Privacy Policy for Private Practice & for Lorna Mcleod's Website
Privacy Policy - For Private Practice
Introduction
I understand how important your privacy is. I handle all personal and therapy information in accordance with UK data protection law (GDPR, 2018) and the ethical guidelines of the BACP. These guidelines are in place to protect your confidential information and ensure professional, ethical practice.
This policy explains how I collect, store, use, and protect your personal information when you work with me or use my website.
Information I Collect
To provide counselling, I may collect the following information:
Personal details: Name, date of birth, email, phone number, address.
Therapy-related information: Session notes, personal history, mental health and wellbeing details.
Emergency contacts: Contact information for your GP and an emergency
contact person, collected at your first session for your safety.
Website information: If you use online forms or email me, basic contact details may be collected securely.
How I Use Your Information
Your information is used only for the purposes of:
Providing counselling services tailored to your needs
Managing and confirming appointments
Communicating with you regarding sessions or therapeutic information
Meeting professional or legal obligations (e.g., safeguarding, supervision)
I will never use your information for marketing purposes or share it with third parties outside of professional or legal requirements.
How I Store and Protect Your Information
I take the security of your information very seriously:
Digital records are password encrypted and securely stored using two factor
authentication.
Physical records: Session notes and any hard-copy information are kept in a
locked cabinet.
Retention: Session notes are kept for up to seven years after therapy ends, in
line with BACP guidelines, and then confidentially destroyed. Basic identifiers,
such as your name and client reference number, are retained for the same
period for administrative purposes.
Sharing Information
Information may be shared in limited circumstances:
With my clinical supervisor in a confidential and anonymised form
When legally required, such as concerns about safety or court orders
Otherwise, your session information remains confidential. If your sessions are paid for or arranged via a third party (e.g., employer or family member), only the necessary administrative details will be shared; session content remains private unless you give written consent.
Your Therapy Sessions
All information shared during therapy is confidential. Confidentiality will only be
broken if:
There is a concern for your safety or the safety of someone else
I am required to do so by law
Remote sessions are conducted in a private, secure environment using encrypted video platforms. While every effort is made to maintain privacy, I cannot accept responsibility for breaches outside my control.
Communications
Emails are sent and received securely; only I have access to these
communications.
All devices used for communication are encrypted, password-protected, and
protected with antivirus software.
Your email and phone number will be used only to contact you about
appointments or therapeutic matters. Text reminders may also be sent.
Your Rights
You have the following rights under GDPR:
1. Right of access: You can request to see the information I hold about you, including session notes.
2. Right of rectification: You can request corrections to any inaccurate information.
3. Right to be forgotten: You can request deletion of your personal data.
Exceptions may apply if records are required for ongoing therapy, legal
obligations, or to defend legal claims.
Requests can be made at any time by contacting me at mcleodlorna1@gmail.com
or 07733104545
Consent
During your initial consultation, you will be asked to confirm your consent to the storage and processing of your personal information for the purpose of counselling. You may withdraw consent at any time by contacting me.
Data Breaches
In the unlikely event of a data breach, I will notify affected clients and the Information
Commissioner’s Office (ICO)within 72 hours and take immediate steps to address
the issue.
Privacy Policy – My Website
Your privacy is critically important and you won’t be asked for personal information unless truly needed.
Your personal information will not be shared with anyone except to comply with the law or where required in order to carry out the service the information was provided for.
Your personal information is not stored on servers unless required for the ongoing operation of any service carried out and you have made an enquiry directly through the website.
In my service, I aim to make it as simple as possible for you to control what’s visible to the public, seen by search engines, kept private, and permanently deleted. Below is my privacy policy which incorporates these goals.
If you have questions about accessing or correcting your personal data, please contact me via email or phone.
The Operator (the legal representative and individual responsible for this website and the business the website is built for) – Lorna Mcleod
Website: lornamcleodtherapy.co.uk
The website provider (the company who designed and runs the website on behalf of The Operator) – Spirivo
Website Visitors
Like most website operators, this website and our website provider, Spirivo, can collect non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request. The purpose of collecting non-personally-identifying information is to better understand how visitors use this website.
From time to time, Spirivo may release non-personally-identifying information in the aggregate, e.g. by publishing a report on trends in the usage of its website.
Gathering of Personally Identifying Information
Certain visitors to this website choose to interact with the site in ways that require The Operator and Spirivo to gather personally-identifying information. The amount and type of information that The Operator and Spirivo gathers depends on the nature of the interaction.
For example, through contact forms, visitors may be required to provide an email address, name, and telephone number. In each case, The Operator and Spirivo can collect such information only insofar as is necessary or appropriate to fulfil the purpose of the visitor’s interaction with the site.
The Operator and Spirivo do not disclose personally-identifying information other than as described below. Visitors can always refuse to supply personally-identifying information, with the caveat that it may prevent them from engaging in certain website-related activities.
Aggregated Statistics
The Operator and Spirivo may collect statistics about the behaviour of visitors to the website. For instance, The Operator and Spirivo may monitor the most popular pages on the site or use spam filtering provided by website systems to help identify spam.
The Operator and Spirivo may display this information publicly or provide it to others. However, The Operator and Spirivo do not disclose personally-identifying information other than as described below.
Protection of Certain Personally Identifying Information
The Operator and Spirivo disclose potentially personally-identifying and personally-identifying information only to those employees, contractors and affiliated organisations that (i) need to know that information in order to process it on The Operator’s behalf or to provide services available, and (ii) have agreed not to disclose it to others.
Some of those employees, contractors and affiliated organisations may be located outside of your home country. By using this website, you consent to the transfer of such information to them.
By using this website, you consent to the exchange of said information to and from Spirivo and The Operator. Neither party will rent or sell potentially personally-identifying and personally-identifying information to anyone.
Other than to employees, contractors and affiliated organisations, as described above, The Operator and Spirivo disclose potentially personally-identifying and personally-identifying information only when required to do so by law, or when the Operator believes in good faith that disclosure is reasonably necessary to protect the property or rights of the business, third parties, or the public at large.
If you are a user of this website and have supplied your email address, The Operator may contact you to schedule a meeting, request feedback, or provide updates about the business.
The Operator may also be required to disclose an individual’s personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
The Operator acknowledges that all individuals have the right to access the personal information/data that we maintain about them. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should contact The Operator directly via the website.
If requested to remove data, The Operator will respond within a reasonable timeframe, not exceeding one week.
If The Operator engages in any onward transfers of your data with third parties for a purpose other than that for which it was originally collected or subsequently authorised, you will be provided with an option to opt out.
What are Cookies?
Cookies are small text files which are stored by the browser on your computer. Only the information that you provide, or the choices you make while visiting a website, can be stored in a cookie. Allowing a website to create a cookie does not give that or any other site access to the rest of your computer.
Our use of Cookies and how to opt out
The Operator and Spirivo may use cookies to monitor how people use this site to improve user experience. Some cookies may be stored by third parties. The Operator and Spirivo have no control over these cookies or how they are used.
If you prefer not to use cookies, you can delete or disable them in your browser settings at any time. Please note that disabling cookies may affect functionality on certain parts of the website.
Purpose of cookies for this website
Session cookies – Used to remember pages visited. These expire when you close your browser.
Persistent cookies – Store settings to improve user experience (e.g. remembering preferences).
Third-party cookies – Set by external services such as analytics tools or social media integrations.
Third-party cookies possibly used by this website
Provider: Spirivo
Purpose: Website provider and analytics
Policy: https://www.spirivo.com/privacy
Provider: Google
Purpose: Search, Maps, Analytics, YouTube
Policy: https://www.google.co.uk/intl/en/policies/privacy/
Provider: Facebook
Purpose: Social sharing
Policy: https://www.facebook.com/about/privacy/
Provider: Pinterest
Purpose: Pinterest features
Policy: https://about.pinterest.com/en/privacy-policy
Provider: Instagram
Purpose: Instagram features
Policy: https://www.instagram.com/about/legal/privacy/
Provider: Vimeo
Purpose: Video hosting
Policy: https://vimeo.com/privacy
Although most changes are likely to be minor, The Operator may update this Privacy Policy from time to time at their sole discretion.