not read clinical notes unless this is necessary for client safety, legal compliance or continuity of care.

Sharing information and use of service providers

I do not sell personal data. I only share information where necessary, proportionate and lawful. This may include sharing limited information with:

• my clinical supervisor
• a clinical executor if my clinical will is activated
• your GP, emergency contact or relevant safeguarding body where there is serious risk or where you have given explicit consent
• professional advisers, insurers, legal advisers or regulators where necessary
• service providers who support my practice, such as email, website, online meeting, accounting, payment or secure storage providers. 

Some digital service providers may process data outside the UK. Where this occurs, I will use providers that put appropriate safeguards in place, such as adequacy arrangements or approved contractual protections. 

Website, cookies and analytics 

If you contact me through my website, I will use the information you provide to respond to your enquiry and, where appropriate, to arrange counselling. If the website uses cookies, analytics, embedded maps, booking tools or contact forms, these may collect limited technical information such as IP address, browser type, device information and time of access. Essential cookies may be used to make the website function. Nonessential analytics or marketing cookies should only be used where legally permitted and with appropriate information and controls. 

9. Data retention

I retain clinical notes and client records for seven years following the date of the final counselling session. This retention period reflects professional indemnity insurance requirements, potential legal liabilities, and professional good practice. After this period, paper records are securely shredded and electronic records are securely deleted, unless there is a lawful reason to retain them for longer. Financial and accounting records may also be retained for the period required by tax and accounting rules. Enquiry information that does not lead to counselling will not be kept longer than necessary. 

Your data protection rights 

You have rights under UK data protection law. These rights are not absolute and may depend on the lawful basis for processing and the nature of the information held. Your rights may include: 

• the right to be informed about how your data is used
• the right of access, including the right to request a copy of personal data and clinical notes I hold about you
• the right to ask for factual inaccuracies to be corrected
• the right to ask for processing to be restricted in certain circumstances
• the right to object to processing in certain circumstances
• the right to data portability where this applies
• the right to ask for erasure in some circumstances, although this right may be limited where records need to be retained for legal, professional, insurance or clinical reasons. 

If you make a request, I may need to confirm your identity before responding. I will respond within the statutory timescale unless the law permits an extension.

Data protection complaints process

If you have a concern about how I handle your personal data, please contact me first so that I can try to resolve it. 

• How to complain: email susanneale4@gmail.com or write to the business correspondence address above.
• Acknowledgement: I will acknowledge a data protection complaint within 30 days of receiving it.
• Investigation: I will investigate the concern without undue delay and may contact you for clarification or to verify your identity. 
• Updates and outcome: I will keep you informed where appropriate and will provide an outcome once the complaint has been considered. 
• Escalation: if you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office at ico.org.uk. 

Changes to this statement 

I may update this statement from time to time to reflect changes in my practice, professional requirements or data protection law. The latest version will be made available through my website or on request.

Newdawn Counselling – Privacy and Data Protection Statement