Westwood Counselling and Psychotherapy 

Privacy and data protection

​

This privacy notice explains how I collect, use, store and protect personal information in my therapy practice.

I am Louise Campbell, trading as Westwood Counselling and Psychotherapy, a psychotherapist who works in person and online. I am the data controller for personal information I collect through Westwood Counselling and Psychotherapy, meaning I am responsible for deciding how personal information is used and for keeping it safe.

If you have any questions about this privacy notice, or about how your information is handled, you can contact me here.

​

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

 

INFORMATION I COLLECT​

I may collect and use the following information.

When you contact me, I may collect:

• your name

• your email address

• your phone number

• the information you share in your enquiry

• any preferences around contact, availability

If we arrange an initial call or begin therapy, I may also collect:

• your address

• your date of birth

• your GP details

• emergency contact details, where appropriate

• relevant health, mental health or wellbeing information

• information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy

• brief clinical notes

• attendance, payment and appointment information

• correspondence between us

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.

I only collect information that is necessary for providing therapy safely, ethically and professionally.

​

HOW I USE YOUR INFORMATION

I use your personal information to:

• respond to enquiries

• arrange initial calls and appointments

• provide therapy

• keep appropriate clinical records

• manage payments, invoices and appointments

• communicate with you about sessions

• meet legal, professional and ethical responsibilities

• manage risk, safeguarding or emergency situations where necessary

• maintain insurance, tax and accounting records

• respond to data protection requests or complaints​​

​

WHY I HOLD YOUR INFORMATION​

Under UK law (UK General Data Protection Regulation, UK GDPR) I must have a lawful basis for holding and using personal information.  For different parts of my work, I may rely on different lawful bases under Article 6 of UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

• contract: where information is needed to arrange and provide therapy

• legitimate interests: where I need to use information to run my practice safely, respond to enquiries, keep appropriate records and protect both you and me

• legal obligation: where I need to keep or share information to comply with the law

Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.

If I ask for your consent for something specific, we will discuss, and I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

 

 

CONFIDENTIALITY​

Therapy is confidential, but with some limits.  If I need to share information, I will endeavour to discuss with you first, if I can.  I may need to share information if:

• I believe there is a serious risk of harm to you or someone else

• If there is a safeguarding concern involving a child, vulnerable adult or person at risk

• I am required to do so by law, court order or legal process

• Like all therapists, I will sometimes discuss our work in supervision.  My supervisor is bound by the same ethical and legal codes as myself, and your identity will be protected as far as possible

• I hold brief and factual clinical notes, stored in a metal filing cabinet. I do not keep a full transcript, or record sessions.

• I will only share your data where it is necessary legally or ethically, and will limit what I share wherever possible 

​

HOW LONG I KEEP INFORMATION​

I keep information only for as long as necessary for the purpose for which it was collected. 

• Enquiry information will be deleted after 6 months if we do not begin therapy.

• client records may be kept for 6 years after therapy therapy ends

• financial records may be kept for the period required for tax and accounting purposes

• emails, messages and administrative records are reviewed periodically and deleted when no longer needed

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.

​​

WHERE YOUR INFORMATION IS STORED​​

I keep electronic storage to a minimum, using only initials wherever possible, and access is password protected  Paper notes and forms are stored in a locked cabinet, to which only I have access. Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.

​

I use the following systems in my practice, and information may be stored here, depending on how you initially contact me:

• Wix (website), Gmail (email), Zoom (if online sessions are used), Nationwide, Sumup (payments), iCloud, WhatsApp business, ClinicalWill.app (my clinical will)

​

I have appointed a clinical executor (another psychotherapist) who may contact you if I die, or am unable to contact you myself.  My will is stored at ClinicalWill.app, and will only be available to them when they are notified of my incapacity. 

​

I do not use AI in my practice. 

​

​WEBSITE VISITORS AND COOKIES​

When you visit Westwood Counselling and Psychotherapy, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools.

My website is hosted by Wix. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security.

You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.​

​

YOUR RIGHTS​

Under UK data protection law, you have rights over your personal information. These may include the right to:

• be informed about how your data is used

• access a copy of your personal information

• ask for inaccurate information to be corrected

• ask for information to be deleted in some circumstances

• restrict or object to certain processing

• complain about how your information has been handled

​

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.

If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

​

DATA PROTECTION QUERIES AND COMPLAINTS

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay. 

Please include:

• your name

• what your concern is about

• what you would like me to look into

• how you would prefer me to respond

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.

If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office 

​

​

CHANGES TO THIS NOTICE

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.

The latest version will be available on my website.

​

Last updated: July 2026