Your privacy matters to me. This notice explains what personal information I collect when you contact me or work with me as a client, why I need it, how I look after it, and what rights you have. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If anything is unclear, please ask.
1. Who I am
I am the "data controller", which means I decide how and why your personal information is used. I am a sole practitioner and an Accredited member of the British Association for Counselling and Psychotherapy (BACP), working within the BACP Ethical Framework.
Name: Natalie Cosgrove-James
Email: Natalie@cosgrove-therapy.com
Phone: 07563174226
Address: Cranberry Wellbeing Centre, First Floor, 67 Leigh Road, SO50 9DF
ICO registration number: ZB047995
2. What information I collect
When you enquire: your name, contact details and anything you choose to tell me about why you are seeking therapy.
When we start working together: the details on my client form, including your full and preferred name, pronouns, date of birth, address, phone number, email address, GP details, emergency contact details and any medication you choose to tell me about. I ask about medication so I can support you safely. You can leave this blank if you prefer.
During our work: brief notes I write after each session, and any emails, texts or messages we exchange. These notes may include sensitive information about your health and wellbeing, which the law calls "special category data". I keep notes factual, relevant and as brief as I can.
For payments: records of the fees you pay, including the date and amount of bank transfers.
3. Why I use your information, and my lawful basis
What I use it for and the relevant lawful basis:
Arranging and providing therapy, contacting you about sessions: Contract (UK GDPR Article 6(1)(b))
Keeping health-related notes and records of our work: Contract, and provision of health or social care (Article 9(2)(h))
Taking payments and keeping accounting records: Contract, and legal obligation (Article 6(1)(c))
Sharing information to protect you or others from serious harm, or because the law requires it: Legal obligation, or vital interests (Article 6(1)(c) and (d))
Discussing our work in clinical supervision: Legitimate interests in providing a safe, high-quality service (Article 6(1)(f)), and Article 9(2)(h)
Responding to complaints or legal claims: Legitimate interests, and establishing or defending legal claims (Article 9(2)(f))
Where I rely on your consent (for example, to contact your GP in a non-urgent situation), I will ask you clearly and you can withdraw it at any time.
4. Who I share your information with
I keep what you tell me confidential. I only share information in the following situations.
Clinical supervisor. I attend regular supervision, as required by BACP.
Your GP or emergency services, if I believe you or someone else is at risk of serious harm. I will aim to speak with you first where it is safe and possible.
Legal or safeguarding authorities, where I am required by law to disclose information, for example in relation to safeguarding, serious crime or a court order.
My clinical executor, a trusted colleague bound by confidentiality, who could contact you if I were unable to do so myself, such as in the event of illness, injury, or death.
Service providers who help me run my practice, such as my online video platform (Doxy.me and Google Meet), email provider (Gmail), secure storage provider (OneDrive and Google Drive), and my bank. These providers act under their own data protection obligations, and I choose them with security in mind.
Health insurers or insurance platforms, if you access therapy through one. I will explain what is shared and ask for your agreement first.
My professional indemnity insurer or BACP, only if there is a complaint, claim or professional conduct matter, and only what is necessary.
I never sell your information or use it for marketing.
5. Digital tools and artificial intelligence
I do not use AI tools to record, transcribe, summarise or analyse our sessions, and I do not enter your personal information into AI tools.
6. How I keep your information safe
Electronic records are stored on my work laptop, protected by a password, and by passwords and, two-factor authentication for OneDrive, Google Drive, and my email account.
Online sessions are held from a private space.
I limit emails and messages to practical matters, and ask you not to send sensitive details by email or text.
7. How long I keep your information
I keep client notes and records for 7 years after our work ends, then securely delete or destroy them. This is to meet insurance and legal requirements. Contact enquiries that do not lead to therapy are deleted after 3 months. Financial records are kept for as long as tax law requires.
If the law or a professional body requires me to keep information for longer, I will do so only for as long as necessary.
8. Transfers outside the UK
I do not transfer your information outside the UK
9. Your rights
You have the right to:
be informed about how your data is used (this notice);
access a copy of the information I hold about you;
correct information that is inaccurate or incomplete;
erase your information, in some circumstances;
restrict how I use your information, in some circumstances;
object to certain uses of your information;
data portability, in some circumstances; and
withdraw consent at any time, where I rely on it.
Some rights are limited. For example, I may need to keep records to meet legal or insurance requirements, or to protect someone's safety. I will always explain my reasoning.
To use any of these rights, contact me using the details above. I will reply within one month.
10. My website
My website uses cookies, which are small files stored on your device. Essential cookies keep the site working. Any non-essential cookies, such as analytics, are only set with your consent, which you can change or withdraw at any time through the cookie settings on the site.
Enquiry form. If you contact me through the form, I receive the details you enter, such as your name, contact details and message. Submissions are stored securely in Google Drive and used only to reply to you. Please don't include sensitive details in the form. Enquiries that don't lead to therapy are deleted after 3 months.
Links to other sites. My website may link to other sites. I'm not responsible for their privacy practices, so please check their notices.
11. Complaints
If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
If your concern relates to my professional conduct, you can also contact BACP.
12. Changes to this notice
I review this notice regularly and will update it when needed. The latest version is always on my website.