top of page

Privacy Policy

​

Last Updated: June 2026

​

Introduction

I am committed to protecting your privacy and handling your personal information in a transparent and lawful manner. This Privacy Policy explains how I collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

This policy applies to prospective clients, current clients, former clients, website visitors, and anyone who contacts me regarding counselling services.

​

Data Controller

Devon McDonald Counselling is the Data Controller responsible for your personal information.

Contact Details

Devon McDonald Counselling

Website: www.devonmcdonaldcounselling.com

Email: hello@devonmcdonaldcounselling.com

Address: Suite 10, 30 Churchill Square, Kings Hill, Kent ME19 4YU

​

What Information I Collect

Depending on the nature of our contact, I may collect:

Identification and Contact Information

  • Name

  • Address

  • Email address

  • Telephone number

  • Date of birth

  • Emergency contact details

 

Health and Therapy Information

  • Information relating to your physical and mental health

  • Information disclosed during counselling sessions

  • GP details where relevant

  • Risk assessments and safeguarding information where required

 

Administrative Information

  • Appointment records

  • Attendance records

  • Correspondence

  • Invoices and payment information

 

Website Information

When you visit my website, certain information may be collected automatically, including:

  • IP address

  • Browser type

  • Device information

  • Website usage statistics

  • Cookies and similar technologies

 

Why I Collect Your Information

I collect and process personal information to:

  • Respond to enquiries

  • Assess suitability for counselling

  • Provide counselling services

  • Maintain clinical records

  • Manage appointments

  • Process payments

  • Comply with legal and professional obligations

  • Protect clients where safeguarding concerns arise

  • Improve website performance and user experience

 

Legal Basis for Processing

Under UK GDPR, I rely on the following lawful bases:

  • Contract

  • To provide counselling services requested by you.

  • Legitimate Interests

  • To manage and operate my counselling practice effectively.

  • Legal Obligation

  • To comply with legal, regulatory and professional requirements.

  • Explicit Consent

  • Where consent is required, particularly for certain special category data processing.

  • Provision of Health Care

  • As a counselling professional, I process special category data where necessary for the provision of counselling and therapeutic support.

 

Confidentiality

Confidentiality is a fundamental part of counselling practice. Information shared during therapy will remain confidential except where:

  • You provide consent for disclosure;

  • There is a serious risk of harm to yourself or others;

  • Safeguarding concerns arise involving a child or vulnerable adult;

  • Disclosure is required by law or court order;

  • Professional or ethical obligations require action.

Where possible, confidentiality concerns will be discussed with you before disclosure takes place.

 

Clinical Notes

I maintain clinical records to support safe and effective practice.

Records may include:

  • Assessment information

  • Clinical notes

  • Treatment plans

  • Risk assessments

  • Correspondence relating to therapy

Records are stored securely using appropriate technical and organisational safeguards.

 

How Information is Stored

Personal information is stored securely using password-protected systems and encrypted devices where appropriate.

Reasonable measures are taken to protect information from:

  • Unauthorised access

  • Loss

  • Misuse

  • Alteration

  • Disclosure

 

Data Retention

Information is retained only for as long as necessary.

Typically:

  • Adult client records are retained for 5 years after therapy ends.

  • Records relating to children and young people are retained for 5 years after their 18th birthday.

Retention periods may vary where legal, regulatory, safeguarding or insurance requirements apply.

 

Sharing Information

Information will not normally be shared without your consent.

However, information may be shared with:

  • Clinical supervisors (anonymised)

  • Professional advisers

  • Insurers

  • Regulatory authorities

  • Legal authorities where required by law

  • Safeguarding agencies where necessary

Only information necessary for the specific purpose will be disclosed.

​

If you choose to pay me by bank transfer, please note that your information will then form part of my bank's data over which I do not have any control. You should exercise caution and look at the privacy statement applicable to the banks in question.

 

Your Rights

You have the right to:

  • Access your personal information

  • Request correction of inaccurate information

  • Request deletion where appropriate

  • Restrict processing in certain circumstances

  • Object to processing where applicable

  • Request transfer of your data

  • Withdraw consent where processing relies on consent

These rights may be subject to legal and professional limitations.

 

Subject Access Requests

You may request a copy of your personal information by contacting me.

I will normally respond within one month unless an extension is permitted under applicable legislation.

 

Website Cookies

My website may use cookies and analytics tools to improve website functionality and understand visitor usage.

You can manage cookie preferences through your browser settings.

 

Changes to this Policy

This policy may be updated periodically to reflect changes in legislation, professional requirements or business practices.

The latest version will always be available on my website.

 

Contact

If you have any questions about this Privacy Policy or how your information is handled, please contact me using the details provided above.

​

Data Protection Complaints Procedure

 

Your Right to Raise a Concern

I take data protection and confidentiality seriously. If you have concerns about how your personal information has been collected, used, stored, shared, or otherwise processed, you have the right to raise a complaint directly with me.

I am committed to investigating concerns fairly, promptly and transparently.

 

How to Make a Complaint

Complaints can be submitted by:

Email: hello@devonmcdonaldcounselling.com

Post: Suite 10, 30 Churchill Square, Kings Hill, Kent ME19 4YU

​

Please provide:

  • Your name

  • Contact details

  • A description of your concern

  • Any relevant dates or supporting information

 

What Happens Next

Acknowledgement

I will acknowledge receipt of your complaint within 30 days.

 

Investigation

I will investigate the issues raised and may contact you if further information is required.

 

Outcome

You will receive a written response explaining:

  • The findings of the investigation

  • Any action taken

  • Any steps proposed to address concerns

 

I aim to resolve complaints as quickly as possible and without undue delay.

 

If You Remain Dissatisfied

If you are unhappy with the outcome of your complaint, you have the right to complain to the Information Commissioner's Office (ICO).

The ICO is the UK's independent authority responsible for upholding information rights.

 

Information about making a complaint can be found on the ICO website.

 

You are encouraged to allow me the opportunity to investigate and respond to your concerns before contacting the ICO, although you are not required to do so.

 

Continuous Improvement

Complaints are reviewed to help improve privacy practices, security measures and the quality of services provided.

bottom of page