Client Privacy Notice

Last updated: 28 September 2026

This notice explains what information I collect when we work together, why I need it, how I look after it and the choices you have. I have tried to write it in ordinary language. Please ask me if anything is unclear or you would like more detail.

In brief: I use your information only to provide and manage therapy, keep appropriate records, meet my professional and legal responsibilities, and protect safety where necessary. I do not sell your information or use it for advertising.

Who is responsible for your information?

Sam Driscoll, trading as Sam Driscoll Therapy, is the data controller. This means I am responsible for deciding how and why your personal information is used.

Email: info@samdriscolltherapy.com

Website: www.samdriscolltherapy.com

What information may I collect?

I collect only the information I reasonably need for our work. Depending on your circumstances, this may include:

your name, preferred name, date of birth, address and contact details;
contact preferences and practical information about appointments;
your GP's details and the details of an emergency contact;
information you choose to share about your physical or mental health, medication, diagnoses, relationships, identity, life experiences and reasons for seeking therapy;
brief session notes, appointment history and records of clinically important decisions, including risk or safeguarding decisions where relevant;
emails, text messages and other communications connected with our work;
payment, invoice and accounting information; and
information provided by a referrer, employer, insurer or other funder where somebody else is arranging or paying for your therapy.

Information about health, sexuality, racial or ethnic origin, religion, political beliefs and similar matters receives additional protection under data protection law. It is described as special category data.

If you give me another person's details, such as an emergency contact, please let them know where it is appropriate and safe to do so. Online sessions are not recorded unless we have made a separate and explicit agreement beforehand.

Why do I use your information?

to respond to you, arrange appointments and provide counselling or psychotherapy;
to understand what support may be appropriate and maintain continuity in our work;
to keep proportionate clinical and administrative records;
to receive payments, issue invoices and maintain tax and accounting records;
to discuss my work in confidential clinical supervision;
to respond appropriately to serious concerns about safety, safeguarding or unlawful activity; and
to meet professional, insurance and legal responsibilities, including responding to complaints or legal claims.

The legal basis for using your information

Data protection law requires me to identify a lawful basis for each use of personal information. The basis will depend on why the information is being used.

Providing therapy and managing our agreement. Most ordinary personal information is used because it is necessary to take steps at your request and to perform our counselling agreement (Article 6(1)(b) UK GDPR).

Professional and practice administration. I may rely on legitimate interests where the use is necessary to run a safe, ethical and accountable practice and those interests do not override your rights (Article 6(1)(f)).

Legal and financial duties. Some information is used to meet legal obligations, including tax, accounting and legally required disclosures (Article 6(1)(c)).

Urgent protection. In exceptional circumstances, information may be used to protect somebody's life or physical safety (Article 6(1)(d)).

For special category information, including health information, I normally rely on the condition that processing is necessary for the provision of health or social care or treatment and is carried out under a duty of confidentiality (Article 9(2)(h), with Schedule 1, Part 1 of the Data Protection Act 2018). Where relevant, another condition may apply, including the establishment or defence of legal claims, vital interests, or safeguarding carried out in the substantial public interest.

Where I specifically ask for your consent to share information, you may withdraw that consent. The acknowledgement that you have received this notice is not consent to every use of your data; it records that I have explained how your information is handled.

Who may see or receive information?

I treat what you tell me as confidential. Information may nevertheless be seen or received by the following people or services where this is necessary:

my clinical supervisor; I normally use limited or non-identifying information wherever possible, and supervision is itself confidential;
service providers that support my work, including Google Workspace for email, calendar and document storage; telephone and text-message providers; a video-calling provider for online sessions; and banking or accounting services;
a GP, emergency service, safeguarding service or another relevant professional where you have agreed, or where disclosure is necessary and justified because of a serious safety or safeguarding concern;
my professional insurer, legal adviser, professional body, a court or another authorised body where this is necessary to meet a legal or professional requirement or to establish, exercise or defend a legal claim; and
a referrer or funder, but only to the extent explained in the particular arrangement. Clinical details are not ordinarily shared with an employer or funder without your knowledge and an appropriate basis.

I will normally discuss a proposed disclosure with you first. There may be rare circumstances in which doing so would increase risk, prejudice an investigation or prevent me from complying with the law.

How is your information stored and protected?

Electronic records are stored using password-protected devices and business services with access controls and encryption. Clinical notes use a client reference where practicable, and identifying contact information is kept separately from session notes. Paper information, if any, is kept securely with access limited to me.

Some of the services I use may process or store information outside the United Kingdom. I use established business services whose published terms explain how personal information is protected and how any international transfers are managed. Further information is available in the privacy and data-processing information published by the relevant provider.

No method of communication or storage is entirely risk-free. I take proportionate steps to reduce foreseeable risks and will act promptly if I become aware of a data breach that may affect you.

How long is information kept?

I keep counselling records for the period required by my professional indemnity insurer at the time our work ends. When a client file closes, I record and apply the relevant retention deadline. You may ask me what period applies to your record and when it is due for deletion.

Financial and accounting information is kept for the period required by tax and accounting law. Routine messages are deleted when they are no longer needed, particularly where any necessary information has been transferred to the appropriate record. Information may be retained for longer where there is an active complaint, safeguarding matter or legal claim, or where the law requires this.

When information is no longer required, it is securely deleted or destroyed. Some backup systems may retain encrypted copies for a limited period before they are overwritten.

Professional reflection, writing and training

My experience as a therapist may inform my professional thinking, writing, training or public discussion. I will not publish your name or identifiable case material without your explicit written permission. Where an example is used without permission, identifying details will be removed or substantially changed, or material from several experiences will be combined, so that it does not identify you. My duty of confidentiality continues after therapy ends.

Your rights

Depending on the circumstances, you may have the right to:

ask for a copy of the personal information I hold about you;
ask me to correct information that is inaccurate or incomplete;
ask for information to be deleted, although this right is not absolute;
ask me to restrict how information is used;
object to processing based on legitimate interests; and
receive certain information in a portable format.

I may need to confirm your identity before responding to a request. I will normally respond within one month. If I cannot fully meet a request, I will explain why. I do not use your information for automated decision-making or profiling.

Questions or concerns

Please contact me first if you have a question, concern or request: info@samdriscolltherapy.com.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. Information about making a complaint is available at www.ico.org.uk.

Changes to this notice

I may update this notice if my practice, the services I use or the law changes. If a change materially affects how I use your information, I will make reasonable efforts to tell you. The current version is available from me on request.