Data and Privacy

Last updated: 1 September 2026 

Our commitment to your privacy 

At Mandy Cummings Counselling, I believe that protecting your personal information is an essential part of the therapeutic relationship. Trust and confidentiality are at the heart of the work we do together, and this extends to how I handle your data. I want you to feel confident that your information is treated with the same care and respect as everything you share with me in our sessions. 

What information I collect 

When you work with me, I collect and keep the following types of information: 

• Your name and contact details (such as address, phone number, and email) 
• Information about why you have come to therapy (your presenting issues) 
• Notes from our sessions 
• Relevant medical or health history that you share with me incl GP details 
• Payment information for invoicing and record-keeping purposes 

Why I collect this information 

I need to collect and use your personal information to provide you with therapy. Under UK data protection law, there are specific legal reasons that allow me to do this: 

For general personal data: I rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. In plain terms, I need your information to fulfil the agreement we make when you become a client. 

For health-related information: Because therapy involves sensitive information about your mental and physical health, I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition under DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care) also applies. 

Professional obligations 

As a BACP-registered counsellor, I am required to discuss my clinical work in professional supervision. This is an important part of maintaining safe and ethical practice. However, your identity is always protected: I do not share your name or any identifying details with my supervisor. My supervisor receives anonymised case material only and is bound by their own professional confidentiality obligations. 

Clinical will arrangements 

I have appointed a Clinical Executor who would act on my behalf should I become seriously ill, incapacitated, or die. In such circumstances, my Clinical Executor would contact you to let you know what has happened and to discuss your options. They would handle your records with complete confidentiality, retaining them securely until the end of the applicable retention period before securely destroying them. My Clinical Executor is bound by the same duty of confidentiality that I observe. 

Who else may see your information 

Beyond myself, the following people or services may have access to your information: 

• Clinical supervisor — receives anonymised case material only, with no identifying details 
• Go Daddy — the platform that hosts my website, which may collect basic technical data about visitors 
• MS Teams — if we work together online, MS Teams facilitates our video sessions 
• Statutory authorities — in rare circumstances where the law requires disclosure (see below) 

When I might need to break confidentiality 

Confidentiality is fundamental to therapy, but there are rare situations where I may need to share information without your consent: 

• If there is a serious risk of harm to you or someone else 
• If there are safeguarding concerns about a child or vulnerable adult 
• If I receive a court order requiring disclosure 

Wherever possible, I will always try to discuss this with you first before sharing any information. 

How long I keep your records 

I keep your records for 7 years after our last session together. This is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements. After this period ends, paper records are securely destroyed and electronic records are permanently deleted. 

Your rights 

You have several rights regarding your personal information: 

• Access — you can ask to see what information I hold about you 
• Correction — if any details are wrong, you can ask me to correct them 
• Deletion — you can ask me to delete your information, although this right is not absolute; I may need to retain your records until the end of the retention period where required by professional guidelines, insurance requirements, or law 
• Complaint — if you are unhappy with how I have handled your data, you have the right to complain 

Making a complaint 

If you have any concerns about how I handle your personal information, please raise them with me directly. You can contact me at hello [at] mandycummingscounselling.co.uk (Please replace [at] with @ when emailing) .

My Data Protection Officer (Voluntary Registration) is Maureen Chaffe who can be contacted at processmatters2@gmail.com or by phone at 07593662123.  

Under the Data (Use and Access) Act 2025, you also have the right to complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled: 

• Website: ico.org.uk 
• Telephone: 0303 123 1113 

 Last updated: 1 September 2026

Mandy Cummings Counselling 

This policy explains how long I keep your personal information, why I need to keep it, and what happens to it afterwards. 

Why I Retain Your Data 

I am required to keep records of our therapeutic work for several important reasons: 

• Legal obligations — UK law, including the Limitation Act 1980, sets time limits during which legal claims may be brought. I must retain records that may be needed to respond to any such claims 
• Professional standards — As a BACP-registered counsellor and psychotherapist, I am bound by the BACP Ethical Framework 2026, which requires me to maintain appropriate records 
• Insurance requirements — My professional indemnity insurance requires me to keep records for a minimum period to ensure I can respond to any claims or complaints 
• Continuity of care — Records help me provide consistent, safe support throughout our work together and in any future sessions 

Retention Periods

Type of Record: Client therapy records (adults) including emails 

Retention Period:  7 years after your last session 

Reason: In line with the Limitation Act 1980 and standard professional indemnity insurance requirements 

Type of Record: Enquiry or contact data (non-clients)

Retention Period: 12 months from last contact 

Reason: To respond to your enquiry and follow up appropriately 

Type of Record: Financial records and invoices 

Retention Period: 6 years from the end of the financial year 

Reason: HMRC requirement for tax purposes 

Type of Record: Insurance records 

Retention Period: 7 years 

Reason: To respond to any insurance-related matters 

Type of Record: Smartphone 

Retention Period: When counselling ends 

Reason: If you have provided consent for communication via mobile, I will hold your client code and telephone number on my mobile phone until our counselling relationship ends and then I will delete it from my contact list, unless you request otherwise. Please note that the phone will retain summary records of calls made to or from your number (date and duration) and any recorded messages. 

What I Retain 

The records I keep may include: 

• Session notes — brief notes about the content and themes of our sessions 
• Contact details — your name, address, phone number, and email address 
• Therapy agreement — the signed contract between us 
• Payment records — invoices and records of payments received 
• Correspondence — emails or letters exchanged between us 
• Risk assessments — any safeguarding concerns or safety plans discussed 
• Consent records — records of any specific consents you have given 

How Your Data Is Stored 

I take the security of your information seriously: 

• Electronic records are held on password-protected devices with MFA and access restricted to me only 
• Paper records are kept in a locked filing cabinet in a secure room, with access restricted to me only 
• Clinical supervision — I discuss my work in supervision to maintain professional standards. When I do so, I use anonymised case material only, meaning your name and identifying details are not shared with my supervisor 

In the event of my death or incapacity, I have appointed a Clinical Executor — a fellow therapist bound by the same professional duty of confidentiality. They will contact you to let you know what has happened and will retain your records securely until the end of the applicable retention period. Records will only be securely destroyed after that period ends. 

Your Right to Erasure 

Under UK GDPR, you have the right to request that your personal data be erased. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where this is required by: 

• Professional guidelines 
• Insurance requirements 
• Legal obligations 

If you ask me to delete your data and I am unable to do so, I will always explain my reasons clearly and let you know when the data can be deleted. 

Secure Disposal 

When the retention period ends: 

• Paper records are securely destroyed 
• Electronic records are permanently deleted 

I do not keep your information for longer than necessary. 

Questions or Complaints 

If you have any questions about how long I keep your data, or if you would like to make a data protection complaint, please contact me: 

Email: hello [at] mandycummingscounselling.co.uk (Please replace [at] with @ when emailing)
(The email above is shown with [at] in place of @ to reduce spam — please replace [at] with @ when emailing) 

You can also use the complaints form at  https://mcummingscounselling.co.uk/makeacomplaint

My Data Protection Officer (Voluntary Registration) is Maureen Chaffe who can be contacted at processmatters2@gmail.com or by phone at 07593662123.  

If you are not satisfied with my response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. 

Last updated: 1 September  2026 

Who we are 

Mandy Cummings Counselling is a private counselling and psychotherapy practice run by Mandy Cummings. I am a registered counsellor and psychotherapist providing therapeutic services to adult clients.   If you have any questions about how I handle your personal data, you can contact me at: 

Email: hello [at] mcummingscounselling.co.uk   (Please replace [at] with @ when emailing) 

What personal data we collect 

To provide therapy and manage our therapeutic relationship, I collect and process the following types of personal data: 

Contact information: 

• Your name, address, telephone number, and email address 
• Emergency contact details 

Health and therapy-related information: 

• The reasons you are seeking therapy (presenting issues) 
• Relevant medical and mental health history including GP details 
• Information about current medications or treatments 
• Session notes recording our therapeutic work together 
• Any assessments or outcome measures used during therapy 

Administrative information: 

• Appointment dates and times 
• Payment records and invoices 
• Correspondence between us 

Important: Much of the information I collect about you relates to your physical or mental health. Under Article 9(1) of the UK GDPR, this is classified as "special category data" because of its sensitive nature. Special category data receives enhanced legal protection, and I take additional care to keep this information secure and confidential.

How we collect your data 

I collect your personal data directly from you in the following ways: 

• At first contact — when you enquire about therapy by email or telephone 
• During intake — when you complete any initial assessment forms or questionnaires 
• During sessions — through our conversations and therapeutic work together 
• Between sessions — through any emails, text messages, or telephone calls we exchange 

I do not collect personal data about you from any other sources unless you ask me to liaise with another professional (such as your GP) and give me written consent to do so. 

Why we process your data — lawful basis 

Under UK data protection law, I must have a valid legal reason (known as a "lawful basis") to process your personal data. Because I process both ordinary personal data and special category health data, I rely on two separate legal bases: 

Article 6 basis (ordinary personal data): 

I process your personal data under Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services. I need to process your personal data to fulfil that contract. 

Article 9 basis (special category health data): 

I process your health-related data under Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. 

The additional condition required under UK law is met through DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care). Processing is carried out by a registered psychotherapist subject to the professional obligation of confidentiality under the UKCP Code of Ethics and Professional Practice. 

Professional obligations and CPD 

As a BACP-registered counsellor and psychotherapist, I am required to attend regular clinical supervision. This is an essential part of maintaining safe, ethical, and effective practice. I may discuss aspects of our therapeutic work with my clinical supervisor. 

When I do so: 

• Your name and any identifying details are not shared with my supervisor 
• I use anonymised or pseudonymised case material only — this means I change or remove any information that could identify you 
• My clinical supervisor is a qualified professional bound by the same confidentiality obligations as I am 
• My supervisor is bound by their own professional code of ethics and practice 

Clinical supervision helps me reflect on my work, ensures I am practising safely, and ultimately benefits the quality of therapy I provide to you. 

Clinical will — what happens to your records if we are unable to practise 

I have appointed a Clinical Executor — a trusted fellow therapist who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly. 

If this happens, my Clinical Executor will: 

• Contact you to let you know I am no longer able to practise 
• Offer to help you find alternative therapeutic support if needed 
• Handle your records with the same confidentiality I would 
• Retain your records securely until the end of the applicable retention period 
• Securely destroy your records only after the retention period has ended 

My Clinical Executor is bound by professional confidentiality obligations and will treat your information with the same care and respect that I do. 

Who we share your data with 

Your personal data is kept strictly confidential. I do not share your information with anyone except in the limited circumstances described below. 

Third-party services: 

I use the following services to run my practice, and they may process some of your data: 

• GoDaddy — provides website hosting. GoDaddy may collect certain technical data about visitors including basic analytics. 
• MS Teams — used for online therapy sessions if you choose video appointments 

Each of these services is bound by a data processing agreement that requires them to protect your data. Links to their privacy policies are available on request. 

Clinical supervision: 

As explained above, I discuss anonymised case material with my clinical supervisor. Your name and identifying details are never shared. 

I never sell your personal data. 

International data transfers 

Some of the third-party services I use may transfer your personal data outside the United Kingdom: 

• GoDaddy (GoDaddy, UK) — no international transfer; data remains in the UK 
• MS Teams (Microsoft UK) — no international transfer; data remains in the UK  

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025. 

The USA does not currently have a UK adequacy decision, which is why these additional safeguards are necessary. 

You can request a copy of the relevant transfer safeguards by contacting me. 

How long we keep your data 

I keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, and to meet my legal and professional obligations. 

Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements 

Financial records: 6 years (this is a legal requirement set by HMRC) 

Website enquiries from non-clients: 12 months 

After the applicable retention period has ended, your records are securely destroyed. Paper records are securely destroyed, and electronic records are permanently deleted. 

Your rights under UK GDPR 

You have the following rights regarding your personal data: 

Right to be informed You have the right to know how I collect and use your personal data. This privacy policy fulfils that right. 

Right of access You can ask for a copy of the personal data I hold about you. This is known as a "subject access request." Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month. 

Right to rectification If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it. 

Right to erasure You can ask me to delete your personal data in certain circumstances. However, this right is not absolute — I may need to retain your records until the end of the applicable retention period where this is required by professional guidelines, insurance requirements, or law. 

Right to restrict processing You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated. 

Right to data portability You can ask me to provide your data in a structured, commonly used format so you can transfer it to another service provider. This right applies only to data you have provided to me and which I process based on your consent or our contract. 

Right to object You can object to certain types of processing. However, as I process your data under contract and for health care purposes, this right has limited application to therapy records. 

Rights related to automated decision-making You have the right not to be subject to decisions made solely by automated means that significantly affect you. I do not use automated decision-making in my practice. 

To exercise any of these rights, please contact me at:   hello [at] mandycummingscounselling.co.uk 

(Please replace [at] with @ when emailing) 

Data protection complaints — your right under the Data (Use and Access) Act 2025 

If you are unhappy with how I have handled your personal data, you have the right to make a data protection complaint directly to me. 

You can submit a complaint at: https://mcummingscounselling.co.uk/makeacomplaint 

Or contact me at: hello [at] mandycummingscounselling.co.uk 

I take all complaints seriously and will respond within one month. 

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO): 

• Website: ico.org.uk 
• Telephone: 0303 123 1113 
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF 

Confidentiality exceptions 

Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to break confidentiality without your consent: 

• Risk of serious harm — if I believe you or someone else is at serious risk of harm 
• Safeguarding concerns — if I become aware of a child or vulnerable adult who may be at risk of abuse or neglect 
• Legal requirement — if I receive a court order requiring me to disclose information 

In any of these situations, I will always try to discuss this with you first, unless doing so would itself put someone at risk. 

If I ever need to break confidentiality, I will share only the minimum information necessary and only with the appropriate person or authority. 

Changes to this policy 

I review this privacy policy annually and whenever my practices change. If I make any significant changes that affect how your personal data is handled, I will inform you directly. 

Last updated: 1 September 2026 

What are cookies 

Cookies are small text files that websites place on your device when you visit them. They help websites work properly and can remember your preferences. Most websites use cookies, and they are generally harmless. 

Cookies we use 

Essential cookies 

These cookies are necessary for the website to function and cannot be switched off. They enable basic features such as page navigation and access to secure areas of the website. Because these cookies are strictly necessary, no consent is required for them to operate. 

Statistical and analytics cookies 

We do not currently use analytics or statistical cookies on this website. 

Advertising and tracking cookies 

We do not use advertising or tracking cookies on this website. 

Cookie consent tool 

We do not currently use a cookie consent tool on this website. If we introduce cookies that require your consent in the future, we will implement an appropriate consent mechanism at that time. 

Third-party cookies 

Cookies may be set by third-party services that we use to provide website functionality: 

• GoDaddy — This website is built on the GoDaddy platform. GoDaddy may place cookies on your device to enable the website to function correctly and may collect certain technical data about visitors including basic analytics. These cookies are set by GoDaddy UK Ltd, UK-based. 
• We also use Google Analytics cookies to help us to improve our website by collecting and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyone.  

I do not control third-party cookies. You can find more information about the cookies these services use by visiting their respective privacy policies. 

How to opt out or manage cookies 

You can control and delete cookies through your browser settings. Most browsers allow you to: 

• See what cookies are stored and delete them individually 
• Block third-party cookies 
• Block cookies from particular websites 
• Block all cookies 
• Delete all cookies when you close your browser 

Please be aware that restricting cookies may affect the functionality of this website. 

For detailed guidance on managing cookies in your specific browser, visit aboutcookies.org. 

Your rights 

Under the Privacy and Electronic Communications Regulations (PECR) as updated by the Data (Use and Access) Act 2025, you have the right to opt out of statistical cookies at any time. Opting out of these cookies will not affect your ability to use the core features of this website. 

If you have any questions about how we use cookies, please contact me at hello [at] mcummingscounselling.co.uk. 

Updates to this policy 

I will update this cookie policy if my use of cookies changes. Any significant changes will be reflected in a revised version published on this website.  

How to control or opt out of cookies 

This website does not use advertising or tracking cookies. Only essential cookies needed for the site to function are used. You can still control or clear cookies through your browser settings at any time. 

Browser controls: All major browsers let you block or delete cookies. See instructions for Chrome, Firefox, Safari, and Edge.