Data Protection & Privacy Policy
Key Counselling and Psychotherapy — Helen Anne Wells PGDip MBACP UKCP (Accred)
1. Data Controller
Helen Anne Wells is the data controller responsible for your personal information. I am committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
2. What Data I Collect
I collect and process personal data including your name, contact details, date of birth, and special category data (health/mental health information) for the purpose of providing counselling services.
3. Lawful Basis for Processing
I process your personal data on the following lawful bases under UK GDPR:
• Article 6(1)(b) — Contract: processing is necessary to deliver the counselling services you have engaged me to provide.
• Article 6(1)(c) — Legal Obligation: I am required by professional regulations and my contractual obligations to retain clinical records for a minimum of 7 years following the end of the therapeutic relationship.
• Article 9(2)(h) — Health Care Provision: for special category health data (including mental health information), processing is necessary for the provision of health or social care treatment. This is a specific condition designed for therapeutic and clinical relationships and does not rely on your consent.
Important: Because I do not rely on consent as my lawful basis for processing your clinical records, there is no consent for you to withdraw in respect of those records. This is intentional and in your interests — it means your records are protected and retained in accordance with professional and legal obligations regardless of any future request.
4. How I Use Your Data
Your data is used solely to deliver and administer your counselling sessions, maintain clinical records, comply with my professional obligations (e.g. safeguarding duties), and — where required — liaise with supervising bodies. I will never sell your data or use it for marketing purposes.
5. Data Retention
Counselling records are retained for 7 years following the end of the therapeutic relationship, in line with my insurance requirements and professional guidance from BACP/UKCP who are my accrediting bodies and my contractual obligations. Records are then securely destroyed once this period has elapsed.
6. Your Rights
Under UK GDPR you have a number of rights in relation to your personal data. However, some rights are qualified and do not apply in all circumstances. The following explains how each right applies to your counselling records:
• Right of Access: You may request a copy of the personal data I hold about you at any time.
• Right to Rectification: You may ask me to correct inaccurate data. I will consider this in light of my professional and clinical obligations.
• Right to Erasure (“Right to be Forgotten”): This right does not apply to your clinical records during the 7-year retention period. Retention is required by law and professional obligation, which overrides any erasure request under Article 17(3)(b) UK GDPR.
• Right to Restrict Processing: You may request restriction in certain circumstances, though this may affect my ability to provide services.
• Right to Object: Where I rely on legitimate interests, you may object. This right does not apply where I process under legal obligation.
• Right to Data Portability: This right applies only to data processed by automated means on the basis of consent or contract. It does not apply to records held under legal obligation.
7. Data Protection Complaints — New Right from 19 June 2026
Under the Data (Use and Access) Act 2025 (Section 164A, Data Protection Act 2018, in force 19 June 2026), you have a statutory right to raise a data protection complaint directly with me before escalating to the Information Commissioner’s Office (ICO).
If you have a concern about how I have handled your personal data, please submit your complaint in writing to: helen.a.wells@outlook.com.
• I will acknowledge your complaint within 30 days of receipt.
• I will investigate and provide a full response without undue delay.
• You will be kept informed throughout the process.
If you remain dissatisfied with my response, you may escalate your complaint to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
8. Contact
Data Controller: Helen Anne Wells - Key Counselling and Psychotherapy Service
Email: helen.a.wells@outlook.com