top of page

Privacy policy

​

Amy Griffin Counselling

Last updated: 29 October 2026

​

1. About this privacy policy

Your privacy and confidentiality are important to me. This policy explains what personal information I collect, why I need it, how I store and protect it, and what rights you have over your information. It applies when you visit my website, contact me about counselling or use my counselling services.

 

I am Amy Griffin, a qualified integrative counsellor and registered member of the British Association for Counselling and Psychotherapy (BACP). I am the data controller for my independent counselling practice. This means I am responsible for deciding how and why personal information is collected and used. I am registered with the Information Commissioner's Office (ICO) and process personal information in accordance with applicable UK data-protection legislation, including UK GDPR and the Data Protection Act 2018.

​

If you have any questions about this policy, you can contact me at:

​

Email: amy@amygriffincounselling.co.uk
Website: www.amygriffincounselling.co.uk

​

2. What information I collect

The information I collect depends on whether you're making an enquiry or receiving counselling. When you visit my website or contact me I may collect:

  • Your name and contact details.

  • Information you choose to share in your enquiry.

  • Technical website information, such as your IP address, browser details and website activity, where collected through Wix and associated website services.

 

When you begin counselling I collect information relevant to providing and managing counselling services, including:

  • Your name, date of birth, address and contact details.

  • Your preferred method of communication.

  • Your completed counselling agreement.

  • Relevant information about your physical or mental health, where appropriate.

  • Emergency contact information, if you choose to provide it.

  • Appointment information and relevant communications.

 

During counselling

I keep brief clinical notes recording relevant aspects of our work together. These may include key themes, clinical observations, safeguarding considerations and information necessary for professional accountability.

I aim to collect only information that is relevant and necessary for providing counselling and meeting my professional responsibilities.

​

3. Why I collect and use your information

I use personal information to:

  • Respond to enquiries and arrange appointments.

  • Assess whether my counselling services are appropriate for your needs.

  • Provide counselling services.

  • Maintain appropriate clinical records.

  • Communicate about appointments and administrative matters.

  • Make reasonable adjustments where needed.

  • Manage payments and meet financial or legal obligations.

  • Meet professional responsibilities relating to supervision, safeguarding and ethical practice.

  • Respond to complaints, legal matters or legitimate requests relating to records.

 

I do not sell your personal information or use counselling records for marketing. I do not currently operate a marketing newsletter or automatically subscribe clients or website visitors to marketing communications.

​

4. My legal basis for processing your information

UK data-protection law requires me to have a lawful reason for collecting, using and storing personal information.

Different lawful bases apply depending on why the information is needed.

 

Contract — Article 6(1)(b)

I process information necessary to respond to requests for counselling, arrange appointments and provide the counselling services we have agreed.

​

Legitimate interests — Article 6(1)(f)

I retain appropriate professional records where necessary for professional accountability and responding to possible complaints or legal claims. In particular, I retain brief clinical notes for seven years after counselling ends, in accordance with my professional indemnity insurance requirements.

I balance these interests against clients' privacy rights and take steps to limit the information retained and protect its confidentiality.

 

Legal obligation — Article 6(1)(c)

I process and retain information where necessary to meet applicable legal obligations, including financial and tax record-keeping requirements. Other lawful bases may apply in exceptional circumstances, such as where processing is necessary to protect someone's life or comply with a specific legal requirement.

 

Sensitive personal information — Article 9

Counselling may involve information about your mental or physical health. This is classed as special category personal data and receives additional protection under UK GDPR. Where necessary to provide counselling, I process health-related information under Article 9(2)(h) of UK GDPR, supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

I am bound by professional confidentiality obligations and take appropriate steps to protect this information.

Where necessary in connection with establishing, exercising or defending legal claims, Article 9(2)(f) may also apply.

 

5. How your information is stored and protected

I use digital systems to manage appointments, communicate with clients and maintain counselling records.

​

Google workspace: I use my professional Google Workspace account for:

  • Email communication through Gmail.

  • Appointment management through Google Calendar.

  • Online counselling through Google Meet.

  • Client agreements and information forms through Google Forms.

  • Storage of client administration records and archived clinical notes through Google Drive.

 

Access to my professional Workspace account is restricted and protected by two-step verification.

 

reMarkable: During counselling, I keep brief clinical notes on a password-protected reMarkable device.

These notes use client reference codes rather than names or other direct identifiers. They synchronise through reMarkable's cloud service as part of my personal Connect subscription.

.

Website and enquiries: My website is hosted through Wix. Information submitted through my website enquiry form is processed to allow me to respond to enquiries. Enquiry information is deleted when no longer required, subject to any ongoing counselling arrangements or other justified retention needs.

 

Communication: I use professional email, telephone and WhatsApp to communicate with clients where appropriate.

Digital communication carries privacy and security risks, so I take reasonable precautions to protect personal information.

I encourage clients to use messages primarily for appointment-related and administrative communication rather than sharing detailed clinical information outside counselling sessions.

​

I review my working arrangements and take appropriate steps to protect confidential information against unauthorised access, loss or disclosure.

​

6. How I use artificial intelligence (AI)

I may use artificial intelligence (AI) tools to support professional learning, marketing preparation, teaching preparation and reflection on fictionalised clinical situations. I do not upload identifiable client information or clinical records, including counselling session notes, to AI tools. AI is not used to record, transcribe or automatically generate notes from counselling sessions. AI does not replace clinical supervision, professional judgement or my responsibility for the counselling services I provide.

​

7. Confidentiality and sharing information

What you share during counselling is treated confidentially. However, there are some circumstances in which information may need to be shared:

​

Clinical supervision: As a counsellor, I attend regular clinical supervision to reflect on my work and maintain appropriate professional standards. I may discuss aspects of client work during supervision, taking care to minimise identifying information and protect confidentiality. My supervisor is also bound by professional confidentiality obligations.

 

Safeguarding and serious concerns about safety: If I become concerned that you or someone else is at risk of serious harm, I may need to consider sharing relevant information with appropriate professionals or services. I will consider each situation carefully, including my ethical and legal responsibilities. Wherever possible and appropriate, I will discuss my concerns with you first and involve you in decisions about sharing information. There are also specific circumstances where disclosure may be required by law.

 

Other professionals: With your agreement, I may share relevant information with other professionals where appropriate to support your care. Information may also be shared where there is another valid legal basis or professional justification.

 

Digital service providers: The services I use may process information on my behalf or as independent providers under their applicable terms. These include Google Workspace, reMarkable, Wix and relevant communication services.

I assess the suitability of digital services and take reasonable steps to protect confidentiality and personal information.

Clinical will and unexpected circumstances

 

I have appointed a Clinical Executor, who is a professional bound by confidentiality, to manage necessary client arrangements if I die or become seriously incapacitated and am unable to continue practising. In these circumstances, my Clinical Executor may access relevant client information to contact current clients, manage outstanding appointments and support appropriate alternative arrangements. My Clinical Executor may also arrange the continued secure custody, retention and eventual deletion of clinical records in accordance with my professional and legal responsibilities. Access to confidential information will be limited to what is necessary for these purposes.

​

8. How long I keep your information

I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of my professional, legal and insurance responsibilities.

 

Client information and communications — six months

I generally retain client contact details, intake information, counselling agreements and relevant communications for six months after your last counselling appointment. Clients may take extended breaks from counselling without necessarily ending our work together. Where counselling remains ongoing, or there is another justified reason to retain information, these records may be held for longer. Once the information is no longer required, it is securely deleted. If you return to counselling after your administrative information has been deleted, I will ask you to complete a new counselling agreement and provide updated information.

 

Clinical notes — seven years

I retain brief clinical notes for seven years after counselling ends, in accordance with my professional indemnity insurance requirements. These notes are stored using client reference codes rather than full names to reduce identifying information.

They are retained for professional accountability and in case they are needed in connection with complaints or legal claims.

At the end of the retention period, the records are securely deleted unless there is a justified reason to retain them for longer.

 

Financial records — six years

I retain financial records, including invoices and receipts, for six years to meet applicable HMRC requirements.

These records are stored securely and deleted when no longer required, unless a longer period is legally necessary.

 

Exceptions: Certain information may need to be retained beyond the normal periods where necessary and lawful, for example in connection with an ongoing complaint, safeguarding matter or legal claim. Any extended retention will be limited to what is necessary and appropriate.

​

9. Website cookies and analytics

My website is hosted by Wix. Like most websites, it uses cookies and similar technologies to support website functionality and security. Cookies or similar technologies may also be used to understand how the website is used. Some cookies are necessary for the website to function. Where consent is required for non-essential cookies or tracking technologies, you can accept, reject or manage your preferences through the website's cookie consent banner. You can also manage certain cookies through your browser settings. I do not currently use additional marketing integrations such as Meta Pixel or Google Analytics through my Wix website.

 

10. International processing of information

Some digital services I use may process or make personal information accessible outside the United Kingdom.

Where international transfers of personal information take place, I consider the applicable data-protection requirements and safeguards, including relevant adequacy arrangements or contractual transfer protections where required.

You can contact me if you would like further information about the safeguards applicable to your personal information.

 

11. Your rights over your personal information

Under UK GDPR, you have rights concerning how your personal information is used. Depending on the circumstances, these include:

  • The right to be informed: To understand how your personal information is collected and used.

  • The right of access: To request a copy of personal information held about you.

  • The right to rectification: To request correction of inaccurate information.

  • The right to erasure: To request deletion of your information in certain circumstances.

  • The right to restrict processing: To ask that the use of your information is limited in certain circumstances.

  • The right to data portability: To receive certain information in a transferable format where applicable.

  • The right to object: To object to certain types of processing, including processing based on legitimate interests.

 

Where processing relies on your consent, you may withdraw that consent. These rights are not absolute. There may be circumstances where certain information must be retained or where an exemption applies. I do not use automated decision-making or profiling to make significant decisions about clients.

​

If you wish to exercise your rights, please contact me at:

amy@amygriffincounselling.co.uk

 

I will respond in accordance with applicable data-protection requirements, normally within one calendar month.

 

12. Concerns or complaints about your information

If you have any questions or concerns about how your information is handled, please contact me so we can discuss them.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

​

Information about making a complaint is available at: https://ico.org.uk/make-a-complaint/

​

13. Changes to this privacy policy

I review this policy periodically and update it when necessary to reflect changes to my practice, the technology I use or relevant legal and professional requirements. The latest version will be available on my website. Where significant changes affect how personal information is used, I will provide appropriate information about those changes.

​

​

bottom of page