• Privacy Policy

    Last updated: 12 June 2026

    1. Who we are

    This privacy policy explains how Counselling for Changes collects, uses, and protects your personal information. I am Sue Bird, a qualified counsellor and psychotherapist registered with BACP, practising under the ethical framework that governs my profession.

    If you have any questions about how I handle your data, please contact me at counsellingforchanges [at] gmail.com

    2. What personal data we collect

    To provide you with therapy, I collect and process the following types of personal information:

    Contact and identification details:

    • Your name, address, telephone number, and email address

    • Emergency contact details (if you choose to provide them)

    Health and therapy-related information:

    • The reasons you are seeking therapy (presenting issues)

    • Information about your mental and emotional health

    • Relevant medical history you share with me

    • Session notes recording our therapeutic work together

    • Risk assessments where appropriate

    Important: Your health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I take additional care to keep it secure and confidential.

    Website enquiries:

    • If you contact me through the website contact form, I collect your name, email address, and the content of your message

    Financial records:

    • Payment information and invoices relating to your sessions

    3. How we collect your data

    I collect your personal information directly from you:

    • When you first contact me to enquire about therapy (by email, telephone, or the website contact form)

    • During your initial assessment session

    • Throughout our therapeutic work together, as you share information during sessions

    • Via email or telephone communications between sessions

    I do not collect information about you from other sources without your knowledge and consent, except in rare safeguarding situations where I may need to contact emergency services or other professionals.

    4. Why we process your data — lawful basis

    Under UK data protection law, I must have a valid legal reason (a "lawful basis") to process your personal information. Because therapy involves both ordinary personal data and special category health data, I rely on two separate legal bases:

    Article 6 basis (ordinary personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for the provision of counselling services, and I need to process your data to fulfil that contract.

    Article 9 basis (special category health data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified counsellor bound by professional confidentiality obligations under the BACP Ethical Framework, I am permitted to process your health-related information for the purpose of providing you with therapy.

    The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care purposes).

    5. Professional obligations and supervision

    As a BACP-registered therapist, I am required to attend regular clinical supervision. Supervision is an essential part of ethical therapy practice — it helps me reflect on my work and ensures I am providing you with safe, effective support.

    When I discuss my therapeutic work with my supervisor:

    • Your name and any identifying details are not shared with my supervisor

    • I use anonymised or pseudonymised case material only — this means I change or remove details that could identify you

    • My supervisor is a qualified professional bound by the same confidentiality obligations as I am

    • My supervisor is bound by their own professional body's ethical framework

    Supervision discussions are confidential and are conducted solely to support the quality of your therapy.

    6. Clinical will — what happens to your records if I am unable to practise

    I am currently putting clinical will arrangements in place. A clinical will is a plan that ensures your records are handled appropriately and confidentially if I become seriously ill, incapacitated, or pass away unexpectedly.

    Once these arrangements are finalised, I will update this policy and inform current clients. The plan will ensure that a designated professional colleague — bound by equivalent confidentiality obligations — securely manages or destroys records in accordance with this privacy policy.

    7. Who we share your data with

    I treat everything you share with me in therapy as confidential. However, I use certain third-party services to run my practice and website, and these services may process limited personal data on my behalf:

    • Squarespace — the platform that hosts this website, website builder and hosting provider

    • Zoom — for online therapy sessions

    Each of these services is bound by a data processing agreement that requires them to protect your information. I am happy to provide links to their privacy policies on request.

    Other parties with limited access:

    • My clinical supervisor — receives anonymised case material only (no names or identifying details)

    • My external bookkeeper — has access to invoice data only (your name and payment information) for accounting purposes. They are bound by confidentiality obligations and do not have access to your therapy records.

    I never sell your personal data to anyone.

    8. International data transfers

    Some of the third-party services I use may transfer your personal data outside the United Kingdom:

    • Squarespace (Squarespace Inc) — USA

    • Zoom (Zoom Video Communications Inc) — USA

    The USA does not currently have a UK adequacy decision, which means it is not automatically recognised as providing equivalent data protection. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards. These are legal mechanisms approved under UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

    You can request a copy of the relevant transfer safeguards by contacting me.

    9. How long we keep your data

    I keep your personal data only for as long as necessary. The retention periods I apply are:

    Type of recordRetention periodReasonTherapy records7 years after our last sessionIn line with the Limitation Act 1980 and standard professional indemnity insurance requirementsFinancial records (invoices, receipts)6 yearsHMRC legal requirementWebsite enquiries (if you do not become a client)12 monthsTo respond to your enquiry and follow up if appropriate

    After the applicable retention period ends, I securely destroy your records. Paper records are shredded using a cross-cut shredder. Electronic records are permanently deleted using secure deletion software that overwrites the data to prevent recovery.

    10. Your rights under UK GDPR

    You have the following rights regarding your personal data. I have explained each one in plain language:

    Right to be informed You have the right to know how I collect and use your data. This privacy policy fulfils that right.

    Right of access You can ask me for a copy of the personal data I hold about you. This is sometimes called a "subject access request." I will respond within one month. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data.

    Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

    Right to erasure In some circumstances, you can ask me to delete your personal data. However, this right does not apply where I am required to keep records for professional, legal, or insurance reasons. I will explain if I cannot fulfil an erasure request and why.

    Right to restrict processing You can ask me to limit how I use your data in certain circumstances — for example, while I investigate a complaint you have made about accuracy.

    Right to data portability Where technically feasible, you can ask me to provide your data in a format that allows you to transfer it to another service.

    Right to object You can object to certain types of processing. However, because I process your data under contract (Article 6(1)(b)) and for health care purposes (Article 9(2)(h)), this right has limited application to therapy records.

    Rights related to automated decision-making I do not use automated decision-making or profiling in my practice.

    To exercise any of these rights, please contact me at counsellingforchanges [at] gmail.com

    11. Data protection complaints — your right under the Data (Use and Access) Act 2025

    If you are unhappy with how I have handled your personal data, you have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate promptly.

    To make a complaint:

    I will acknowledge your complaint within 7 days and provide a full response within 28 days.

    If you are not satisfied with my response: You have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator:

    • Website: ico.org.uk

    • Telephone: 0303 123 1113

    • Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

    12. Confidentiality exceptions

    Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent:

    • Risk of serious harm: If I believe you or someone else is at immediate risk of serious harm or death

    • Safeguarding concerns: If I become aware of abuse or neglect involving a child or vulnerable adult

    • Legal obligation: If I receive a court order requiring me to disclose information

    • Terrorism: Under the Terrorism Act 2000, I have a legal duty to report certain information related to terrorism

    Wherever possible, I will discuss any disclosure with you first, unless doing so would itself put someone at risk. I will only share the minimum information necessary and will tell you what I have shared and why, unless prohibited by law.

    13. Changes to this policy

    I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how your data is handled, I will inform you directly — for example, by email or at your next session.

    The date at the top of this policy shows when it was last updated.

    Contact

    If you have any questions about this privacy policy or how I handle your personal data, please contact me:

    Item description

  • Cookie Policy

    Last updated: 12 June 2026

    What are cookies

    Cookies are small text files that websites place on your device when you visit them. They help websites work properly and can remember your preferences. Some cookies are temporary and disappear when you close your browser, while others stay on your device for longer.

    Cookies we use

    Essential cookies

    These cookies are necessary for the basic functions of our website to work. They do not require your consent because the website cannot function properly without them. Essential cookies may be used for:

    • Keeping the website secure

    • Remembering your cookie preferences

    • Enabling pages to load correctly

    Statistical and analytics cookies

    We do not currently use any analytics or statistical cookies on this website. If this changes in the future, we will update this policy and ensure you have the ability to opt out.

    Advertising and tracking cookies

    We do not use any advertising or tracking cookies on this website.

    Third-party cookies

    Our website uses services provided by third parties, which may set their own cookies on your device:

    WebHealer

    Our website is built using Squarespace. Squarespace may collect certain technical data about visitors and may place cookies to enable the website to display and function properly.

    We do not control the cookies set by these third parties. You can find more information about their cookie practices in their respective privacy policies.

    Cookie consent

    We do not currently use a cookie consent tool on this website. This is because:

    • We only use essential cookies that are strictly necessary for the website to function

    • We do not use analytics cookies

    • We do not use advertising or tracking cookies

    Under the Privacy and Electronic Communications Regulations (PECR) as updated by the Data (Use and Access) Act 2025, consent is not required for strictly necessary cookies.

    How to manage or opt out of cookies

    You can control and delete cookies through your browser settings. Most browsers allow you to:

    • View the cookies stored on your device

    • Delete some or all cookies

    • Block cookies from specific websites

    • Block all cookies from being set

    • Allow cookies from specific websites only

    Please note that blocking essential cookies may affect how our website works for you.

    How to manage cookies in common browsers:

    • Chrome: Settings > Privacy and security > Cookies and other site data

    • Firefox: Settings > Privacy & Security > Cookies and Site Data

    • Safari: Preferences > Privacy > Cookies and website data

    • Edge: Settings > Cookies and site permissions > Cookies and site data

    For detailed instructions on managing cookies across different browsers, visit aboutcookies.org.

    Your rights

    Under UK data protection law, you have the right to:

    • Opt out of statistical cookies at any time without affecting your ability to use this website

    • Request information about what cookies we use and why

    • Manage your cookie preferences through your browser settings

    If we introduce analytics cookies in the future, we will provide you with a clear way to opt out while still being able to use the website fully.

    Updates to this policy

    We will update this cookie policy if our use of cookies changes. Any significant changes will be noted with a new "last updated" date at the top of this page. We encourage you to check this policy periodically.

    Contact us

    If you have any questions about our use of cookies, please contact:

    Sue Bird Counselling for Changes

    Email: counsellingforchanges [at] gmail.com

    Website:https://suebirdtherapy.com

    How to control or opt out of cookies

    This website does not use advertising or tracking cookies. Only essential cookies needed for the site to function are used. You can still control or clear cookies through your browser settings at any time.

    Browser controls: All major browsers let you block or delete cookies. See instructions for Chrome, Firefox, Safari, and Edge.

  • Data Retention Policy

    Counselling for Changes
    Sue Bird — Counsellor

    Last updated: 12 June 2026

    1. Why We Retain Your Data

    I keep records of our work together for several important reasons:

    • Legal obligations — UK law requires me to retain certain records, particularly financial information for tax purposes

    • Professional standards — As a BACP registered counsellor, I maintain records in accordance with professional ethical requirements and the common-law duty of confidence

    • Insurance requirements — My professional indemnity insurance requires me to keep records for a specified period in case a claim is made

    • Continuity of care — If you return to therapy after a break, your records help me provide consistent support

    • Your protection and mine — Records provide an accurate account of our therapeutic relationship should any questions arise

    I only keep information for as long as necessary. Once the retention period ends, I securely destroy all records.

    2. Retention Periods

    Type of RecordRetention PeriodReasonClient therapy records (adults)7 years after our last sessionIn line with the Limitation Act 1980 and standard professional indemnity insurance requirementsEnquiry and contact data (non-clients)12 months from your last contactTo respond to your enquiry and follow up if appropriateFinancial records and invoices6 years from the end of the financial yearHMRC legal requirementInsurance records7 yearsProfessional indemnity insurance requirementsWebsite contact form submissions12 monthsUnless your enquiry leads to a therapeutic relationship, in which case normal client retention appliesCorrespondence (emails, letters)7 years after our last sessionPart of your overall client record

    3. What We Retain

    The records I keep may include:

    • Contact details — your name, address, telephone number, and email address

    • Session notes — brief records of our sessions, including themes discussed and any agreed actions

    • Assessment and intake information — details you share at the beginning of therapy

    • Contract and consent forms — the agreement we make about working together

    • Correspondence — emails, letters, or messages between us

    • Payment records — invoices and records of payments received

    • Emergency contact information — details of someone to contact in an emergency, if you have provided this

    I do not keep audio or video recordings of our sessions.

    4. How Your Data Is Stored

    I take the security of your information seriously and use appropriate measures to protect it:

    Electronic records:

    • Stored on encrypted, password-protected devices

    • Access restricted to me alone

    • Regular security updates applied

    • Backed up securely

    Paper records:

    • Kept in a locked filing cabinet

    • Located in a secure room within my practice premises

    • Access restricted to me alone

    Who can access your records:

    • Me (Sue Bird) — I am the only person with full access to your therapy records

    • My clinical supervisor — receives anonymised case material only (no identifying details about you) to support the quality of my practice

    • My bookkeeper — has access to invoice data only (your name, dates of sessions, and amounts paid) for accounting purposes

    No one else has access to your personal information unless you give explicit consent or I am required by law to share it.

    5. Your Right to Erasure

    Under UK GDPR, you have the right to request that I delete your personal data. However, this right is not absolute. I may need to continue holding your records where:

    • Retention is required to comply with legal obligations (such as HMRC requirements for financial records)

    • Retention is necessary for professional standards and insurance purposes

    • The data is needed to establish, exercise, or defend legal claims

    If you ask me to delete your data and I am unable to do so, I will explain my reasons clearly in writing. Where partial erasure is possible (for example, deleting some information while retaining other records), I will discuss this with you.

    6. Secure Disposal

    When the retention period ends, I dispose of your records securely:

    • Paper records — shredded using a cross-cut shredder

    • Electronic records — permanently deleted using secure deletion software that overwrites the data to prevent recovery

    I maintain a record of when client files are destroyed, without retaining any personal details.

    7. Clinical Will Arrangements

    I am currently putting arrangements in place to ensure your records are handled appropriately in the event of my sudden incapacity or death. This is known as a clinical will. Once these arrangements are finalised, I will update this policy and inform clients of the details.

    8. Questions or Complaints

    If you have any questions about how long I keep your data or would like to discuss your records, please contact me:

    Email: counsellingforchanges [at] gmail.com

    If you are unhappy with how I have handled your personal data, you can raise a complaint with me directly. If we cannot resolve your concern, you have the right to complain to the Information Commissioner's Office (ICO):

    Website: ico.org.uk
    Telephone: 0303 123 1113

    You can also view my full suite of data protection documents at:
    https://counsellingforchanges.policydiary.co.uk

  • GDPR Statement

    Last updated: 12 June 2026

    Our Commitment to Your Privacy

    At Counselling for Changes, I believe that protecting your personal information is an essential part of the trust we build together. Confidentiality sits at the heart of effective therapy, and I take my responsibility to safeguard your privacy seriously. This statement explains, in plain language, how I collect, use, and protect your information.

    What Information I Collect

    To provide you with therapy and manage our work together, I collect and keep:

    • Your name and contact details (address, phone number, email)

    • Emergency contact information

    • Details about what brings you to therapy (your presenting issues)

    • Session notes recording our work together

    • Relevant medical or health history you share with me

    • Payment and invoicing information

    Why I Collect This Information

    I need to collect and use your information for two main reasons:

    To fulfil our therapeutic contract

    Under Article 6(1)(b) UK GDPR, processing your personal data is necessary for me to provide the therapy service we have agreed upon. Without this information, I cannot offer you appropriate support.

    To provide health-related care

    Some of the information you share with me — such as details about your mental health, emotions, or wellbeing — is classed as "special category" data under data protection law. I am permitted to process this under Article 9(2)(h) UK GDPR, which allows health professionals to process such data when providing health or social care treatment. The additional legal condition is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes).

    Professional Obligations and Supervision

    As a member of BACP, I am required to discuss my clinical work in professional supervision. This is an essential part of maintaining high standards of care and my own professional development.

    Your identity is protected in supervision. I do not share your name or any details that could identify you with my supervisor. My supervisor receives anonymised case material only and is bound by their own professional body's confidentiality obligations.

    Clinical Will Arrangements

    I am currently putting arrangements in place for a clinical will — a plan that ensures your records are handled appropriately and confidentially should I become unexpectedly unable to continue practising. Once these arrangements are finalised, I will inform clients of the relevant details.

    Who Else May See Your Information

    Beyond myself, the following people or services may have limited access to your information:

    • Clinical supervisor — receives anonymised case material only; your name and identifying details are never shared

    • External bookkeeper — has access to invoice data only (your name and payment amounts) for accounting purposes; they do not see session notes or clinical information

    • Website and technology providers — this website runs on Squarespace, and I use Zoom for online sessions. These providers may process limited technical or contact data as part of delivering their services

    • Statutory authorities — where I am legally required to share information (see below)

    When I Might Need to Break Confidentiality

    Confidentiality is not absolute. In rare circumstances, I may need to share information without your consent. This would only happen if:

    • There is a serious risk of harm to you or someone else

    • There are safeguarding concerns involving a child or vulnerable adult

    • I receive a court order requiring disclosure

    Wherever possible, I will discuss any disclosure with you first. I will only share the minimum information necessary.

    How Long I Keep Your Records

    I keep your records for 7 years after our last session. This retention period is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

    After this period, paper records are securely shredded and electronic records are permanently deleted using secure deletion software.

    Your Rights

    You have important rights over your personal information:

    • See your records — you can ask me for a copy of the information I hold about you

    • Correct errors — if anything is inaccurate, you can ask me to put it right

    • Request deletion — you can ask me to delete your records, although I may need to keep certain information for legal, professional, or insurance reasons, and I will explain this if it applies

    • Restrict processing — in some circumstances, you can ask me to limit how I use your data

    • Object to processing — you can object to certain types of processing

    • Data portability — you can ask for your data in a format that can be transferred to another provider

    If you would like to exercise any of these rights, please contact me and I will respond promptly.

    Making a Complaint

    If you are unhappy with how I have handled your information, I encourage you to raise this with me directly first. You can contact me at:

    Email: counsellingforchanges [at] gmail.com
    Compliance information: https://counsellingforchanges.policydiary.co.uk

    You also have the right under the Data (Use and Access) Act 2025 to complain to the Information Commissioner's Office (ICO):

    Website: ico.org.uk
    Telephone: 0303 123 1113