Last updated: 04/09/26
This notice explains what information I collect about you, why I collect it, how I look after it, and the choices you have. I have tried to keep it in plain English. If anything is unclear, please ask me.
Who I am
I am Susie Renshaw, a counsellor, psychotherapist and supervisor. I am registered with the British Association for Counselling and Psychotherapy and I am the "data controller" for the information described in this notice, which means I am responsible for looking after it.
You can contact me about anything in this notice at susierenshaw@gmail.com or 07479 185962.
I am registered with the Information Commissioner’s Office (ICO), registration number ZA343698.
What information I collect
Depending on how we work together, I may hold:
- Your contact details (name, email address, phone number)
- Your GP details
- Information you share with me in sessions, and my session notes
- Information from your initial enquiry or assessment
- Payment and invoicing records
- Basic technical information if you use my website, such as cookies
Why I collect it, and the legal basis
I use your information to provide therapy to you, to keep the records that safe and ethical practice requires, to manage appointments and payments, and to meet my legal and insurance obligations.
UK data protection law requires me to have a lawful basis for this. In most cases that is the agreement between us (our Counselling Agreement), my legitimate interest in running my practice responsibly, or a legal obligation.
Some of what you share with me is information about your health. The law treats this as "special category data" and requires an extra condition to use it. I rely on the condition that covers the provision of health and care by a professional who owes a duty of confidentiality. Where I need your consent for something specific, I will ask for it clearly and you can withdraw it at any time.
Digital tools and AI
I use the following digital tools to run my practice: Gmail for communication, Zoom for online sessions, Word for session notes and administration.
Who I share it with
What you share with me stays confidential, with a small number of exceptions that are standard in therapy. I discuss my work in clinical supervision, without details that identify you. I may need to share information if the law requires it, or if I believe you or someone else is at serious risk of harm. Wherever possible I would talk to you first. A trusted colleague (my professional executor) holds secure instructions so clients can be contacted if I am suddenly unable to practise.
I never sell your information, and I never share it for marketing.
How long I keep it
I keep session notes and client records for 7 years after our work ends, in line with my professional body’s guidance and my insurer’s requirements, and then delete or destroy them securely. Enquiry emails and texts from people who do not become clients are deleted after 2 months. Payment records are kept for 5 years, as tax law requires.
How I keep it safe
Session notes and any documents containing your contact details are stored in Microsoft Word and are encrypted and password-protected. My devices are protected with a password and two-factor authentication. Email is provided by Gmail and I avoid sending sensitive detail by email where possible.
Your rights
You have rights over your information, including the right to ask for a copy of it, to have mistakes corrected, to ask me to delete it, to object to or restrict how I use it, and to withdraw any consent you have given. Some of these rights have limits, for example where I am required to keep records, but if you ask, I will always explain what I can do.
To use any of these rights, contact me at susierenshaw@gmail.com. I will respond within one month.
Complaints
If you are unhappy with how I have handled your information, please tell me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
I review this notice at least once a year and whenever I change how my practice handles information. The date at the top tells you when it was last updated.
