Effective date: 1st February 2025
Last updated: 25th March 2025

Who I Am

I am Nicole Marchant, and I am the data controller for the personal information you provide through this website, by email, by phone, through contact forms, and during counselling work.

Contact details:
Name: Nicole Marchant
Trading name: Nicole Marchant Counselling
Email: nicole@nicolemarchantcounselling.co.uk
Phone: 07785 261 193

If you have any questions about this Privacy Policy or how I use your personal data, please contact me using the details above.

Personal Information I Collect

I may collect and use the following personal information:

Contact and identity information, such as your name, phone number, email address, postal address and date of birth.

Enquiry information, such as details you include when you contact me about counselling.

Session and clinical information, such as notes about our work together, appointment history, relevant background information, risk information, and information you choose to share in therapy.

Special category data, where relevant, such as information about your health, mental health, sexual life or sexual orientation, racial or ethnic origin, religious beliefs, or other sensitive information that may arise in counselling.

Payment and transaction information, such as payment dates, amounts paid, invoices and limited accounting records.

Website and technical information, such as IP address, browser type, device information, cookie preferences and website usage information.

Emergency contact information, where you provide this.

How I Collect Your Personal Information

I collect personal information directly from you when you:

contact me by email, phone, text, WhatsApp or contact form;
book an initial consultation or counselling session;
complete intake or assessment forms;
attend counselling sessions;
make payments;
use my website.

I may also receive information from third parties where appropriate, for example from a GP, referrer, insurer or another professional, but only where this is lawful and appropriate.

Why I Use Your Personal Information

I use your personal information to:

respond to your enquiries;
arrange and manage appointments;
provide counselling and related support;
maintain appropriate clinical records;
communicate with you about sessions, cancellations or practical matters;
take payment and keep accounting records;
comply with legal, regulatory, insurance and professional obligations;
protect your vital interests or the vital interests of another person where there is a serious risk of harm;
operate, maintain and improve my website and its security.

Lawful Bases For Processing

Under the UK GDPR, I must have a lawful basis for using your personal data. Depending on the circumstances, I rely on one or more of the following:

Contract: where processing is necessary to take steps at your request before entering into a counselling agreement, or to provide services under that agreement.

Legal obligation: where I need to process data to comply with legal obligations, for example tax, accounting, safeguarding or other legal requirements.

Legitimate interests: where it is necessary for the legitimate interests of running and protecting my practice, provided those interests are not overridden by your rights and freedoms. This may include appointment administration, record management, responding to enquiries, website security and defending legal claims.

Vital interests: where processing is necessary to protect someone’s life.

The ICO requires organisations to identify a valid lawful basis and to explain it clearly in their privacy information.

Special Category Data

Counselling work often involves special category data, including health-related information. Where I process special category data, I identify both a lawful basis under Article 6 UK GDPR and a separate Article 9 condition, as required by the ICO.

For counselling records, I may rely on one or more of the following Article 9 conditions, depending on the circumstances and how my practice is structured:

Explicit consent.

The provision of health or social care or treatment, or the management of health or social care systems and services, where applicable.

The protection of vital interests where you or another person is physically or legally incapable of giving consent.

Establishment, exercise or defence of legal claims, where relevant.

Important: you should keep only the Article 9 condition or conditions you actually rely on in practice. If you want, I can help you choose the cleanest legally defensible wording for a sole practitioner therapist model.

Confidentiality and When Information May be Shared

Counselling is confidential, but confidentiality is not absolute. I may share personal information where I have a lawful basis to do so, including:

where you have given permission;
where I am required to do so by law;
where there are serious safeguarding concerns involving a child or vulnerable adult;
where there is a serious risk of harm to you or another person;
where necessary for the establishment, exercise or defence of legal claims;
where required by a court order, regulator, insurer or professional body;
where I use trusted service providers to help run my practice.

Where possible and appropriate, I will aim to discuss this with you first.

The ICO’s transparency guidance says people must be told who data may be shared with and why, and its safeguarding guidance makes clear that data protection law does not prevent appropriate sharing for safeguarding purposes.

Who I May Share Your Information With

I may share your information, where necessary and lawful, with:

my clinical supervisor, using anonymised or minimally identifying information where possible;
my accountant, bookkeeper or payment provider;
my website host, email provider, practice management software provider or cloud storage provider;
my insurer, solicitor or other professional advisers;
your GP or another healthcare professional, where appropriate and lawful;
the police, local authority, NHS services, safeguarding teams, coroners, courts or regulators where legally required or justified.

I require service providers to handle personal data appropriately and securely.

How Long I Keep Your Personal Information

I only keep personal information for as long as necessary for the purposes for which it was collected, including legal, professional, insurance and tax requirements.

Typical retention periods are:

Enquiries that do not proceed to counselling: [for example 6 to 12 months].
Client counselling records: [for example 7 years after therapy ends, or longer where justified].
Children’s records, if applicable: [for example until age 25, or 26 if the young person was 17 at the end of treatment].
Financial and tax records: [for example 6 years after the end of the relevant tax year].
Website analytics or cookie records: [insert period].

You should replace these with the periods you actually use. The ICO says privacy information should include retention periods, or the criteria used to decide them.

International Transfers

I try to keep personal data within the UK or countries with appropriate safeguards. If any provider I use stores or accesses personal data outside the UK, I will ensure that an appropriate safeguard is in place, such as adequacy regulations or approved contractual protections.

Your Data Protection Rights

Depending on the circumstances, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of your data;
request restriction of processing;
object to processing carried out on the basis of legitimate interests;
request data portability in certain circumstances;
withdraw consent where I rely on consent;
complain to the Information Commissioner’s Office.

The ICO says these rights should be explained in privacy information, and that the right to object must be brought to people’s attention where relevant.

Please note that these rights are not absolute, and there are lawful exemptions. For example, some therapy records may need to be retained for legal, safeguarding, insurance or professional reasons.

How to Complain

If you are unhappy with how I use your personal data, please contact me first so I can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website, Cookies and Analytics

My website may use cookies or similar technologies to make the site work, remember your preferences, improve performance and understand how visitors use the website.

Where non-essential cookies are used, they will only be placed where required by law after you have been given a clear choice.

You can manage cookies through your browser settings and, where available, through the cookie controls on this website.

Security

I take appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing, accidental loss, destruction or damage. This may include password protection, secure devices, secure storage, limited access and appropriate systems for email, note-taking and record storage.

Children and Young People

My counselling practice is intended for adults aged 18 and over. I do not knowingly offer services directly to children through this website.

Changes to This Privacy Policy

I may update this Privacy Policy from time to time. The latest version will always be posted on this website with the revised effective date.