Privacy Policy

At The Held Space, I take your privacy seriously. I understand that counselling involves sharing personal, sensitive and sometimes deeply private information, and I am committed to treating your information with care, respect and confidentiality.

This Privacy Notice explains what personal information I collect, why I collect it, how I use and protect it, how long I keep it, when it may be shared and the rights you have in relation to your personal information.

This Privacy Notice applies to clients, prospective clients and anyone who contacts The Held Space about counselling.

It has been prepared with reference to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), and relevant guidance from the Information Commissioner's Office (ICO).

Who is responsible for your information?

For the purposes of data-protection legislation, The Held Space is the data controller responsible for the personal information I collect and process in connection with your counselling.

The Held Space
Counsellor: Lauren Budd
Email: admin@theheldspace.uk

If you have any questions about how your personal information is handled, or wish to exercise any of your data-protection rights, please contact me using the details above.

What personal information do I collect?

The information I collect will depend on your relationship with The Held Space and the counselling you receive.

Contact and identification information

• Your name
• Telephone number
• Email address
• Address, where necessary
• Date of birth or age
• Emergency contact details
• Information needed to confirm your identity where necessary

Appointment and administrative information

• Appointment dates and times
• Attendance information
• Cancellation or rearrangement information
• Correspondence relating to appointments
• Information needed to administer your counselling

Counselling and wellbeing information

This may contain sensitive information that you choose to share during therapy. I aim to collect and retain only information that is relevant and necessary for safe and effective therapeutic practice. This may include information relating to:

• Your mental and emotional wellbeing
• Your physical health
• Relationships and family circumstances
• Personal history and experiences
• Trauma or distressing experiences
• Medication or other relevant healthcare information
• Risk and safeguarding concerns
• Information relevant to your therapeutic work

Some of this information may constitute special category personal data, including information concerning your physical or mental health.

You are not required to discuss anything during counselling that you do not wish to discuss.

Payment information

Counselling sessions are paid for by bank transfer. I may process information necessary to record and administer payments, including:

• Payment date
• Amount paid
• Payment reference
• Information required for accounting and tax purposes

I do not have access to or retain your online banking passwords, login details or security credentials.

Communications

I may process information contained in communications between you and The Held Space, including emails, telephone communications, appointment enquiries and other correspondence relating to your counselling.

I encourage you to avoid including highly sensitive therapeutic information in ordinary emails unless necessary.

How is your information collected?

Information may be collected:

• Directly from you when you enquire about counselling
• When you complete an initial assessment, intake or consent form
• During counselling sessions
• Through email, telephone or other communications
• Through appointment and payment administration
• From a professional or organisation involved in your care, where appropriate and lawful
• From another lawful source where necessary

Where information is received from another person or organisation, I will only use it where there is an appropriate and lawful reason to do so.

Why do I use your information?

Your personal information may be used for the following purposes:

• Providing counselling. To provide counselling services, understand your needs, maintain appropriate therapeutic records and support safe, ethical and effective therapeutic practice.
• Managing appointments and administration. To arrange and manage appointments, communicate with you, record payments, manage cancellations and maintain appropriate business records.
• Safeguarding and safety. Information may be used or disclosed where necessary to protect you or another person from serious harm, or where there is a safeguarding concern requiring action. Where possible and appropriate, I will discuss this with you beforehand.
• Professional supervision. As part of my professional practice, I receive regular clinical supervision. Relevant information may be discussed with my clinical supervisor for professional reflection, safe practice, safeguarding and maintaining appropriate professional standards. Information will be anonymised or appropriately de-identified wherever reasonably possible.
• Legal, professional and insurance obligations. Information may be processed or disclosed where necessary to comply with a legal obligation, meet professional or regulatory requirements, comply with the requirements of my professional indemnity insurance, respond to a lawful request from a court or other authorised body, establish, exercise or defend legal claims, or protect the rights, safety or property of myself or another person.

What is the lawful basis for using your information?

Data-protection law requires me to have a lawful basis for processing your personal information. Depending on the circumstances, information may be processed because it is:

• Necessary for the performance of a contract. This includes providing and administering counselling services, arranging appointments and managing the counselling relationship.
• Necessary for compliance with a legal obligation. For example, where I am legally required to retain or disclose particular information.
• Necessary for legitimate interests. Where appropriate, I may process information where this is necessary for my legitimate interests in running and protecting my counselling practice, provided that these interests are not overridden by your rights and interests.
• Another lawful basis where required. There may be circumstances where another lawful basis applies under data-protection legislation.

I will only process your information where there is an appropriate lawful basis.

Special category information

Counselling records may contain special category personal data, including information concerning your physical or mental health. Special category data has additional protection under the UK GDPR.

Where I process special category information, I will ensure that there is both an appropriate lawful basis under Article 6 of the UK GDPR, and an applicable condition under Article 9 of the UK GDPR.

Where consent is used as the applicable basis or condition, you will be informed of this and your consent will be obtained appropriately. You can withdraw consent where consent is the basis being relied upon. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Confidentiality

Confidentiality is an important part of the counselling relationship. The information you share during counselling will normally remain confidential.

There are, however, circumstances where I may need to disclose information without your consent. This may include where:

• I believe there is a serious risk of significant harm to you or another person
• There is a safeguarding concern
• I am required to disclose information by law, including in response to a court order
• Disclosure is necessary to meet a legal, professional or safety obligation
• Disclosure is necessary to protect someone's vital interests

Any decision to disclose information will be made carefully and proportionately. Wherever possible and appropriate, I will discuss this with you beforehand. Only information that is necessary for the relevant purpose will normally be disclosed.

Further information about confidentiality and its limitations is contained within your Counselling Agreement / Working Agreement.

Who may your information be shared with?

Your information is treated as confidential and will only be shared where there is a lawful and appropriate reason to do so. Depending on the circumstances, this may include:

• Clinical supervisor. Relevant counselling information may be discussed with my clinical supervisor as part of professional supervision. Information will be anonymised or appropriately de-identified wherever reasonably possible. In the unlikely event that I become incapacitated or unable to manage my practice, my clinical supervisor may be given access to relevant client information where necessary to contact current clients and make appropriate arrangements for continuity of care.
• Healthcare or other professionals. Information may be shared with your GP, healthcare professional or another professional involved in your care where you have given appropriate permission, where sharing is otherwise necessary and lawful, or where there is a safeguarding or serious safety concern requiring disclosure.
• Emergency or safeguarding services. Information may be disclosed to emergency services, safeguarding services, the police or another appropriate organisation where this is necessary and lawful to protect someone from serious harm or where disclosure is required by law.
• Professional, legal, insurance or regulatory advisers. Information may be shared where necessary with appropriate professional, legal, insurance or regulatory bodies, for example where required to comply with a legal or professional obligation or to establish or defend a legal claim.
• Service providers. I use carefully selected third-party service providers to support the running of The Held Space. These currently include Google Workspace, my banking provider, and website and hosting providers, where applicable. These organisations may process personal information on my behalf in providing their services.

I do not sell your personal information or share it with third parties for their own marketing purposes.

Google Workspace

The Held Space uses Google Workspace to support the delivery and administration of the counselling service. The Google services I use may include:

• Gmail — used for email communication with clients and prospective clients, including appointment and counselling-related administration. Emails may contain personal information.
• Google Meet — used to provide online counselling sessions. Counselling sessions are not recorded. Information such as your name, email address and information required to arrange or conduct the session may be processed through Google Meet.
• Google Drive — may be used to securely store relevant counselling and administrative documents. Where counselling records are stored electronically, access is restricted and appropriate security measures are used.
• Google Calendar — used to manage counselling appointments. Only information necessary for appointment management will be included in calendar entries. Sensitive therapeutic information will not be recorded in calendar entries.
• Google Docs — may be used where necessary to create or maintain counselling or administrative documents. Where Google Docs is used to process personal information, appropriate access and security measures will be applied.

Google may process personal information outside the United Kingdom. Where this occurs, appropriate safeguards and lawful international transfer mechanisms will be used where required by UK data-protection law. For further information about how Google processes personal information, you can refer to Google's own privacy information.

Online counselling and electronic communication

The Held Space currently provides counselling online, using Google Meet. Online sessions will not be recorded.

You should take reasonable steps to ensure that you attend counselling from a private and appropriate location where other people cannot overhear the session.

Email, telephone and other electronic communications may be used to communicate with you about appointments and counselling administration. Electronic communications carry some inherent security risks. I will take reasonable steps to protect your information, but no electronic communication system can be guaranteed to be completely secure. Please avoid sending highly sensitive therapeutic information by email.

If an online session becomes disconnected unexpectedly, the arrangements for reconnecting or contacting you will be set out in your Working Agreement.

How are counselling records stored?

Counselling records are maintained to support safe, ethical and effective professional practice. Records may include information about:

• Presenting concerns
• Relevant personal history
• Therapeutic discussions
• Therapeutic interventions
• Risk and safeguarding considerations
• Professional reflections
• Attendance
• Information necessary to support continuity and safe practice

Electronic records may be stored using Google Drive and Google Workspace. Access to counselling records is restricted to the counsellor, except where access is necessary and lawful, such as professional supervision or other circumstances described within this Privacy Notice.

Appropriate physical, password and technical security measures are used to protect information from unauthorised access, loss, alteration or disclosure. Paper records, where created, will also be stored securely.

Clinical supervision

Regular clinical supervision is an important part of safe and ethical counselling practice. I discuss my professional work with a clinical supervisor to support:

• Safe therapeutic practice
• Professional reflection
• Ethical decision-making
• Safeguarding
• Professional development
• Maintaining appropriate standards of care

Where client information is discussed, I will anonymise or appropriately de-identify information wherever reasonably possible. My clinical supervisor is also expected to maintain appropriate professional confidentiality.

Payment information

Counselling sessions are paid for by bank transfer. Bank transfer payments are recorded for accounting, business, tax and insurance purposes where necessary.

Financial records will be stored securely and retained for the period required by applicable tax, accounting and legal requirements.

International transfers

Some third-party technology providers used by The Held Space, including Google, may process or store personal information outside the United Kingdom.

Where personal information is transferred outside the UK, I will ensure that the transfer is carried out in accordance with applicable UK data-protection law and that appropriate safeguards are in place where required.

How long is your information retained?

I will retain your personal information only for as long as it is necessary for the purposes for which it was collected, unless there is a legal, professional, insurance or other lawful reason to retain it for longer.

• Counselling records including intake information, consent forms and session notes will normally be retained for 7 years following the end of the therapeutic relationship. For clients aged 16–17, counselling records will be retained until the client reaches 25 years of age. This retention period reflects the requirements of my professional indemnity insurance and my professional record-keeping responsibilities. Where there is a specific legal, safeguarding, insurance or other lawful reason to retain information for longer, it may be retained for the additional period necessary.
• Financial and accounting records will be retained for the period required by applicable tax, accounting and legal requirements.
• Information relating to an initial enquiry where counselling does not proceed will normally be retained only for as long as necessary to deal with the enquiry and any related administrative requirements.
• Emails, calendar information and other administrative communications will not be retained indefinitely and will be deleted when they are no longer necessary, subject to any legal, professional, insurance or other lawful requirement to retain them.

Retention periods will be reviewed periodically to ensure that personal information is not kept for longer than necessary.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• Be informed about how your personal information is collected and used
• Request access to the personal information held about you
• Request correction of inaccurate or incomplete information
• Request erasure of your personal information in certain circumstances
• Request restriction of processing in certain circumstances
• Object to certain processing
• Request data portability where the legal requirements for this right are met
• Withdraw consent where consent is the lawful basis for processing
• Have rights relating to certain automated decision-making and profiling

These rights are not absolute and exemptions or limitations may apply. For example, information may need to be retained where there is a legal, professional, insurance or safeguarding reason to do so.

Subject Access Requests

You can ask for a copy of the personal information held about you. This is known as a Subject Access Request (SAR).

Requests can be made by contacting me at admin@theheldspace.uk.

You may be asked to provide sufficient information to verify your identity before information is disclosed. I will carry out reasonable and proportionate searches for information covered by your request, and will respond within the timeframe required by applicable data-protection law.

Data protection complaints

If you have concerns about how your personal information has been collected, stored, used or otherwise processed, please contact me in the first instance at admin@theheldspace.uk. You can make a data-protection complaint electronically by email.

I will acknowledge and investigate data-protection complaints in accordance with applicable requirements and provide you with the outcome of my investigation.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection and information rights. Further information about making a complaint to the ICO is available at ico.org.uk.

Data breaches

If a personal-data breach occurs, I will assess the breach and take appropriate action in accordance with applicable data-protection law.

Where notification to the ICO or affected individuals is legally required, this will be carried out within the applicable timescales. I will also take reasonable steps to contain the breach, reduce any potential harm and prevent similar incidents from occurring again.

Automated decision-making

Your personal information will not be used by The Held Space to make decisions about you based solely on automated processing where those decisions have legal or similarly significant effects on you.

Changes to this Privacy Notice

This Privacy Notice may be reviewed and updated from time to time to reflect changes in legislation, ICO guidance, professional requirements, technology, the services used by The Held Space, or the way personal information is processed.

The current version of this Privacy Notice will be made available on The Held Space website. Where changes materially affect how your personal information is processed, appropriate information will be provided where required.

Contact

If you have any questions about this Privacy Notice or how your personal information is handled, please contact:

The Held Space
Counsellor: Lauren Budd
Email: admin@theheldspace.uk