Data & Privacy Policy | Mike Clement Counselling

1. Who I am

This privacy policy explains how Mike Clement Counselling collects, uses, stores, and protects your personal information.

I am Mr. Michael Clement, a qualified counsellor and supervisor, and the sole practitioner at Mike Clement Counselling. I am a registered member of the British Association for Counselling and Psychotherapy (BACP) and bound by their Ethical Framework for the Counselling Professions.

I am registered with the Information Commissioner's Office (ICO). My registration number is ZA765347.

If you have any questions about how I handle your personal data, you can contact me at: info@mikeclementcounselling.co.uk

2. What personal data I collect

To provide therapy services, I may collect and process the following types of personal data:

Contact information:

• Your name, address, telephone number, and email address
• Emergency contact details

Therapy-related information:

• The reasons you are seeking therapy (presenting issues)
• Information about your background relevant to our therapeutic work
• Relevant medical history and any current medications
• Details of your GP (if you choose to provide this)
• Session notes recording key themes and progress in our work together
• Dates and times of appointments
• Any correspondence between us

Financial information:

• Records of payments made for therapy sessions

Special category data

Much of the information I collect about you falls into what UK GDPR calls "special category data" under Article 9(1). This includes information about your physical and mental health. Special category data receives enhanced protection under data protection law, and I take additional care to keep this information secure and confidential.

3. How I collect your data

I collect your personal data directly from you in the following ways:

• When you first contact me to enquire about therapy (by email, telephone, or through my website)
• When you have an initial assessment session before we begin working together
• During our therapy sessions, through what you share with me
• Through any correspondence between us (emails, text messages, or telephone calls)

I do not collect personal data about you from third parties without your knowledge and consent.

4. Why I process your data — lawful basis

Under UK GDPR, I must have a lawful basis to process your personal data. Because therapy involves special category data (health information), I need to meet conditions under both Article 6 and Article 9 of UK GDPR.

Article 6 basis — ordinary personal data

My lawful basis is Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.

When you engage me as your therapist, we enter into a contract. I need to process your personal data to fulfil my obligations under that contract, including scheduling appointments, maintaining appropriate records, and providing you with therapy.

Article 9 basis — special category data (health information)

My lawful basis for processing your health-related information is Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care purposes). This condition applies because I am a qualified counsellor subject to the professional obligation of confidentiality under the ethical framework of BACP.

5. Professional obligations and CPD

As a BACP member, I am required to attend regular clinical supervision. This is a professional requirement that helps ensure you receive safe and effective therapy.

When I discuss my therapeutic work with my supervisor:

• Your name and any identifying details are NOT shared — I use anonymised or pseudonymised case material only
• My supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is bound by their own professional body's ethical framework
• Supervision discussions focus on the therapeutic process and my professional development, not on identifying you personally

Clinical supervision is an essential part of ethical practice and helps me provide you with the best possible care.

6. Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor — my own supervisor — who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly.

If such a situation occurs, my Clinical Executor will:

• Contact you to let you know I am no longer able to see you
• Offer to provide you with referral information to help you find another therapist if you wish
• Handle your records with the same level of confidentiality I would
• Securely destroy your records in accordance with this privacy policy, or retain them for the appropriate period if required

My Clinical Executor is bound by professional confidentiality and will only access the minimum information necessary to contact you and manage records appropriately. They will not read your therapy notes unless strictly necessary for record management purposes.

7. Who I share your data with

I take your confidentiality seriously and share your personal data only when necessary and appropriate.

Clinical supervisor

As explained above, I discuss my work in supervision using anonymised or pseudonymised case material only. Your name and identifying details are not shared with my supervisor.

External accountant

I use an external accountant to help manage my accounts. They have access to invoice data only (your name, dates of sessions, and amounts paid). They do not have access to any clinical information, session notes, or details about why you are attending therapy. My bookkeeper is bound by confidentiality obligations.

Third-party service providers

I use the following third-party services which may process some of your data:

• WebHealer — the platform my website is built on
• Zoom — for online therapy sessions (if we meet online)
• Google Meet — for online therapy sessions (if we meet online)

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

I never sell your personal data.

8. International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

• WebHealer — WebHealer Ltd, UK (no international transfer)
• Zoom — Zoom Video Communications Inc, USA
• Google Meet — Google LLC, USA

The USA does not currently have a UK adequacy decision. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

You can request a copy of the relevant transfer safeguards by contacting me.

9. How long I keep your data

I retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law or professional guidelines.