← Back to home

Privacy Notice

Carl Lingwood Counselling & Therapy

1. Introduction & overview

This Privacy Notice outlines how Carl Lingwood Counselling & Therapy collects, processes, stores and protects personal data obtained through this website and during the delivery of psychological therapy services. Respecting client privacy and maintaining strict confidentiality is central to ethical practice. Data is handled strictly in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Ethical Framework of the British Association for Counselling and Psychotherapy (BACP).

2. Information I collect

In order to provide ethical, safe and effective therapy, I process two categories of personal information:

A. Standard personal data

  • Identity & contact details: full name, date of birth, postal address, email address, telephone number.
  • Emergency contact details: name, relationship, and telephone number of your nominated emergency contact (e.g. next of kin, partner, or trusted friend).
  • GP & healthcare provider details: name, clinic address and contact number of your registered General Practitioner.
  • Administrative data: billing/payment records, appointment scheduling history, and correspondence (emails, SMS, contact form submissions).

B. Special category (sensitive) personal data

Under Article 9 of the UK GDPR, data concerning health is classified as “Special Category Data”. I collect:

  • Intake assessments, psychological history, physical/mental health conditions and current medications.
  • Anonymised or pseudonymised clinical session notes outlining themes discussed during therapy.
  • Psychometrics or self-report assessment scales (e.g. PHQ-9, GAD-7) completed as part of therapy tracking.

3. Lawful basis for processing

Under UK GDPR, I am required to establish a lawful basis for processing your information.

4. How your data is stored & secured

I employ robust technical and organisational security measures to protect your personal information:

  • Electronic records: stored on encrypted, password-protected hardware using two-factor authentication (2FA). Practice management software and online storage use ISO 27001-certified, UK/EU-compliant servers.
  • Paper records & written notes: brief paper-based clinical notes or intake forms are stored in a locked filing cabinet within a secured facility.
  • Communications: email communications are transmitted via secure, TLS-encrypted protocols. Client phone numbers are stored on a dedicated, passcode-protected practice telephone.

5. Confidentiality & third-party sharing

Confidentiality is a cornerstone of therapy. Your personal details and session content will never be sold, rented or shared with third parties for marketing purposes. Information is only shared under the following limited, controlled circumstances:

  • Clinical supervision: as required by professional governing bodies (BACP), I regularly review my clinical practice with a qualified clinical supervisor. Client identities are strictly anonymised during supervision.
  • Risk of serious harm (safeguarding): if there is a clear and immediate risk of serious harm to yourself or another person, or if a child or vulnerable adult is at risk, I may have an ethical and legal obligation to notify emergency services, your GP, or safeguarding teams. Where appropriate and safe, I will discuss this with you first.
  • Legal obligation: if compelled by a UK court order, or under specific statutory duties (e.g. disclosures regarding terrorism, money laundering, or drug trafficking under UK law).
  • Data processors: necessary operational third parties (e.g. secure practice management platforms, accounting software, website web hosts) who act solely under contract and in strict compliance with UK GDPR.

6. Data retention period

I retain personal data and clinical session records only for as long as necessary to fulfil professional, legal and insurance obligations. Financial and tax-related records (invoices, receipts) are retained for 6 full tax years in accordance with HMRC guidelines.

7. Your data protection rights

Under UK GDPR, you hold specific rights regarding the personal data I retain about you:

  • Right of access (subject access request): you have the right to request a copy of the personal information and clinical notes held about you. Requests are fulfilled within 30 days free of charge.
  • Right to rectification: you may ask to correct inaccurate or incomplete personal details.
  • Right to erasure (‘right to be forgotten’): you can request that personal data be deleted. Note that this right is not absolute; clinical note retention required by professional insurance/statutory rules takes precedence over erasure requests.
  • Right to restrict processing: you may request that the processing of your data be restricted under certain conditions.

8. Website cookies & digital tracking

My website (counselling-cornwall.co.uk) is built and hosted using Lovable, which acts as the content management system (CMS) for the site. You can find out more about how Lovable handles data protection via their own privacy policy at lovable.dev/privacy.

I do not currently use any analytics or visitor-tracking service (such as Google Analytics) on my website. If this changes in the future, this Privacy Notice will be updated accordingly and the new service will be named here.

My website does not use cookies.

No user-specific data is collected by me or any third party. If you fill in a form on my website, that data will be temporarily stored on the web host before being sent to me.

9. How to contact me or make a complaint

If you have any questions regarding this Privacy Notice or wish to exercise your data protection rights, please contact me directly:

If you have any complaint about how I handle your personal data, please do not hesitate to get in touch with me by writing or emailing using the details above. I would welcome any suggestions for improving my data protection procedures.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

10. BACP membership

I am a registered member of the British Association for Counselling and Psychotherapy (BACP), and work in accordance with their ethical framework. As a BACP Registered Counsellor, I meet their high standards for professional training, safe practice and ongoing ethical commitment. Find out more about BACP registration here.