Privacy policy

Rosanne Please

BSc Humanistic Counselling, MBACP

Beaconsfield

Buckinghamshire

GENERAL DATA PROTECTION REGULATIONS ('GDPR')

PRIVACY NOTICE.

This Privacy Notice sets out what personal data I keep and why, how I receive such data, how I keep it and for how long I keep it, and with whom I share it. These activities all take place in the context of my role as a psychotherapist & counsellor in private practice. As a professional I am registered with the Information Commissioner’s Office (‘ICO’).

Personal Data that I hold and why I hold this.

I hold your name, address and contact details, such as telephone number and email address, and GP contact details. Please advise me of any change in these details so that I can keep my records up to date and accurate. I take brief notes of our sessions, which cover date of session and a short description of the session. These are stored securely on Kiku, a secure online practice management platform, as described below.

I use your contact details contractually to fulfil my obligations to you by making contact with you about my services and to respond to your contact with me, for example to make arrangements about our session appointments or to conduct our session online where we have agreed this means of working.

I hold session notes in the legitimate interest of assisting me, as an aide to memory, in providing the services related to my roles as set out above.

I keep details of the dates and times of our sessions together on my electronic diary, which is held on my computer and phone. I use your client number to record this data. I use this data to keep accurate records for the times we have agreed to meet, to assist me in providing the information for drawing up my annual accounts and in meeting my obligations to the professional organisations to which I belong.

If you choose to pay for your sessions by electronic means, for example BACS, then I will have records of your name on my bank statements.

How I receive Personal Data.

I receive the personal data set out above directly from you or as a result of our sessions together. If I receive any other information from a third party then I will inform you of such at our next session appointment or as soon as I can within a month of receiving such communication.

How I keep your Personal Data secure

I keep your name, address & contact details, and my session notes, on Kiku (www.wearekiku.com), a secure online practice management platform designed for therapists. I access Kiku from my computer and phone. I hold your phone number on my phone under your client number. This device is password protected and only used by me.

Kiku is GDPR compliant. Your data is encrypted both when it is processed and when it is stored, and my Kiku account is protected by a password and two-factor authentication. Kiku's servers are hosted by Amazon Web Services (AWS) in Ireland, which holds recognised security certifications including ISO 27001. As Ireland is within the European Economic Area, your data is protected by data protection laws equivalent to those in the UK.

Kiku acts as a data processor on my behalf. This means it holds your data only so that I can use its service, and it does not use your data for its own purposes.

Use of Mobile Devices and Microphone Access

I take additional steps to protect your confidentiality when using electronic devices. I do not knowingly use any applications that passively monitor or record audio in the background, and I take reasonable steps to ensure that my devices do not capture or store session content outside of our agreed therapeutic work. I do not grant applications permission to access my device’s microphone unless this is strictly necessary for agreed online sessions.

During in-person sessions, my mobile phone is turned off or placed in a state where it cannot actively listen or record. These measures are in place to minimise any risk of unintended data capture by third-party applications or services.

How long I keep your Personal Data

Generally I keep your personal data in electronic format for 7 years from the end of our work together, after which time they are deleted from Kiku and from my devices. This is subject to the following:

Any record of your name or initials in my accounting records is kept for a period of 6 years. I am required by law to keep such records.

With whom I share information

Our confidentiality agreement and my arrangements for my work to be regularly supervised are set out in the administrative contract we sign at the beginning of our work together. They are included here as part of this notice:

Confidentiality

In accordance with good practice, I have a professional executor who would contact you in the event of my death or being unable to work and unable to contact you myself. To make this possible, I have set up Kiku’s Emergency Clinical Executor access, which allows my professional executor to access my Kiku account only in the event of my death or incapacity. This would allow them to view the client name and phone number I hold on Kiku, so that they can contact you and make sure your records are managed confidentially and deleted in line with this notice.

The content and records of our sessions will be kept confidential except in the following circumstances;

Where you agree in writing to the release of information. I will keep a record of your written consents separately from my notes of our sessions.
Where I am required to make disclosure of information in accordance with the Law.
Where a matter is of such importance that I fear you may harm yourself or others (including criminal activity). In such matters, I will use reasonable endeavours to obtain your consent to action that I think appropriate for you or I to take. If I am unable to obtain your consent then I will inform you of the action I intend to take.

Supervision

My work with all clients is regularly supervised. I have supervision in groups, with peers and in individual settings. Your identity will be withheld in such supervision sessions and confidentiality will be maintained as set out above.

Your rights under GDPR

You are entitled to view, amend, restrict or delete your personal data held by me.

Changes to this Privacy Notice

I review this policy from time to time to ensure it continues to reflect what personal data I hold and how I use it under the headings set out above. I will advise you of any changes I make to this notice.

Please note that this Privacy Notice is governed by the laws of the Untied Kingdom and subject to the jurisdiction of that country.

Date: 7 October 2026