Privacy Policy

Your Privacy Matters

At Counselling with Rupal, I understand that your privacy is important. Whether you're making an enquiry or attending counselling, you can feel confident that your personal information will be treated with care, respect, and confidentiality.

This Privacy Policy explains what information I collect, why I collect it, how it is stored, and your rights under UK data protection law.

If you have any questions about this policy, please don't hesitate to get in touch.

1. Who is Responsible for Your Information

I am Rupal Rickman, founder of Counselling with Rupal, and I am the Data Controller for the personal information you provide.
I am registered with the Information Commissioner's Office (ICO). My registration number is ZB337955.
If you have any questions about how I handle your personal data, you can contact me at:
counsellingwithrupal@gmail.com

2. Why I Collect Your Information

I only collect the information necessary to provide a safe, professional, and ethical counselling service.

Depending on your relationship with me, your information may be used to:

• Respond to your enquiry. 

• Arrange appointments. 

• Provide counselling sessions. 

• Maintain confidential client records. 

• Meet my legal, ethical, and professional responsibilities. 

• Improve the functionality and performance of my website. 

Your information will never be sold or shared for marketing purposes.

3. If You Contact Me

If you contact me by email, telephone, or through my website contact form, I will only use the information you provide to respond to your enquiry.

If you decide not to proceed with counselling, your details will normally be securely deleted after a reasonable period unless I am legally required to retain them.

4. If You Become a Client

If we begin working together, I will collect some additional information so I can provide counselling safely and professionally.

This may include:

• Your name and contact details 

• GP details (where appropriate) 

• An emergency contact 

• Information gathered during your initial assessment 

• Brief factual counselling notes following each session 

Further information about how client records are managed can be found in my Counselling Agreement.

5. Why I Process Your Data (Lawful Basis)

Under UK GDPR, I must have a lawful basis to process your personal data. Because therapy involves special category data (health information), I need to meet conditions under both Article 6 and Article 9 of UK GDPR.

Article 6 basis — ordinary personal data
My lawful basis is Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.

When you engage me as your therapist, we enter into a contract. I need to process your personal data to fulfil my obligations under that contract, including scheduling appointments, maintaining appropriate records, and providing you with therapy.

Article 9 basis — special category data (health information)
My lawful basis for processing your health-related information is Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care purposes). This condition applies because I am a qualified counsellor subject to the professional obligation of confidentiality under the ethical framework of BACP.

6. Confidentiality Exceptions

Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent:

• Risk of serious harm — if I believe there is a serious risk of harm to you or to another person. 

• Safeguarding concerns — if I become aware of concerns about the safety of a child or vulnerable adult. 

• Legal requirement — if I am ordered to disclose information by a court of law. 

• Prevention of terrorism — if required under the Terrorism Act 2000. 

In most circumstances, I will try to discuss this with you first and explain why I need to share information. The only exception would be if doing so would itself put someone at risk.

If I do need to break confidentiality, I will share only the minimum information necessary and only with the appropriate authorities.

7. Who I Share Your Data With

I take your confidentiality seriously and share your personal data only when necessary and appropriate.

Clinical Supervisor
As explained above, I discuss my work in supervision using anonymised or pseudonymised case material only. Your name and identifying details are not shared with my supervisor.

External Accountant
When I appoint an external accountant to help manage my accounts. They will have access to invoice data only (your name, dates of sessions, and amounts paid). They do not have access to any clinical information, session notes, or details about why you are attending therapy. My bookkeeper is bound by confidentiality obligations.

Third-Party Service Providers
I use the following third-party services which may process some of your data:

• Google Slides — the platform my website is built on 

• Zoom — for online therapy sessions (if we meet online) 

• Google Meet — for online therapy sessions (if we meet online) 

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.
I never sell your personal data.

8. International Transfers

Some of the providers I use (for example Google and Zoom) may process data outside the UK. Where this happens, I rely on the appropriate safeguards required by UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

9. How Long I Keep Your Data

I only keep your personal information for as long as is necessary to fulfil the purposes for which it was collected, or to meet my legal, professional, and regulatory obligations.

• Therapy records (including clinical notes, assessments, and correspondence) are retained for 7 years following your final counselling session. This is in line with the Limitation Act 1980 and professional indemnity insurance requirements. 

• Financial records (including invoices and payment records) are retained for 6 years to comply with HMRC legal requirements. 

• Website enquiries (where you contact me but do not become a client) are retained for up to 12 months to allow me to respond to your enquiry and maintain appropriate records. They are then securely deleted. 

Once the relevant retention period has expired, your records will be securely destroyed. Paper records will be confidentially shredded, and electronic records will be permanently deleted.

10. Keeping Your Information Safe

I take appropriate measures to protect your personal information.
Paper records are stored securely in locked storage, and electronic records are password protected and encrypted.
Your information is retained only for as long as is professionally and legally necessary before being securely destroyed.

11. Website Security

My website uses SSL (Secure Socket Layer) encryption, helping to ensure that any information you submit through the website is transmitted securely.
You can recognise this by the padlock symbol displayed in your web browser.

12. Cookies & Website Analytics

Like most websites, this website uses cookies to improve your browsing experience.

Essential Cookies
These cookies help the website function correctly and cannot be switched off. 

Analytics Cookies
I use Google Analytics to understand how visitors use my website. This anonymous information helps me improve the website and make it easier to use.
Google Analytics may collect information such as:

• Pages viewed 

• Time spent on the website 

• Device type 

• General location 

• Anonymous IP information 

This information does not personally identify you.                                                                                                                                                                                                 You can find out more about how Google uses information by visiting Google's Privacy Policy.

13. Your Rights Under UK GDPR

You have the following rights regarding your personal data. I will respond to any request within one month.

• Right to be informed You have the right to know how your data is being used. This privacy policy provides that information.

• Right of access You can request a copy of the personal data I hold about you. This is known as a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data.

• Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

• Right to erasure In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I am required to retain records in line with the Limitation Act 1980 and professional indemnity insurance requirements, or where retention is necessary for legal claims.

• Right to restrict processing You can ask me to limit how I use your data in certain circumstances.

• Right to data portability You can ask me to provide your data in a format that allows you to transfer it to another service provider.

• Right to object You can object to certain types of processing, such as processing for direct marketing (which I do not carry out).

• Rights related to automated decision-making You have the right not to be subject to decisions based solely on automated processing. I do not use automated decision-making in my practice.

To exercise any of these rights, please contact me at: counsellingwithrupal@gmail.com
(I will respond within one month.)

14. Children & Young People

When working with children and young people, confidentiality is respected. Information will only be shared with parents or carers where appropriate, in line with the therapeutic agreement, safeguarding responsibilities, or legal requirements.

15. Clinical Will

What Happens to Your Records if I Am Unable to Practice.

I am in the process of appointing a Clinical Executor, who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly.

If such a situation occurs, my Clinical Executor will:

• Contact you to let you know I am no longer able to see you. 

• Offer to provide you with referral information to help you find another therapist if you wish. 

• Handle your records with the same level of confidentiality I would. 

• Securely destroy your records in accordance with this privacy policy, or retain them for the appropriate period if required. 

My Clinical Executor is bound by professional confidentiality and will only access the minimum information necessary to contact you and manage records appropriately. They will not read your therapy notes unless strictly necessary for record management purposes.

16. Links to Other Websites

My website may contain links to other organisations, including the BACP, Counselling Directory, Google, and the Information Commissioner's Office. Please note that once you leave my website, I am not responsible for the privacy policies or content of external websites.

17. Data Protection Complaints

You have the right to make a data protection complaint directly to me. If you are concerned about how I have handled your personal data, please let me know so I can address your concerns.

To submit a complaint:

• Contact me at: counsellingwithrupal@gmail.com 

I will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk 

• Telephone: 0303 123 1113 

• Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF 

18. Changes to This Policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how I handle your personal data, I will inform you directly.

The date at the bottom of this policy shows when it was last updated.

Counsellingwithrupal@gmail.com
ICO registration: ZB337955

19. Related Information

If you are considering counselling or become a client, I recommend reading my Counselling Agreement, which explains how we will work together and how your personal information is managed throughout our therapeutic relationship.

20. Contact

If you have any questions about this Privacy Policy or how your information is stored or used, please feel free to get in touch.

Rupal Rickman
Counselling with Rupal

📧 counsellingwithrupal@gmail.com
📞 0754 6224937

Last updated: July 2026