Sara J Barnard Therapy’s Privacy Policy
Date Completed: 26/11/25
Introduction
This privacy notice tells you what I will do with your personal information from initial point of contact through to after therapy has ended. Your privacy is very important to me and your personal information will be kept safe and secure and will only be used for the purpose it was given to me.
This privacy policy is relevant to you if you are a client, potential client, or website visitor. It explains what data I keep, why I keep it, and how I store it, and describes how my website collects, uses and manages the data of visitors.
GDPR is a legal framework that sets guidelines for the collection and processing of personal information from individuals. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. I also adhere to the ethical guidelines regarding protecting client privacy and confidentiality set by the British Association for Counselling and Psychotherapy (BACP).
‘Data controller’ is the term used to describe the person/organisation that collects, stores, and has responsibility for people’s personal data. I am the data controller for my private practice. I am registered with the Information Commissioner’s Office (ICO) – registration number ZC048328. You can confirm that here.
I am happy for you to ask me about any aspect of my data protection policy.
You can read more about your rights here: https://ico.org.uk/for-the-public/
Contact details
Name: Sara Barnard
E-mail: contact@sjbarnardtherapy.co.uk
LAWFUL BASIS – CLIENTS & POTENTIAL CLIENTS
The GDPR states that I must have a lawful basis for processing your personal data and there are different lawful bases, depending on the stage of data processing. If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information. If you are currently having therapy or if you are in contact with me to consider starting therapy, I will process your personal data where it is necessary for the performance of our contract. The GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called ‘special category personal information’. The lawful basis for me processing any special categories of personal information is that it is for provision of health treatment (in this case counselling and psychotherapy) and necessary for a contract with a health professional (in this case, a contract between me and you).
HOW I USE YOUR INFORMATION:
I only use your personal data for the purpose of administration of the therapy service that I am providing to you, i.e. to arrange, cancel, and reschedule appointments. I only retain your personal information for as long as necessary in line with guidance from the Information Commissioner’s Office and my professional insurance company. I keep minimal information about clients to carry out my work. I conduct regular audits of the data I collect and routinely delete emails, email addresses and text messages.
How I get the personal information and why I have it:
Most of the personal information I process is provided directly by you for one of the following reasons:
- To contact you when arranging, cancelling, or changing appointments.
- To get support for you if you are at risk of harm to yourself or anyone else.
Initial contact:
When you contact me to make an enquiry or book a first appointment, I will collect some brief information to enable me to work safely with you. I currently collect the following information: your name, your date of birth, your address and contact details, your GP information, any medication details, and emergency contact information. This information is necessary to arrange or cancel appointments, and so that if there is an emergency situation during our sessions I can support you appropriately. I keep this information in a password protected document on my laptop (which itself also requires a password to log in) and if it is a paper form I keep it in a locked filing cabinet. If you make an enquiry but then decide not to proceed with counselling, I will ensure that all of your personal data is deleted within one month (and if on paper shredded) – this allows time for you to make a decision about whether you want to proceed.
While you are accessing therapy: Your email address or phone number will be used to provide you with written confirmation of your appointment times if you have given consent for this. Your email address and telephone number will only be used to contact you regarding appointment times, unless we have agreed that I will also use your email address to send you information that is relevant to your therapy sessions, for example resources or details of recommended reading.
To fulfil my duty of care towards you while also maintaining your confidentiality I will only contact your GP if it is necessary (for example in an emergency situation) and should these circumstances arise I would discuss this with you wherever possible before contacting your GP.
Rest assured that what is said in our sessions will be kept confidential. I am a Registered Member of the British Association of Counselling & Psychotherapy (BACP) and I abide by their professional code of ethics. Confidentiality will only be broken if there are legal or ethical obligations to disclose, for example, if you disclose abuse/neglect of a child or vulnerable adult, or say something else that implies serious harm to yourself or others, or if a court of law requires me to disclose information. In the event that confidentiality must be broken I will always try to speak to you about this first, unless there are safeguarding issues that prevent this.
Counsellors are required to have regular supervision support so the only place I may discuss our work together is with my supervisor. This would be done without identifying you and my supervisor is a counsellor who also abides by the BACP’s code of ethics regarding confidentiality.
I keep brief notes of our therapy sessions for the purpose of assisting our work together. The notes help me to keep track of the issues that we are working on and they are for my use only. The notes do not include any personal details that could be used to identify you and they are stored securely in a locked filing cabinet that only I have access to. Your therapy notes are stored separately to your personal details form.
After therapy has ended: There are various reasons why counsellors are required to keep records after therapy has ended. For example, in the case of financial transactions personal information must be retained for as long as legally required in respect of tax or accounting purposes. Retaining your therapy notes also ensures that I can continue to offer you an efficient service if you make contact after therapy has ended. Your therapy notes do not include any personal details that could be used to identify you and continue to be stored securely in a locked filing cabinet that only I have access to for five years after therapy has ended. This time frame is to ensure I am compliant with my professional insurance requirements and BACP recommendations. Five years after therapy has ended your therapy notes will be confidentially destroyed.
Your personal details form is deleted from my computer and, when paper versions are also held, confidentially destroyed on ending your therapy sessions. Please note however that I need to keep a record of your name, date of birth, date of sessions, and brief notes regarding treatment, along with your client reference number for five years after therapy ends. Your client reference number corresponds with a client reference number on your therapy notes and therefore enables me to identify your therapy notes if necessary.
Your rights:
Under GDPR, 2018 guidelines you have the following rights: The right to request access to the personal information that I store and process about you. You can ask for corrections to be made to the information held or for your personal information to be deleted. You can also ask me to restrict the processing of your personal information or to object to the processing of it altogether in some circumstances. You can read more about your rights at ico.org.uk/your-data-matters. If you would like to make a request relating to any of the rights above, please send a request in writing by emailing contact@sjbarnardtherapy.co.uk. Please be aware that in certain situations counsellors may be unable to comply with the above requests – eg as stated I am obliged to keep my notes for five years from when our sessions end for insurance purposes, or for example, if compelled to retain the records by a court of law.
Third party recipients of personal data:
I share a very limited amount of personal data with third parties in order to provide therapy services to you and to fulfil legal obligations in respect of tax and accounting purposes. If you contact me to book an appointment which is not taking place in my own therapy room, I may need to give your name to reception at the location where your appointment is due to take place depending on their venue rules.
Anonymised session notes are kept for supervision and auditing purposes due to my registration with the BACP.
The Information shared in therapy is strictly confidential. The only time I will break confidentiality and share information about you, is if I believe you are at risk of harming yourself or others, and in compliance with the following acts: The Terrorism Act 2000; Drug Trafficking Act 1994, Proceeds of Crime Act 2002 or the Money Laundering Regulations 2007; Road Traffic Act 1991; the Children Act 1989; the Serious Crime Act 2007, and the Female Genital Mutilation Act 2003. I will endeavour to share my concerns with you prior to taking any action.
I also share your email address with my supervisor via a secure shared google sheets document. This would only ever be accessed by my supervisor for the reasons of contacting you if anything should happen to me resulting in me no longer being able to offer my service or contact you myself e.g. health reasons/death.
Quick overview of how I store your personal information:
Emails and email addresses: Most emails are sent via google mail or my webhost with password protected accounts. Any email correspondence will be deleted within one month if it is not necessary to keep it. If it is necessary to retain the information for your case notes I will print the email and store it securely in a locked filing cabinet that only I have access to or copied into a password protected document on my laptop.
Telephone: I save your number on a designated work SIM card on my mobile phone using your initials, not your full name. While this device could be lost or stolen, I ensure it is as secure as possible using two step id to unlock it. I do not share your phone number with any third party. I delete your number from my phone when we finish our work together.
Online work: I send you a password for a new meeting link for each appointment. I also operate a waiting room system to ensure nobody else is able to enter the meeting.
Anonymised case notes: I keep these in a notebook/files in a locked filing cabinet and/or on my laptop, in password protected documents. Additionally, a password is needed to open my laptop. If you would like to access a copy of your notes place make a written request via email.
WEBSITE VISITORS:
(Please note I am in the process of updating this section for improved accuracy and more detailed information)
By accessing the website, you are consenting to the information collection and use practices described in this privacy notice. Should you choose to contact me using the contact form on the website none of the data that you supply will be stored by the website or passed to any third party data processors. Instead the data will be collated into an email and sent to me over the Simple Mail Transfer Protocol (SMTP). SMTP servers are protected by TLS (sometimes known as SSL) meaning that the email content is encrypted before being sent across the internet. The email content is then decrypted by local computers and devices.
The website uses cookies. Almost all websites use cookies which are small files that get put on your computer by websites as you surf them. These cookies can store lots of information which can have privacy implications. No user-specific data is collected by me or any third party.
How to complain:
If you have any concerns about my use of your personal information or have a complaint about how I handle your personal data, please do not hesitate to get in touch.
My email address is contact@sjbarnardtherapy.co.uk
To make a formal complaint or to get further information you can contact the ICO: https://ico.org.uk/make-a-complaint/
Helpline number: 0303 123 1113
————————————————————————————————————–
Please note this policy is updated on an annual basis and the date of the most recent update is:
26/11/25
Updated by Sara Barnard, Sara J Barnard Therapy, using BACP Privacy Notice Guide.