Here at Stable Foundations Counselling I believe that protecting your personal information is an essential part of the therapeutic relationship. Trust and confidentiality are at the heart of the work we do together, and I take my responsibility to safeguard your data as seriously as I take the care I provide in our sessions.

I work under UK jurisdiction and adhere to the British Association for Counselling and Psychotherapy (BACP) ethical framework, complying with UK GDPR and other data protection laws.

This policy explains, in plain terms, what information I collect, why I collect it, how I keep it safe and what rights you have. By using my services, you opt in to consent.

1. Who we are

Stable Foundations Counselling is a private therapy practice run by Mercie Kennedy who is a BACP registrant (Membership number 00923781) and ICO registered (ZB427186).

If you have any questions about how I handle your personal data, please contact me via email (mercie@stablefoundations.co.uk) or through the contact form on my website (https://stablefoundations.co.uk/contact-us/)

2. What personal data we collect

I collect and process the following types of personal data:

Contact and administrative information:

• Your name, address, telephone number and email address
• Emergency contact details
• GP details
• Enquiry details submitted via the website contact form
• Enquiry details submitted via any Therapist Directories I advertise my services on
• Enquiry details submitted via social media such as Facebook Messenger and Instagram

Health and therapy-related information:

• Presenting issues and reasons for seeking therapy
• Relevant medical and mental health history
• Session notes and records of our therapeutic work together
• Assessment information and treatment plans

Website information:

• Standard, anonymised browsing data (eg IP address, pages visited) for website improvement, via tools like Google Analytics

3. Who we share your data with/ Confidentiality

I take your confidentiality seriously and keep your personal data within strict professional boundaries. The following parties may have limited access to your data:

• Clinical supervisor: Receives anonymised case material only and is bound by confidentiality and ethical standards.
• Executor of my Clinical Will: A clinical will is an agreement with a trusted colleague who would manage client records, in line with this policy, in the event that I become incapacitated or die unexpectedly.
• External IT support: May have incidental access to systems during maintenance; bound by confidentiality agreements

I also use the following GDPR- compliant and professional industry standard third-party services which may process limited data as part of their service delivery:

• Stackmail (encrypted email)
• Microsoft Teams (video sessions)
• Zoom (video sessions)
• WhatsApp and Text (messaging, where agreed)
• Starling (Payments)
• HMRC Tax Services

Data Security

I never sell your personal data.

Al Transparency: I do not use AI-tools to write my clinical notes or record sessions. To operate professionally, I need to use some third-party providers that use AI tools but are secure and GDPR-compliant.

I use secure systems (password protection, encryption) to protect your data. Electronic records are stored securely, often a servers within GDPR-compliant regions. While I strive for maximum security, no online transmission is 100% risk-free. Paper records are filed in a locked cabinet and do not leave my premises.

Confidentiality

Your sessions are confidential. I do not share your personal information without your explicit consent, except when:

• There’s a serious risk of harm to you or others (I’ll try to discuss this with you first)
• Legally required by a UK court
• In cases of money laundering
• In cases involving acts of terrorism or other breaches of security
• For professional supervision

4. How we collect your data

Most of the personal data I collect will be directly from you:

• When you first contact me to enquire about therapy (by phone, email or the website contact form)
• During our initial consultation and assessment
• Throughout our therapeutic work together during sessions
• Through any communications between sessions (email, telephone or messaging)

I do not collect personal data about you from any other source without your knowledge.

Data not collected directly from you includes data for website use: Standard, anonymised browsing data (e.g. IP address, pages visited) for website improvement, via tools like Google Analytics

5. Why we process your data

• Providing therapy: Based on our contract and legitimate interests. For sensitive health data, I rely on “provision of health or social care” and/or your explicit consent.
• Managing sessions: Scheduling, communication and maintaining minimal clinical records.
• Professional supervision: Supervision is a standard requirement across the counselling profession. I am required by BACP to attend regular clinical supervision as part of my ongoing professional development and to ensure safe, ethical practice. I may discuss our therapeutic work with my supervisor. My clinical supervisor is a qualified professional bound by the same confidentiality obligations as I am.
• Legal/ethical duties: Compliance with tax, safeguarding and BACP guidelines.
• Emergency protocols: Managing serious risk of harm, potentially involving emergency services or trusted contacts, with prior discussion where possible.
• Service improvement: Analysing anonymised website data.

6. How long we keep your data

I retain your personal data for a period of 7 years after your last session, in line with professional and insurance guidelines.

After the applicable retention period ends, paper records are securely destroyed and electronic records are permanently deleted.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right to be informed— to know how your data is being used (this privacy policy fulfils that right)
• Right of access — to request a copy of the personal data I hold about you (known as a subject access request)
• Right to rectification — to ask me to correct any inaccurate or incomplete data
• Right to erasure — to ask me to delete your personal data. This right is not absolute; I may need to retain records until the end of the applicable retention period where required by professional guidelines, insurance requirements or law
• Right to restrict processing — to ask me to limit how I use your data in certain circumstances
• Right to data portability — to receive your data in a commonly used format or have it transferred to another provider (where technically feasible)
• Right to object — to object to certain types of processing
• Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice

You are not required to pay any charge for exercising your rights. If you make a request, I have one month to respond to you. Please contact us at mercie@stablefoundations.co.uk or via my website if you wish to make a request.

8. How to make a complaint:

If you have any concerns or complaints about how I handle your personal data, you have the statutory right to raise a formal data protection complaint directly with me.

Please submit your complaint in writing to mercie@stablefoundations.co.uk or via the Complaints Form here. form on my website.

I will acknowledge receipt of your complaint within 30 days.

Complaints are logged and documented by myself.

I will investigate the matter in line with the Data (Uses and Access) Act of 2025 and will provide a full outcome response without undue delay.

I will keep you informed of my progress if the investigation requires extended enquiries.

If you remain dissatisfied with the outcome of my internal investigation, you have the right to escalate your complaint to the UK’s Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Clients outside the UK may contact their local data protection authority.

9. Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how your personal data is handled, I will inform you directly.

The current version of this policy is always available on my website.