Confidentiality and Privacy Notice

Introduction

I am the data controller for the personal information you share with me. 'Data controller' describes the person or organisation that collects and stores personal data and is responsible for handling it safely. I am registered as a data controller with the Information Commissioner's Office, registration number ZC246387.

I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This notice explains what I will do with your personal information, from your first contact with me through to after your therapy has ended. I am happy to talk through any questions you have. You can contact me at vera@udaya.care.

Confidentiality

Your therapy and your personal information are confidential. I will not disclose information to anyone else except in the following circumstances:

1. I have reasons to believe you or someone else are at risk of harm

2. I need to share information to safeguard a child or young person

3. I am obliged to do so by law

In the first two circumstances, I will always try to discuss it with you first and proceed with your consent, unless there are safeguarding reasons that prevent this.
Where possible, I will tell you what I have a duty to share, who with, and what to expect.

My professional body, the BACP, requires me to have regular supervision, in which ongoing work is discussed anonymously to ensure I am practising safely and can support you as well as possible. My supervisor will not be able to identify you, and is bound by the same confidentiality as I am.

In the event that I am suddenly and unexpectedly unable to practise, my supervisor will have access to your contact details so that they can let you know.

Privacy Notice

Your privacy matters to me. Your personal information will be kept secure and used only for the purpose you gave it to me.

This notice covers why and on what basis I process your information, whether you have to provide it, how long I keep it, who else may receive it, whether it leaves the UK, whether I use automated decision-making, and what rights you have.

Lawful basis

I must have a lawful basis for processing your personal data. Which basis applies depends on the stage we are at.

If you are in contact with me about starting therapy, or currently having therapy, I process your personal data because it is necessary for the performance of our contract.

If your therapy has ended, I use legitimate interest as my basis for holding your information until the retention period is over.

Sensitive information about your health is called 'special category personal information'. My lawful basis for processing it is that it is necessary for the provision of health treatment — in this case counselling — under a contract with a health professional.

Automated decision-making and profiling

I do not use automated decision-making or profiling. No decision affecting you is made by automated means.

Transfers outside the UK

Squarespace, which hosts this website and processes messages sent through my enquiry form, is a United States company and may store this information outside the UK.
Transfers are made under the safeguards permitted by UK data protection law. All clinical records are held by me in the UK and are not transferred abroad.

How long I keep your information

Initial contact: When you enquire about counselling, I collect only what I need to reply: your name, your email address, and whatever you choose to tell me.
If we arrange an introductory call, I will also take a phone number. If we do not go on to work together, I delete your enquiry and any correspondence within three months.
If you would like me to delete it sooner, just ask.

At intake: If we decide to work together, before our first session I will collect fuller details: your address, date of birth, GP details and an emergency contact.
Alternatively, your GP or another health professional may send me your details when making a referral.

While you are having counselling: I keep brief written notes of each session. For security, I do not keep text messages for longer than one week; if a message contains something relevant to our work, I transfer it to your notes and delete the original. Email correspondence is deleted after three months unless it needs to form part of your record.

After counselling has ended: In line with BACP guidance, I keep client records for five years after our last session, after which they are securely destroyed. If you would like me to delete your information sooner, please tell me.

How I store your information

Your records are held in a password-protected folder on my personal laptop, which is encrypted. Correspondence is kept in my Udaya email account.

Visitors to this website

This site is built on Squarespace, which collects standard internet log information and details of visitor behaviour, including IP address, device type and approximate location, so that I can see how many people visit and which pages they read. I use this only to understand traffic to the site in general. I do not attempt to identify individual visitors, and I do not combine this information with anything else. My lawful basis for this is legitimate interest.

Like most websites, this one uses cookies. Necessary cookies keep the site working. Analytics cookies are placed only if you consent to them, and you can decline without affecting your use of the site.

Online enquiries

When you use the enquiry form or email me, I receive your name, your email address, and whatever you choose to write. Please share only as much as you need to at this stage; there is no need to describe your circumstances in detail in order to arrange a first conversation. Anything personal is better discussed when we speak.

Messages sent through the form are processed by Squarespace before reaching me, as described above.

I use this information solely to reply to you and, if we go on to work together, to arrange sessions. I do not add you to any mailing list, and I do not share your details with anyone.

Your rights

You have the right to ask me to delete your personal information, to limit how I use it, or to stop processing it.
You can ask for a copy of anything I hold about you, and object to my use of it in some circumstances. You can read more at ico.org.uk/your-data-matters.

If I hold information about you, I will:

- give you a description of it and where it came from

- tell you why I am holding it, how long I will keep it, and how I reached that decision

- tell you who it could be disclosed to

- give you a copy in an intelligible form

You can also ask me at any time to correct any mistakes. Please put any request in writing to vera@udaya.care.

Complaints

If you have a concern about how I handle your personal information, please contact me first at vera@udaya.care. I would welcome any suggestions for improving how I do this.

If you want to make a formal complaint, you can contact the Information Commissioner's Office, the statutory body overseeing data protection law in the UK.
See ico.org.uk/make-a-complaint. My ICO registration number is ZC246387.

Last updated: 14/09/2026