Privacy
Privacy Policy
How I collect, store and protect your personal information. Last updated September 2026.
Who I am
I’m Susan Cunningham (Suzie), a counsellor trading as Solent Reflection Therapy. For the purposes of UK data protection law I’m the data controller for the personal information described in this notice. I’m registered with the Information Commissioner’s Office (ICO) under reference ZC111418, and I’m a Registered Member of the British Association for Counselling and Psychotherapy (MBACP 420382).
This notice explains what information I collect about you, why I collect it, how I keep it safe, how long I keep it, and the rights you have over it. It applies to enquiries made through this website or by email, to counselling clients, and to visitors to the website.
What information I collect
If you make an enquiry — your name, email address, phone number if you give it, and anything you choose to tell me in your message or on the first call.
If you become a client — your contact details and date of birth; the name and phone number of someone I can contact in an emergency; the working agreement we both sign; brief notes I make after each session, which record themes and progress rather than a transcript of what you said; and records of sessions booked, attended and paid for.
If you visit the website — anonymous, aggregated information about how the site is used (which pages are visited, roughly where in the world visitors come from, and what kind of device they use). This is collected without cookies and can’t be used to identify you. The site doesn’t use advertising or tracking cookies.
Much of what you share in counselling is information about your health and wellbeing. The law treats this as special category data, which means it has extra protection, and I handle it accordingly.
Why I collect it, and the legal basis
I collect and use your information only for the purposes of providing you with counselling, and for the administration that goes with it: replying to your enquiry, arranging and keeping track of sessions, taking payment, keeping the records that ethical and professional practice require, and contacting someone on your behalf in an emergency.
Under UK GDPR, the legal bases I rely on are: contract, because I need your details to provide the service you’ve asked for; legitimate interests, for the ordinary running of my practice and for keeping records that protect us both; and legal obligation, where a law requires me to keep or disclose information. For health information I rely on Article 9(2)(h) — the provision of health or social care by a professional bound by a duty of confidentiality — and, where I ask for it, your explicit consent.
I’ll never sell your information, and I don’t use it for marketing.
How long I keep it
Enquiries that don’t lead to counselling — deleted within three months of our last contact.
Client records — kept for seven years after our work together ends, in line with professional and insurance requirements for counselling records, and then securely destroyed. If you’re under 18 when we work together, records are kept until your 25th birthday or for seven years, whichever is longer.
Financial records — kept for six years after the end of the tax year they relate to, as HMRC requires.
How it’s stored and kept secure
Electronic records are kept on password-protected, encrypted devices and in secure, UK- or EU-hosted services with two-factor authentication. Any paper notes are kept in a locked cabinet. Session notes are stored separately from your contact details and identified by a reference rather than your name, so that the two can’t easily be connected if either were ever lost.
Emails and website enquiries reach me through an encrypted email service. The website is served over HTTPS, and the contact form sends your message to me by email and doesn’t store it on the website itself.
Who I share it with
Nobody, routinely. What you tell me in counselling stays between us, with these exceptions:
Supervision. Like every ethical counsellor, I discuss my work regularly with a clinical supervisor. You’re never identified, and my supervisor is bound by the same confidentiality as I am.
Serious risk. If I believe there’s a serious risk to your life or someone else’s, I may need to contact your emergency contact, your GP or the emergency services. Wherever it’s possible and safe to do so, I’ll talk to you first.
Legal requirement. If a court orders it, or the law requires it — for example in relation to terrorism or money laundering — I may have to disclose information.
With your agreement. If you ask me to write to your GP or another professional, I’ll do so only with your written consent and only share what you’ve agreed to.
Service providers. The companies that host my email and my website, and Therasee — the practice-management platform I use for bookings, records and video sessions — process data on my behalf under contracts that require them to keep it secure. They can’t use it for their own purposes.
If I become unable to practise unexpectedly, a named colleague has secure access to client contact details solely so that clients can be informed. They don’t have access to session notes.
Your rights
You have the right to see the information I hold about you, to have it corrected if it’s wrong, to ask me to delete it, to restrict or object to how I use it, and to receive a copy in a portable form. Where I rely on your consent, you can withdraw it at any time.
Some of these rights have limits. In particular, I may need to keep records for the periods above even if you ask me to delete them, because professional and legal requirements apply — but I’ll always explain why.
To exercise any of these rights, email me at info@solentreflectiontherapy.co.uk. I’ll respond within one month, and there’s no charge.
Questions and complaints
If you have a question about how I handle your information, or you’re unhappy about something, please tell me first — I’d much rather put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
I’ll update this page if anything about how I handle your information changes, and the date at the top will tell you when it was last reviewed.