Privacy Statement

Last updated: 5 July 2026

 

1. Overview

1.1 James York Counselling & Wellbeing ("we", "us") is committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, and to the responsible and secure use of your personal data.

1.2 This statement explains what personal information we collect and hold, why we collect it, the legal basis we rely on, how long we keep it, who we share it with, and your rights over it.

1.3 We are registered with the Information Commissioner's Office (ICO), reference ZB142583.

1.4 The person responsible for data protection matters is James York, who can be contacted at talk@jamesyorkcounselling.co.uk. 

 

2. Information we collect

2.1 Enquiry data: When you contact us to ask about counselling or to arrange an initial appointment, we collect your name, contact details (email/phone), your availability, and any other information you choose to share with us in your message.

2.2 Client data: If you go on to become a client, we hold session records and case notes, which may include details about your health, wellbeing, and other sensitive matters you share in the course of therapy. This is "special category data" under Article 9 of the UK GDPR and is treated with extra care.

2.3 Data from enquiries that don't proceed to counselling: This is kept only for as long as needed to respond to you and is then deleted, normally within 12 months unless you ask us to keep in touch.

2.4 Client records: These are stored securely for 5 years after counselling ends, in line with professional (BACP) guidance, and then securely destroyed.

 

3. Why we collect it and our legal basis

3.1 We use your data to respond to enquiries, arrange and deliver counselling sessions, maintain accurate clinical records, and meet our professional and legal obligations (for example, to our clinical supervisor or insurer, or where the law requires disclosure).

3.2 For general enquiry and contact details, our legal basis is 'legitimate interest' — we need this information to respond to you and provide our services.

3.3 For special category (health-related) data shared during counselling, our legal basis is your 'explicit consent' (Article 9(2)(a) UK GDPR), which you give at the start of the counselling relationship as part of our contracting process. You can withdraw this consent at any time, though this may affect our ability to continue providing counselling to you.

3.4 Where disclosure is required by law (for example, safeguarding concerns or a court order), our legal basis is 'legal obligation', and this is also explained in our counselling contract.

 

4. Sharing your information

4.1 We will not share your details with any other person or organisation without your knowledge and permission, except:

- where there is a legal requirement to do so, as set out in your counselling contract; or
- where we use trusted third parties to help run our practice. These providers only process data on our instructions and are contractually required to keep it secure:
  - WriteUpp — a secure client management platform used to store session records and manage appointments. See WriteUpp's own privacy policy at writeupp.com for details of how they handle data on our behalf.
  - Google (Gmail) — used for email communication with you. See Google's privacy policy at policies.google.com/privacy.

4.2 We do not sell or rent your personal data to anyone. Most of your data stays within the UK, but Gmail is provided by Google and may store and process data outside the UK, including in the United States. Where this happens, Google maintains its own safeguards (such as the UK-US Data Bridge or standard contractual clauses) to ensure your data is protected to a standard equivalent to UK GDPR. We recommend keeping the content of emails to scheduling and general contact where possible. 

4.3 A breach of confidentiality is when information is shared in circumstances where it would reasonably be expected to stay confidential. We take confidentiality extremely seriously and it is central to the counselling relationship.

 

5. Cookies and our website

5.1 Our website uses one cookie, PHPSESSID, which is strictly necessary to keep the site working properly — for example, so that forms and page navigation function correctly as you browse.

5.2 This cookie does not track you, does not collect personal information, and is automatically deleted when you close your browser.

5.3 Because it is strictly necessary, it does not require your consent under the law and will be set regardless of any preference you select on our cookie banner. The banner still allows you to record a preference, which will automatically apply if we introduce any optional cookies (such as analytics) in future.

5.4 If this changes — for example, if we start using analytics or marketing cookies — we will update this section and ensure any non-essential cookies only run once you have given your consent via the banner.

 

6. Security

6.1 We take all reasonable precautions to prevent the loss, misuse, or alteration of the information you give us, including secure storage of physical and digital records.

6.2 Communications in connection with this service may be sent by email. For ease of use and compatibility, communications will not be sent in encrypted form unless you request this and give us permission to communicate with you that way. Unless encrypted, email is not a fully secure means of communication. While we take care to keep our systems and communications protected, we cannot guarantee that all communications will be free of viruses or interception.

 

7. Your rights over your personal data

7.1 Under UK GDPR, you have the right to:

- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data in certain circumstances
- Restrict or object to our processing of your data
- Withdraw consent at any time where we rely on consent (see 3.3)
- Complain to us or to the ICO (see Section 8)

7.2 To exercise any of these rights, please email us at talk@jamesyorkcounselling.co.uk. We will respond within one month, and may ask you to confirm your identity or clarify your request first — if we do, the response clock pauses until we receive that information.

 

8. How to complain

8.1 Complain to us directly: If you have any concern about how we've handled your personal data, please email talk@jamesyorkcounselling.co.uk with details of your concern. You do not need to use any particular form of words — any expression of dissatisfaction about how your data has been handled will be treated as a complaint.

8.2 We will acknowledge your complaint within 30 days, investigate it properly, keep you updated on progress, and let you know the outcome without undue delay.

8.3 Complain to the ICO: You also have the right to complain directly to the Information Commissioner's Office at any time, whether or not you have raised the matter with us first:
   - Website: ico.org.uk/make-a-complaint
   - Helpline: 0303 123 1113

 

9. Changes to this statement

9.1 We may update this statement from time to time to reflect changes in the law or in how we handle your data. The date at the top shows when it was last updated.

---

© 2026 James York Counselling & Wellbeing