Privacy Policy

This privacy policy explains how I collect, use, and protect your personal information.

Who I am and what I do

I’m Mel Packer, a counsellor and supervisor who offers therapy services through Caring Counselling Worthing.

I’m registered with the Information Commissioner’s Office (ICO) under registration number ZB955295, and I’m also a registered member of BACP.

If you have any questions about this policy or how I handle your data, please feel free to reach out to me at info@caringcounsellingworthing.co.uk 

What personal data I collect

I collect and process the following types of personal information

• Contact and administrative information.
• Your name, address, telephone number, and email address.
• Emergency contact details
• GP details (where relevant)
• Enquiry details submitted through my website contact form
• Health and therapy-related information:
• The specific symptom, life challenges, or emotional distress that  you shared and why you’re seeking counselling
• Relevant medical and mental health history
• Details of current medication or treatments
• Short notes from our sessions that record what we have worked on together.
• Information from our initial conversation, including any assessment form, how you are doing and what we have achieved.

Important: Just so you know, your health and therapy-related information is considered ‘special category data’ under Article 9(1) of the UK GDPR. This means it gets extra legal protection, and I can only process it under specific conditions set out in law. 

How I collect your data

I collect your personal information directly from you in the following ways.

• When you first contact me to enquire about therapy (by email, or through the website contact form).
• During your initial assessment or intake session
• Following our ongoing counselling sessions
• By email or telephone communication between sessions
• Through any forms or questionnaires you complete as part of your therapy

I do not collect information about you from third parties without your knowledge. 

Why I process your data and the lawful basis

Under the UK GDPR, I need to have a valid, legal reason to handle your personal information. Since counselling involves sensitive health data, I need to meet different legal criteria.

• When you choose me as your counsellor, we’ll be entering into a contract. To make sure I can provide the counselling services you need, I need to process your personal data. This falls under Article 6(1)(b) of the UK GDPR.
• I am allowed to handle your health information to provide you with counselling. This is covered under Article 9(2)(h) of the UK GDPR (special category health data).
• As a qualified counsellor, I am committed to keeping your information private, which is a key part of my job. There is also a specific rule in UK law that I must follow, which you can find in DPA 2018 Schedule 1, Part 1, paragraph 2 (for health or social care reasons).

Professional obligations and supervision

The BACP is a professional body that sets standards and provides ethical guidelines for UK counsellors and psychotherapists. As a member, I am required to attend regular clinical supervision. 

Supervision is key to ethical counselling. Its purpose is to help me to reflect on my work and ensures I am providing you with the best possible care.

Supervision discussions focus on the therapeutic process and my professional development, not on identifying individual clients.

My supervisor is a qualified professional who is guided by their professional body’s ethical guidelines and the same confidentiality rules as I am. When I talk about my therapeutic work with my supervisor:

• I don’t share your name and any identifying details 
• I only present anonymised or pseudonymised case material. 

What happens to your records if I am unable to practise

I am currently setting up a clinical will to make sure your records are kept safe if I am suddenly unable to practise (because of something like a serious illness, incapacity, or if I die). A clinical will ensures that a nominated colleague (who is also bound by professional confidentiality) can securely manage or destroy any records I hold about you. If needed, they can also reach out to you to offer support or suggest someone else you might want to talk to.

Once everything is finalised, I will update this policy. 

Who I share your data with

I take your information seriously and only share it when absolutely necessary. However, there are a few situations where other parties might need to see your data.

• Clinical supervisor: As explained above, I discuss my counselling and supervision work with my supervisor using anonymised case material. Your name and identifying details are not shared.
• Third-party service providers: I use the following third-party services which may process your data:
• WordPress: My website runs on WordPress, which may process certain technical data
• WebHealer: My website is built by WebHealer, which may collect certain technical data about visitors including basic analytics
• Microsoft Teams: I use this for video supervision sessions and occasional counselling sessions where agreed

Each of these services is bound by a data processing agreement and prvacy policy.

I will never sell your personal data. 

Some of the third-party services I use may transfer personal data outside the United Kingdom:

• WordPress (Automattic Inc, USA)
• Microsoft Teams (Microsoft Corporation, USA)
• WebHealer (WebHealer Ltd, UK — no international transfer)

The USA doesn’t have a UK adequacy decision and so I rely on the following extra protections. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

How long I keep your data

I only keep your personal information for as long as necessary.

1. Therapy records (adult clients) are retained for 6 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
2. Financial records are retained for 6 years in line with HMRC's requirements
3. Any enquiries made through my website by people who do ot become clients will be retained for 12 months

Once the time has passed for keeping records:

• paper records will be safely shredded
• electronic records will be permanently removed using secure deletion software 

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right to be informed: You have the right to know how I use your data, and this privacy policy is designed to fulfil that right.
• Right of access: You can request a copy of the personal information I hold about you. This is known as a Subject Access Request. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information and respond within one month.
• Right to rectification: If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.
• Right to erasure (in certain circumstances): You can ask me to delete your personal data. However, this right does not apply where I need to keep your records to comply with professional guidelines or insurance requirements, or to defend potential legal claims.
• Right to restrict processing: You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.
• Right to data portability: Where technically feasible, you can ask me to transfer your data to another provider in a commonly used electronic format.
• Right to object: You can object to certain types of processing. However, this is unlikely to apply to therapy records processed under the lawful bases I use.
• Rights related to automated decision-making: I do not use automated decision-making or profiling in my practice.

If you would like to exercise any of these rights, please get in touch with me at info@caringcounsellingworthing.co.uk. I will get back to you within a month.

For most requests, there is no charge, but if a request seems clearly unreasonable or excessive, I might ask for a reasonable fee. 

Data protection complaints 

Under the Data (Use and Access) Act 2025, you have the right to raise a data protection complaint directly with me. I treat all complaints seriously and will look into them thoroughly and get back to you as soon as possible.

To make a complaint:

• Submit a complaint by contacting me at info@caringcounsellingworthing.co.uk
• If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):
• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

I treat everything you share with me in your counselling as confidential. However, there are rare circumstances where I may need to share information without your consent:

• Serious harm: If I think there is a real and immediate danger to you or someone else.
• Safeguarding: If I notice any worries about a child or someone who is vulnerable.
• Legal need: If I get a court order to share information or if the law asks me to in certain situations.

In most cases, I will try to discuss any disclosure with you first, unless doing so would itself put someone at risk. 

I am currently putting arrangements in place to ensure your records are handled appropriately if II can no longer practise, due to serious illness, incapacity, or death. 

Once these arrangements are finalised, I will update this policy and inform clients accordingly.

Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make important changes that affect how I use your data, I will inform you directly.

It was last updated on: 16 June 2026

Contact

If you have any questions about this privacy policy or your personal data, please contact:

Mel Packer at mel@caringcounsellingworthing.co.uk