Privacy Policy

Last Updated: 10 July 2026

Protecting your privacy and maintaining the confidentiality of your personal information is extremely important to me. This Privacy Policy explains how I collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

By contacting me or engaging in counselling, psychotherapy, clinical supervision or related professional services, you acknowledge that your personal information will be processed as described in this Privacy Policy.

Data Controller:

The Data Controller is: Nina Guha

  • Senior Accredited Counsellor, Psychotherapist & Clinical Supervisor
  • Senior Accredited Registered Member – British Association for Counselling and Psychotherapy (BACP)
  • Senior Accredited Registrant – National Counselling & Psychotherapy Society (NCPS)

If you have any questions about this Privacy Policy or how your personal information is handled, please contact me using the contact details published on this website.

Information I Collect:

Depending upon the services you receive, whether counselling, psychotherapy, clinical supervision or related professional services, I may collect:

  • Your name, address, telephone number and email address.
  • Date of birth and emergency contact details where appropriate.
  • GP details and details of other healthcare or relevant professionals where appropriate.
  • Information relating to your health, wellbeing, therapy goals, supervision requirements and personal circumstances.
  • Assessment questionnaires and outcome measures where applicable.
  • Session and supervision notes.
  • Appointment history and correspondence.
  • Payment and invoicing records.
  • Information submitted through my website contact form.
  • Technical information such as IP address, browser type and cookies when visiting my website.

Special Category Data:

As a counsellor, psychotherapist and clinical supervisor, I routinely process special category personal data relating to health and wellbeing. This information receives additional legal protection under the UK GDPR.

Such information is collected only where necessary to provide safe, ethical and effective professional services.

How I Use Your Information:

Your personal information is used to:

  • Respond to enquiries.
  • Arrange and manage appointments.
  • Provide counselling, psychotherapy, clinical supervision and related professional services.
  • Maintain accurate clinical and supervision records.
  • Communicate with you regarding appointments and professional services.
  • Prepare invoices and maintain financial records.
  • Meet professional, ethical and legal obligations.
  • Protect the safety of clients or others where necessary.
  • Improve the services offered through my practice.

I will only use your information for the purposes for which it was collected unless required or permitted by law.

Lawful Basis for Processing:

Depending upon the circumstances, I process your personal information under one or more of the following lawful bases:

  • Performance of a contract.
  • Legitimate interests.
  • Compliance with legal obligations.
  • Protection of vital interests where necessary.

Where special category personal data is processed, this is undertaken in accordance with the relevant provisions of the UK GDPR together with my professional and ethical obligations as a counsellor, psychotherapist and clinical supervisor.

Confidentiality:

Everything discussed within counselling, psychotherapy and clinical supervision is treated confidentially.

However, there are exceptional circumstances where confidentiality may need to be breached. These include situations where:

  • there is a serious concern regarding your safety or the safety of another person;
  • disclosure is required by law or by a court order;
  • safeguarding concerns arise involving a child or vulnerable adult;
  • disclosure is necessary to prevent serious crime.

Wherever possible and appropriate, I will discuss this with you before sharing information.

Professional Supervision:

As required by my professional ethical framework, I discuss my clinical work in confidential professional supervision.

Client information shared during supervision is anonymised wherever possible, and supervisors are themselves bound by strict professional and confidentiality obligations.

Clinical Supervision:

If you engage me as your Clinical Supervisor, I will collect and process personal information necessary to provide supervision, maintain supervision records, communicate with you, and fulfil my professional, ethical and legal obligations.

Information shared within supervision is treated confidentially, subject to the same legal and ethical limits of confidentiality outlined in this Privacy Policy.

Sharing Your Information:

Your personal information will never be sold.

Information will only be shared where:

  • you have given your consent;
  • it is necessary to provide your care or professional services;
  • I am legally required to do so;
  • there is a safeguarding concern;
  • it is necessary to protect your vital interests or those of another person;
  • it is required in connection with professional indemnity insurance, legal proceedings or regulatory requirements.

How Your Information Is Stored:

I take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.

Records may be stored securely in electronic and/or paper format and are accessible only where necessary for the operation of my practice.

Where counselling, psychotherapy or supervision is provided online, I use secure platforms and take reasonable steps to protect the privacy and confidentiality of remote sessions.

Although every reasonable effort is made to protect your information, no electronic transmission or storage system can be guaranteed to be completely secure.

How Long Information Is Retained:

Records are retained only for as long as necessary to fulfil the purposes for which they were collected and to comply with legal, professional, ethical and insurance requirements. Retention periods are determined in accordance with applicable legislation, professional guidance, insurance requirements and the legitimate needs of the practice.

My current retention periods are as follows:

  • Adult client records: 7 years following the end of therapy.
  • Children and young people’s records (where applicable): Until the client’s 25th birthday (or 26th birthday if they were 17 when therapy ended).
  • Clinical supervision records: 7 years following the end of the supervisory relationship.
  • Financial and accounting records: 6 years in accordance with HMRC requirements.
  • General enquiries where therapy does not commence: Up to 12 months.

Once the relevant retention period has expired, records are securely destroyed or permanently deleted.

Your Rights:

Under the UK GDPR you have the right to:

  • Request access to the personal information I hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request erasure of your personal information where applicable.
  • Request restriction of processing in certain circumstances.
  • Object to certain types of processing.
  • Request a copy of your personal data in a portable format where applicable.
  • Raise a concern or complaint with me regarding how your personal information has been handled.
  • Lodge a complaint with the Information Commissioner’s Office (ICO) if you remain dissatisfied.

Data Protection Complaints:

If you have any concerns about how I collect, use, store or protect your personal information, I encourage you to contact me in the first instance so that I can investigate and try to resolve your concerns promptly.

Complaints may be submitted by email or in writing using the contact details published on this website.

I will acknowledge receipt of your complaint within 30 calendar days and will investigate the matter fairly and impartially. Where appropriate, I will keep you informed of the progress of my investigation and will provide a written response once my investigation has been completed.

If you remain dissatisfied following my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Further information about your data protection rights and the ICO’s complaints process can be found on the ICO website.

Cookies:

My website uses cookies and similar technologies to improve website functionality, analyse website traffic and enhance your browsing experience.

You may manage or disable cookies through your browser settings, although doing so may affect certain features of the website.

Changes to This Privacy Policy:

This Privacy Policy may be updated from time to time to reflect changes in legislation, professional guidance or the services I provide.

The most recent version will always be published on this website together with the date it was last updated.

Contact:

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or would like to raise a concern about how your personal information has been handled, please contact me using the contact details published on this website.

If you remain dissatisfied after contacting me, you may also contact the Information Commissioner’s Office (ICO).