Privacy Policy

Last updated: 21 July 2026

Who I Am

I am Susan Chambers, a qualified counsellor and psychotherapist practising as Chambers Counselling. I am registered with the Information Commissioner's Office (ICO) under registration number ZB547053.

If you have any questions about how I handle your personal data, please contact me at sue@chamberscounselling.com

What Personal Data I Collect

I collect the following categories of personal data:

  • Name and contact details — your phone number and email address

  • Date of birth

  • Postal address

  • GP name and contact details

  • Emergency contact details

  • Health and therapy-related information — including your presenting issues and relevant medical history

  • Session notes — records of our therapeutic work together

  • Payment and invoicing information — details necessary for billing and financial records

  • Enquiry details — information you submit via the contact form on my website

Health and therapy-related information, including session notes and presenting issues, is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data receives enhanced protection because of its sensitive nature.

How I Collect Your Data

I collect personal data directly from you:

  • When you first contact me to enquire about therapy

  • During our initial consultation and intake process

  • Throughout our sessions together

  • Via email, telephone, or video call communications

  • When you submit the contact form on my website

Why I Process Your Data — Lawful Basis

I process your personal data under two lawful bases:

Article 6 basis (ordinary personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. This means I need to process your personal data to provide you with the therapy services you have engaged me to deliver.

Article 9 basis (special category data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care). Processing is carried out by a qualified counsellor/psychotherapist subject to the professional obligation of confidentiality under the BACP Ethical Framework for the Counselling Professions.

Professional Obligations and Continuing Professional Development

I am required by BACP to attend regular clinical supervision. This is an essential part of maintaining high standards of practice and ensuring the quality of the therapy I provide.

When I discuss my therapeutic work with my clinical supervisor:

  • Your name and any identifying details are not shared with my supervisor

  • I use anonymised or pseudonymised case material only

  • My clinical supervisor is a qualified professional bound by the same confidentiality obligations as I am

  • My supervisor is bound by their own professional code of ethics and practice

Clinical Supervision Services

In addition to providing therapy to my own clients, I also provide clinical supervision to other therapists (supervisees).

For supervisees, I collect:

  • Name and contact details (address, email address, telephone number)

Supervision session notes are kept as both paper records in a locked, secure location and password-protected electronic records.

Any material about a supervisee's own clients that is discussed during supervision is anonymised — the supervisee's clients are not identified in my supervision records.

Where I deliver supervision online, I use Zoom, Microsoft Teams, or Google Meet.

The lawful basis for processing supervisee data is Article 6(1)(b) UK GDPR — processing is necessary for the performance of the supervision contract between me and the supervisee. Supervisee contact data is ordinary personal data, not special category health data.

Supervisee records are retained in line with the retention periods described in the "How Long I Keep Your Data" section below.

Clinical Will — What Happens to Your Records If I Am Unable to Practise

I am currently putting clinical will arrangements in place to ensure your records are handled appropriately in the event that I become unable to practise due to serious illness, incapacity, or death.

Once these arrangements are finalised, I will inform you of the details. The clinical executor I appoint will be a qualified therapist or appropriately trained professional, bound by the same duty of confidentiality that I observe, and will handle your records securely and in accordance with this privacy policy.

Who I Share Your Data With

I use the following third-party services which may process your data:

  • Squarespace — website hosting

  • Zoom — video sessions

  • Microsoft Teams — video sessions

  • Google Meet — video sessions

  • Google Calendar — appointment scheduling

Each of these services is bound by a data processing agreement and publishes its own privacy policy with further detail.

In addition, the following parties may have limited access to specific elements of your data:

  • Clinical supervisor — anonymised case material only, as described above

  • External accountant or bookkeeper — invoice data only, for the purpose of managing my accounts and meeting tax obligations

I never sell your personal data.

International Data Transfers

The following third-party services I use may transfer personal data outside the United Kingdom:

  • Squarespace (Squarespace Inc, USA)

  • Zoom (Zoom Video Communications Inc, USA)

  • Microsoft Teams (Microsoft Corporation, USA)

  • Google Meet (Google LLC, USA)

  • Google Calendar (Google LLC, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025. The USA does not currently have a UK adequacy decision. Details of these safeguards are set out in each provider's own privacy documentation.

How Long I Keep Your Data

I retain your personal data for the following periods:

  • Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements

  • Therapy records (clients under 18 at time of therapy): until the client reaches the age of 25

  • Supervisee records: 7 years after the supervision relationship ends, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements

  • Financial records: 6 years, as required by HMRC

  • Website enquiries (non-clients): 12 months

After the applicable retention period ends, paper records are securely destroyed and electronic records are permanently deleted.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right to be informed — to know how I collect and use your data (this privacy policy fulfils that right)

  • Right of access — to request a copy of the personal data I hold about you

  • Right to rectification — to ask me to correct any inaccurate or incomplete data

  • Right to erasure — to ask me to delete your data in certain circumstances. However, this right is not absolute; I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance, or law

  • Right to restrict processing — to ask me to limit how I use your data in certain circumstances

  • Right to data portability — to receive your data in a commonly used format and, where technically feasible, have it transferred to another provider

  • Right to object — to object to certain types of processing

  • Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice

To exercise any of these rights, please contact me at sue@chamberscounselling.com.

If you make a subject access request, I will conduct a reasonable and proportionate search in accordance with the Data (Use and Access) Act 2025 and respond within one month.

Data Protection Complaints — Your Right Under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. You can submit a complaint at Make a Complaint or contact me at sue@chamberscounselling.com.

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Telephone: 0303 123 1113

  • Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality Exceptions

Everything you share with me in therapy is treated as confidential. However, there are specific circumstances in which I may need to break confidentiality:

  • Risk of serious harm — if I believe there is a serious risk of harm to you or to another person

  • Safeguarding concerns — if I become aware of concerns relating to the safety of a child or vulnerable adult

  • Legal requirement — if I receive a court order requiring disclosure

In most situations, I will always try to discuss this with you first, unless doing so would itself put someone at risk.

Changes to This Policy

I review this policy annually and whenever my practices change. If I make any significant changes that affect how your personal data is handled, I will inform you directly.