Corri Johnson MBACP
Data Controller
ICO Registration Number: ZA152290
In accordance with the General Data Protection Regulations (GDPR), I hereby inform you of how I handle your data. If you have any questions about this notice please contact me at: corri.johnson@pandmcounselling.com
Summary
I handle your information for the purposes of:
Responding to service enquiries
Receiving and making referrals
Brief notes for session recordkeeping, both handwritten and digital
Communication with clients or with relevant professionals, for example texts and emails
Billing and invoicing
Clinical supervision and oversight
Counselling sessions
Once counselling has ended, your records will be kept for seven years from the time of your last contact with me and then securely destroyed.
All information provided is safeguarded and you have the right to access, correct, or request the deletion of the information held.
The legal justifications for processing your information rely upon the principles of consent and legitimate interest.
Information that may be collected, stored, and used includes but is not limited to:
Personal details given at the time of registration, details given during your initial assessment, payment information, appointment records, copies of communications via all methods we may use, medical and psychiatric conditions, prescribed medication, therapy history, emotional & psychological issues, relationships, occupation, employment, education, religious and/or beliefs, and criminal offences and alleged offences. I may record personal information received from your healthcare providers such as your GP.
Why I collect this information:
This information is collected to ensure that I can provide you with an appropriate service or referral and to support any ongoing therapy sessions.
Confidentiality
Sessions and their content are strictly confidential subject to the following exceptions:
· disclosure that you are at risk of harming yourself or others, particularly children
· a legal requirement to break confidentiality, such as court injunction or subpoena
· in the service of our work in discussion with my clinical supervisor, who holds the same principles of confidentiality to ensure safety, quality of care, and ethical responsibility in keeping clinical records.
Sharing personal information
In some circumstances it may be necessary for me to share information:
· in making a referral to another professional
· in breaking confidentiality as subject to the exceptions stated above
· in working with a third party for specific tasks in order to deliver my counselling service (such as my supervisor, executor of my clinical will, HMRC)
Where possible I will seek to obtain your written consent before sharing information with other professionals.
Where necessary I may transfer personal information outside of the UK. When doing so I comply with the UK GDPR making sure appropriate safeguards are in place.
In the unlikely event that something happens to me and I can neither conduct our session nor contact you to inform you, I have nominated a clinical executor who will contact my clients on my behalf. This executor is a counselling professional and will also comply with GDPR and BACP legal and ethical standards. This person will gain access only to your personal contact details and only if access becomes necessary.
Storing personal information
Your contact information may be stored in an encrypted file on a computer-based storage system and accessed on a mobile phone or a laptop. I do not use cloud-based storage. All of the devices that I may use have access to your information and are protected by encryption and local passcodes. I am the only person who can access the files, with the exception of my clinical executor in the event that my clinical will is executed.
Any information that is more detailed, such as GP referral letters or any other documents that contain confidential information (the GDPR calls this ‘special category data’), will be saved on a securely encrypted, computer-based storage system. Special category data will be transferred via an encrypted email service.
Hard copy documents will be kept under lock and key in a locked building.
Website
My website does not use cookies or web analytics. No user-specific data is collected by me or any third party.
If you complete the form on my website, that data will be temporarily stored on the web host before being sent to me. By completing this form, you consent to this temporary usage of your personal contact data. This data will be not be used for any other purpose but to return your contact. I do not make marketing calls or send marketing emails.
I use legitimate interest as my lawful basis for holding and using your personal information in this way when you visit my website.
Your rights
Under data protection law, you have rights including:
· to be informed of what information I hold (as set out in this privacy notice)
· to see the information I hold about you
· to rectify any inaccurate or incomplete personal information
· to withdraw consent to me holding your personal data
· to request your personal information to be permanently erased
· to have access to data portability
· to decide on any automated decision making or profiling that uses your data
· to object
If you would like to make an information access request, enact any of your rights as listed above, or make a complaint please contact at corri.johnson@pandmcounselling.com. If you make a request or complaint, I will respond within 30 days. If you wish to make a complaint, you may do so in person or in writing. I can provide you with a complaint form upon request. Your complaint will be addressed without undue delay and you will be updated at every step of the process. Please note that significant changes due to exercising your rights may affect our ability to continue working together.
If you wish to object to the way that I use your personal information and are not satisfied with my response, you have the right to complain to the Information Commissioners Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Lawful basis
These rights do not mean that in every case they can be observed and there may be occasions where they may be overridden by a legitimate need to process your information.
Accordingly, the legislation requires me to inform you of the ‘lawful basis for processing’ your data. These are legal terms that have specific definitions that can be found on the Information Commissioners Office website http://www.ico.org.uk.
The following represents the lawful bases for using your information in our work together:
Consent
Legitimate interest
In addition the following categories apply to my processing your ‘special category data’:
Explicit consent
If you have any questions at all about how the GDPR works in practice during your relationship with me then please do not hesitate to ask.
This Privacy Notice is reviewed regularly. Last updated 7 July 2026.