Privacy and Data Protection Notice
Privacy & Data Protection Notice
- I am Emma Johnston, a qualified Counsellor and Psychotherapist
- Registered with BACP (British Association for Counselling and Psychotherapy)
- BACP registration number: 00926554
- ICO registration number: ZB288533
- Based in Morley, Leeds - also available online
- Phone: 07538 119591
- This notice was last updated on 19 June 2026
What Data I Collect When You Contact Me
- Your name
- Your email address
- Your phone number
- Any other information you choose to share in your message
What Data I Collect When You Become a Client
- Your contact details and date of birth
- Emergency contact details
- GP details (if you choose to provide them)
- Brief clinical notes relevant to our therapeutic work
- Payment and billing information
Why I Process Your Data (Lawful Basis)
- Responding to your enquiry - Legitimate interests (you contacted me)
- Providing counselling or psychotherapy - Performance of a contract
- Keeping clinical session notes - Performance of a contract
- Safeguarding where there is risk to life - Vital interests
- Billing and invoicing - Legal obligation (HMRC) and Contract
- Sending email updates if you subscribe - Consent (you can unsubscribe any time)
- Website cookies - Consent (via the cookie banner)
Special Category Health Data
- As a therapist, I process special category personal data relating to your physical and mental health
- This is permitted under UK GDPR Article 9(2)(h) - processing necessary for health or social care purposes
- This is also permitted under the Data Protection Act 2018, Schedule 1, Paragraph 2
- As a BACP-registered counsellor, I owe a duty of confidentiality equivalent to that of a health professional
- I only record what is necessary for our therapeutic work
- Records are password-protected and encrypted where possible
- Only I have access to your therapy records
- Records are deleted when no longer needed
- Clinical supervision is fully anonymised - no names or identifying details are shared
How Your Data Is Stored
- Clinical notes - stored in a password-protected, encrypted system
- Contact details - stored securely with password protection
- Email communications - within a secure email provider
- Paper records (if any) - in a locked filing cabinet at my practice
- All electronic data is password-protected
- I am the only person with access to your therapy records
Who Sees Your Data
- I do not share your personal data with third parties except in these limited circumstances:
- Safeguarding - where there is serious risk to life or a child protection concern
- Legal obligation - if required by a court order
- Clinical supervision - your identity is fully anonymised; no names or identifying details are shared
- Payment processing - if you pay by card, your payment is handled securely by a third-party processor
- This website is hosted by GoDaddy
How Long I Keep Your Data
- Adult client records - 7 years after therapy ends
- Under-18 client records - until your 25th birthday or 7 years after therapy ends (whichever is longer)
- Couples therapy records - 7 years after therapy ends
- Enquiries that don't proceed to therapy - 12 months from last contact
- Financial and billing records - 6 years (HMRC requirement)
- Supervision notes - 7 years after therapy ends
- Email subscribers - until you unsubscribe
- When retention expires, electronic records are permanently deleted and paper records are cross-cut shredded
Your Rights
- Access your personal data (Subject Access Request)
- Correct inaccurate data
- Delete your data (where appropriate and not overridden by legal or professional retention requirements)
- Restrict how I use your data
- Port your data (receive it in a portable format)
- Object to processing based on legitimate interests
- Withdraw consent at any time (for example, for email updates)
- To exercise any of these rights, contact me on 07538 119591 or by email
- I will respond within 30 days
Data Protection Complaints
- If you have a concern about how I have handled your personal data, please contact me first
- Phone: 07538 119591
- Email: ejohnstoncounselling@protonmail.com
- Post: The Safety House, Ackroyd Street, Morley, Leeds, LS27 8PZ
- Please include your name, a description of your concern, and what outcome you are hoping for
- I will acknowledge your complaint within 30 days
- I will investigate and keep you informed of progress
- I will provide a clear outcome without undue delay
- If you are not satisfied with my response, or if 45 days have passed, you can complain to the ICO
- ICO website: ico.org.uk/make-a-complaint
- ICO telephone: 0303 123 1113
- Under the Data (Use and Access) Act 2025, the ICO requires you to raise your complaint with me first
Data Breach Procedure
- In the unlikely event of a personal data breach, I will assess the breach and its potential impact
- If it poses a risk to your rights, I will report it to the ICO within 72 hours
- If it poses a high risk to you personally, I will notify you directly without undue delay
Cookies
- When you first visit this site, a cookie banner asks whether you accept or decline cookies
- Cookie consent preference - remembers your choice (lasts 12 months)
- GoDaddy session cookies - required for the site to function (session only)
- Analytics cookies (if enabled) - help me understand how visitors use the site
- You can change your preferences by clearing your browser cookies (the banner will reappear)
- You can also adjust your browser settings to block cookies
- I may update this notice from time to time - the date at the top will always reflect the latest version