Privacy Notice
Last updated: June 2026
Confidentiality and information sharing
Everything discussed in therapy is treated confidentially.
However, confidentiality is not absolute and there are circumstances where information may need to be shared.
These include:
Where there is a serious risk of harm to yourself or another person.
Where there are safeguarding concerns involving a child, vulnerable adult or person at risk.
Where disclosure is required by law, court order or legal process.
Where disclosure is necessary to prevent or detect a serious crime.
Where there is a medical emergency and information is required to protect life.
For the purposes of professional clinical supervision.
Where possible and appropriate, I will discuss any disclosure with you beforehand. However, there may be situations where I am unable to do so because this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure or would otherwise not be possible.
Clinical supervision
As part of professional practice, I attend regular clinical supervision.
I may discuss aspects of client work with my supervisor to support safe and effective practice. Information is anonymised or pseudonymised wherever possible and appropriate, and my supervisor is bound by confidentiality, professional standards and data protection obligations.
Clinical notes and records
I keep brief clinical notes to support safe, ethical and effective therapy.
These records may include:
Session dates.
Brief themes discussed.
Relevant risk, safeguarding or clinical information.
Agreed actions or important decisions.
Contact and administrative information.
I do not keep full transcripts of therapy sessions.
Professional standards
I hold professional indemnity insurance.
Where required by my work, I maintain appropriate DBS checks in accordance with professional and organisational requirements.
Online therapy
Where therapy is provided online, sessions take place using Zoom.
I take reasonable steps to protect confidentiality from my side and ask clients to participate from a private location where they cannot easily be overheard or interrupted.
Zoom may process technical information such as IP addresses, device information and connection data. Please refer to Zoom's own privacy notice for further information about how it processes personal data.
Privacy and handling your personal information
I am committed to protecting your privacy and handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This privacy notice explains how I collect, use, store and protect your personal information.
I am Mandy Fowler and I am the Data Controller for the personal information that I collect and process as part of my therapy practice.
If you have any questions about this privacy notice or how your information is handled, please contact:
Email: mandy@mandyfowler.co.uk
This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.
Initial enquiries
When you first make contact with me, I will store your contact details and any information you choose to share in your enquiry.
If we do not begin working together and I receive no further contact from you, your information will normally be deleted within four weeks.
What information I collect
I may collect and process the following personal information:
Your name, address, email address and telephone number.
Date of birth and emergency contact details.
Information you provide during an enquiry or consultation.
Information shared during therapy sessions.
Information relating to your health, wellbeing, relationships, family circumstances and personal history where relevant to therapy.
Session notes and records relating to our work together.
Appointment, attendance and payment information.
Correspondence between us.
Some of this information may be classed as special category data under UK data protection law, including information relating to health, mental health, sexuality, ethnicity, religion or other sensitive matters where relevant to therapy.
I only collect information that is necessary for providing therapy safely, ethically and professionally.
Why I collect your information
I collect and use your information to:
Respond to enquiries.
Assess whether I am able to offer an appropriate service.
Provide counselling and psychotherapy.
Maintain clinical records.
Arrange and manage appointments.
Process payments and maintain financial records.
Communicate with you regarding sessions.
Meet professional, ethical and legal obligations.
Manage risk, safeguarding or emergency situations where necessary.
Respond to data protection requests or complaints.
I do not sell your personal information.
Lawful basis for processing
Under UK GDPR, the lawful bases I rely upon are:
Article 6(1)(b) – Contract
To arrange and provide counselling and psychotherapy services requested by you.
Article 6(1)(f) – Legitimate Interests
To manage and administer my practice safely and effectively, maintain appropriate records and protect both you and me.
Article 6(1)(c) – Legal Obligation
Where I am required to process or disclose information in order to comply with a legal obligation.
As therapy involves information about health and wellbeing, I also process special category data under:
Article 9(2)(h) – Provision of Health or Social Care
and, where appropriate,
Article 9(2)(a) – Explicit Consent
Where I ask for consent for a specific purpose, I will explain what I am asking for and whether that consent can be withdrawn.
How your information is stored
I take appropriate technical and organisational measures to protect your information.
Information may be stored:
In secure electronic systems protected by passwords and encryption where available.
In secure paper records kept in locked storage.
Within secure email, phone text and administrative systems used to manage appointments and correspondence.
Within secure online therapy systems where applicable.
Access to information is restricted to those who have a legitimate need to access it.
AI, recording and transcription
I do not record therapy sessions.
I do not use artificial intelligence (AI), transcription software or automated systems to record, transcribe, analyse or create notes from therapy sessions.
I may use digital tools for general practice administration, writing, planning or education. Where I do so, I take care not to enter identifiable client information into systems that are not appropriate for confidential clinical material.
Sharing your information
I will not share your personal information unless there is a clear reason to do so.
Information may be shared, where necessary and lawful, with:
My clinical supervisor.
Professional advisers such as my insurer, accountant or legal adviser.
Safeguarding services, emergency services or your GP where there is serious risk or safeguarding concern.
A court or legal authority where required by law.
An appointed clinical executor should I die or become incapacitated.
Trusted digital service providers who process information on my behalf, including Zoom for online sessions.
Where possible, only the minimum necessary information will be shared.
Some service providers may process information outside the United Kingdom. Where this occurs, appropriate safeguards are relied upon in accordance with UK data protection law.
Clinical will
I have arrangements in place so that clients can be contacted if I die or become seriously incapacitated.
This may involve a trusted professional colleague having access to the minimum information necessary to contact current clients. Any such person would be bound by confidentiality and would not take on an ongoing therapeutic role unless separately agreed and appropriate.
How long information is kept
Client records are normally retained for seven years after the end of therapy, in line with professional practice recommendations and insurance requirements.
Records relating to children and young people may be retained for longer in accordance with professional guidance.
Financial records may be retained for the period required by tax and accounting regulations.
After the relevant retention period has expired, records will be securely destroyed.
Your rights
Under UK GDPR, you have rights including:
The right to be informed about how your information is used.
The right to access your personal information.
The right to request correction of inaccurate information.
The right to request erasure in certain circumstances.
The right to restrict processing in certain circumstances.
The right to object to processing in certain circumstances.
The right to data portability where applicable.
The right to complain about how your information has been handled.
Some rights are not absolute and may be limited where legal, professional, safeguarding, insurance or complaint-related obligations apply.
If you would like to exercise any of your rights, please contact me using the details above.
I will normally respond within one month.
Website and cookies
If you visit this website, basic technical information may be collected automatically through cookies, website hosting systems and website analytics.
This information may include:
IP address.
Browser type.
Device type.
Pages visited.
Date and time of your visit.
You can control cookies through your browser settings.
Where cookies require consent under applicable law, appropriate notice and choice will be provided.
Data protection concerns and complaints
If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me at:
Please include:
Your name.
Details of your concern.
What you would like me to investigate.
How you would like me to respond.
I will acknowledge your complaint within 30 days and will investigate and respond without undue delay.
If you remain dissatisfied with my response, or if you would prefer to contact the regulator directly, you can contact the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Changes to this privacy notice
I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.
The latest version will always be available on my website.
Mandy Fowler
June 2026