Privacy Policy

Sarah Bernard Counselling and Psychotherapy services are delivered by Sarah Bernard. This Privacy Policy explains how I collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a counsellor/psychotherapist, I fully understand the importance of confidentiality and go to great lengths to keep all your information safe. 

Data Controller:
Sarah Bernard, 19 Dulka Road, London, SW11 6SB

1. Contact Form and Website Enquiries

When you use the contact form on this website, you provide your name, email address, and any information included in your message. This information is used solely to respond to your enquiry about counselling and psychotherapy services.

Handling of enquiries:

• Your message is sent securely via Microsoft 365 Outlook, which is GDPR-compliant.
• No personal data are stored on the website once the enquiry is submitted.
• If you do not proceed with therapy, your details are deleted within three months of last communication.
• If you begin therapy, your information becomes part of your client record and is managed under this Privacy Policy.
• Your personal data are never used for marketing or shared with third parties.

2. Information Collected:
When we first speak, I will request further information including contact details, medical history, and other information relevant to the provision of therapy services. To deliver therapeutic services and maintain appropriate records, I will also make brief session notes which are stored in accordance with data protection laws.
.

Storage and Security:
When we begin working together, records - including session notes - are stored securely on an encrypted hard drive on a password protected computer. Email communication is managed through Microsoft 365 Outlook, which provides GDPR-compliant encryption and data processing agreements. Information is not shared with third parties unless:

• required by law; or
• there is a serious risk of harm to self or others.

In such cases, only necessary information is disclosed and shared securely.

3. Data Retention & Disposal Policy

Purpose:
To ensure personal data are retained only as long as necessary and disposed of securely.

Retention Period:
All client records (session notes, consent forms, correspondence) are retained for five years after therapy ends as required by my professional insurance body. For clients under 18, records are kept for seven years after they reach 18.

Disposal:

• Digital records: Permanently erased using professional data deletion tools.
• Paper records (if any): destroyed securely.

Retention periods are regularly reviewed and updated to reflect changes in legal or professional guidance.

4. Protecting Your Data
I will go to great lengths to keep your data secure. However, no internet-based platform, including email, is 100% secure, so I cannot be held responsible for unauthorised or unintended access that is beyond our control. When I communicate via email, there is always the possibility that email platforms can be hacked or email transmission may not be encrypted going back and forth. I remain mindful of this and do everything I can to protect your personal information.

5. Accessing Your Data

Clients have the right to access, correct, or request deletion of their personal data under the UK GDPR.

Procedure:

• Requests must be made in writing (by email) to Sarah Bernard.
• Proof of identity may be required.
• Responses will be provided within one calendar month of receipt.
• Information may be withheld if release would cause serious harm to the client or another person.
• All requests and responses will be documented.

6. Data Processing & Consent

By engaging in therapy with Sarah Bernard, you acknowledge that your personal information will be processed and stored in accordance with this Privacy Policy and relevant data protection laws. Your data are used solely to provide counselling/psychotherapy services. You have the right to access, rectify, or request deletion of your personal data as described above. You may withdraw consent for optional communications (e.g., email reminders) at any time by notifying me in writing.

7. Cookies and Website Use

This website uses cookies to ensure it functions properly, enhance user experience, and analyse anonymous usage patterns.

Types of cookies used:

• Essential cookies: Necessary for website functionality (e.g., secure contact form).
• Performance & analytics cookies: Anonymous data to improve website performance.
• Hosting & security cookies: Used by GoDaddy to ensure stability and protection against malicious activity.

Consent:
When visiting the site, you can choose whether to allow non-essential cookies. Essential cookies are always active for security. You can withdraw or change consent at any time via browser settings. Cookies do not collect personal information such as your name or contact details.

8. Website Hosting and Security

This website is hosted by GoDaddy, acting as a data processor under the UK GDPR. GoDaddy may process limited technical data (e.g., IP addresses, browser type, security logs) to ensure reliability and security. The site uses SSL encryption to protect data transmitted between your browser and the website. No confidential therapy records or session notes are stored on the website or its hosting server.

9. Your Rights

You have the right to request:

• access to your personal data;
• correction of inaccurate data;
• restriction or erasure (subject to legal requirements);
• data portability (in certain circumstances).

Requests should be made in writing to Sarah Bernard.

10. Complaints

If you believe your personal data have not been handled appropriately, please contact Sarah Bernard in the first instance. You also have the right to raise your concern with the Information Commissioner’s Office (ICO): Website: www.ico.org.uk