Debbie Hicks Counselling and Psychotherapy - Privacy & Consent Notice
I am happy to chat through any questions you might have about my data protection policy and you can contact me via email or telephone.
Data Controller is the term used to describe the person/ organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me, Debbie Hicks. I am registered with the Information Commissioner’s Office ZA266772.
YOUR PERSONAL INFORMATION
General Data Protection Regulation (GDPR)
In compliance with GDPR regulations this document tells you what personal information I hold and why, and what your rights are. Once you have read it please complete and sign the declaration of consent at the bottom.
Therapist: Debbie Hicks
Telephone: 07851155782
Address: Stoneleigh, St Ive Road, Pensilva, Liskeard Cornwall. PL14 5NX
The Purpose of Processing Client Data
I hold and use client data in order to provide you with the best possible therapy options, and support.
Lawful Basis for Holding and Using Client Information
The GDPR states that I must have a lawful basis for processing your personal data. There are different lawful bases depending on the stage at which I am processing your data. I have explained these below:
If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information.
If you are currently having therapy or if you are in contact with me to consider therapy, I will process your personal data where it is necessary for the performance of our contract.
The GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called ‘special category personal information’. The lawful basis for me processing any special categories of personal information is consent initially. I will then retain any counselling records in case of the need to reference them in the future (the official legal basis is to defend against potential legal claims).
Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information are:
Your consent. You can remove your consent at any time. You can do this by contacting email address
(a) I have a contractual obligation
(b) I have a legal obligation:
1.‘Claims occurring’ insurance: (records to be kept for 7 years after last treatment)
2.Law regarding children’s records (records to be kept until the child is 25 or if 17 when treated, then 26)
3.CNHC requirements to retain information for 8 years
(d) I have a vital interest
(e) I need it to perform a public task
(f) I have a legitimate interest [i.e.my requirement to retain the information to provide you with the best possible therapy]
What information I hold and what I do with it.
In order to give professional therapy, I will need to ask for and keep information about you. I will only use this for information for my personal use. The information to be held is:
- Your contact details
- Medical history and other health-related information
How I use your information
Initial contact.
When you contact me with an enquiry about my counselling services I will collect information to help me satisfy your enquiry. This will include telephone number and email address. Alternatively your sponsor or guardian may send me your details when making a referral or a parent or trusted individual may give me your details when making an enquiry on your behalf.
If you decide not to proceed I will ensure all your personal data is deleted as soon as possible.
While you are accessing counselling. Rest assured that everything you discuss with me is confidential. However if a safeguard issue arises I will always try to speak to you about this first, but if there is immediate danger to yourself or another I am legal bound to report this matter.
I will keep a record of your personal details to help the counselling services run smoothly. These details are kept securely in lock cabinet and are not shared with any third party. I will keep written notes of each session, these are kept in a locked cabinet. For security reasons I do not retain text messages for more than a week. If there is relevant information contained in a text message I will keep it on password/finger print protected iPhone.
Likewise, any email correspondence will be deleted after we finish working together if its is not important. If necessary I will print emails and keep securely stored. After counselling has ended.
Once counselling has ended your records will be kept for 7 years (inline with my insurance advice) from the end of our contact with each other and are then securely destroyed. If you want me to delete your information sooner than this, please tell me.
Protecting Your Personal Data
I am committed to ensuring that your personal data is secure. In order to prevent unauthorised access or disclosure, I have put in place appropriate technical, physical and managerial procedures to safeguard and secure the information I collect from you.
I will contact you using the contact preferences you have given me.
I keep the information listed above, for 7 years after your last treatment. I will then dispose your information by secure deletion of electronic data and shredding and burning paper records.
Your Data Protection Rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask me for copies of your personal information.
Your right to rectification - You have the right to ask me to rectify personal information you think is inaccurate. You also have the right to ask me to complete information you think is incomplete.
Your right to erasure - You have the right to ask me to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask me to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that I transfer the personal information you gave me to another organisation, or to you, in certain circumstances. You are not required to pay any charge for exercising your rights. If you make a request, I have one month to respond to you. Please contact me at email address if you wish to make a request. If you are dissatisfied with the response you can complain to the Information Commissioner's Office; their contact details are at: www.ico.org.uk
International Data Transfers
Some of our third-party service providers are based outside the UK. I.e Zoom Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or the service provider is in a country with an adequate data protection framework.
Complaints.
If you are unhappy with how we have handled your personal data, please contact us first at so we have the chance to put it right. We will respond within one month.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
Therapist’s Rights
If you don’t agree to me keeping records or information about you and your sessions or if you don’t allow them to use the information in the way they needed, I could withdraw therapy.
I must keep your records of therapy sessions for a certain period as described above, which may mean that even if you ask them to erase any details about you, they might have to keep these details until after that period has passed.
I can move Your records between their computers and IT systems without your permission if your details are protected from being seen by others.
DECLARATION
I have seen this document and understand that you will hold and use my personal information, using it in order to provide me with the best possible therapy, care in line with the statements above.
Changes to this policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated date.
This policy is effective from 1st November 2026
