top of page

privacy policy

Last updated: October 2026

​

Your privacy is highly important to me. This notice outlines how Claire Thom Counselling collects, uses, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR).

​

As the Data Controller, Claire Thom decides how and why your personal data is processed. For full details on UK privacy laws, you can visit the Information Commissioner’s Office (ICO) website at: ico.org.uk.

​

Information Collected & How It Is Used​

  • Contact Information: Your name, address, phone number, and email are used solely to schedule and manage your appointments.

  • Emergency Details: If you enter therapy, you will be asked for your GP details and an emergency contact. These are only used in a safety crisis.

  • Client Notes: Your session notes act as a reminder of our work together. They are used to inform your ongoing therapeutic support.

  • Session & Financial Records: Dates of attendance and payment logs are tracked strictly for internal business accounting.

​

Sharing Your Personal Data​

Your personal data is treated as strictly confidential. It will only be shared with third parties under specific, necessary circumstances:

  • With Your Consent: If you explicitly ask me to act on your behalf, such as writing a support letter.

  • Clinical Will Execution: In the event of my sudden death or incapacitation, your contact details (but never your client notes) will be shared with the executor of my Clinical Will so they can advise you on next steps.

  • Legal Obligations: If required by law, such as a court order or formal police mandate.

  • Safety & Safeguarding: If I judge there is a significant risk of serious harm to yourself or others, or for the explicit purpose of safeguarding children or vulnerable adults.

  • Professional Bodies & Legal Counsel: Shared with my regulatory bodies (UKCP and the United Kingdom Association for Transactional Analysis) or my solicitor only if a professional complaint or legal proceeding is brought against me.

 

Security, Storage, & Data Retention​

  • Physical Records: All handwritten or printed client notes are secured in a locked filing cabinet.

  • Digital Records: Electronic notes and emails are stored exclusively on a password-protected computer.

  • Data Retention: I keep your personal data for no longer than reasonably necessary. Client records are kept for three years from your last session, after which they are securely destroyed.

  • Clinical Will Destruction: In the case of my sudden death, the executor of my Clinical Will is instructed to take immediate steps to ensure the complete destruction of all client notes.

  • Email Safety: Standard email is not encrypted in transit. Please avoid sending highly sensitive clinical info via email.

  • Practice Management System: I use Sessionly to securely manage appointment bookings and initial client intake. You can review their individual privacy protocols directly on the Sessionly website (www.sessionly.uk).

​

Website Cookies & Analytics​

When you visit clairethomcounselling.co.uk, anonymous third-party services collect basic internet log information to monitor traffic trends. This data does not identify you personally and is used purely to keep the website running efficiently.

​

Your Rights & Personal Data​

Unless subject to a legal exemption under the GDPR, you hold the following individual rights regarding your data:

  • Access & Portability: Request a copy of the personal data held about you, or request it be transferred to another controller.

  • Correction: Request updates or corrections to inaccurate or out-of-date information at any time.

  • Erasure & Restriction: Request that your data be deleted or restricted if it is no longer necessary to retain it.

  • Withdraw Consent: Withdraw your processing consent at any time (where consent is the primary legal basis).

  • Data Loss Notification: The right to be informed immediately if your data is ever compromised or lost.

​​

Handling Complaints

If you wish to make a complaint regarding my services, website content, or data usage, please contact me directly using the details below.

  • Data Protection Complaints: In accordance with the Data (Use and Access) Act 2025, any formal complaint regarding how your personal data is handled will be officially acknowledged within 30 days of receipt. I will investigate the matter thoroughly and provide you with an outcome or status update.

  • Internal Resolution: I record and investigate all complaints to reach a fair resolution. If the complaint requires me to contact an external party, I may share minimal relevant details at my sole discretion.

  • Website Content: If you object to any content on my site or leaflets, I will remove it while an investigation takes place.

  • Vexatious Claims: If a complaint is deemed entirely without basis or vexatious, I reserve the right to cease correspondence regarding it.

​

Contact & Regulatory Details

To exercise any of your data rights, request updates, or file an initial query or complaint, please contact me directly:

If we cannot resolve your concern directly, you have the statutory right to lodge a formal complaint with the UK's independent data protection authority, the Information Commission (formerly the ICO):

  • Website: ico.org.uk

  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

bottom of page