PRIVACY NOTICE
The Karter Consultancy
LAST UPDATED: 13 JULY 2026
A Confidential & Supportive Space
Your privacy is very important to me. You can be confident that your personal information will be kept safe and secure, and will only be used for the purpose for which it was provided to me. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. This privacy notice explains what I will do with your personal information from your initial point of contact through to after your therapy has ended, including:
• Why I am able to process your information and what purpose I am processing it for.
• Whether you have to provide it to me.
• How long I store it for.
• Whether there are other recipients of your personal information.
• Your data protection rights.
I am happy to discuss any questions you may have about my data protection policy. You can contact me by email using the address provided below. ‘Data controller’ is the term used to describe the person or organisation that collects, stores and is responsible for people’s personal data. In this instance, the data controller is me.
I am registered with the Information Commissioner’s Office under registration number ZC168314.
Postal address: The Greenhouse Therapy Rooms, Vectra House, 36 Paradise Road, Richmond upon Thames, TW9 1SE
My phone number is: 07716 386593.
My email address is: ryan@karterconsultancy.co.uk.
My Lawful Basis for Holding and Using
Your Personal Information
The UK GDPR states that I must have a lawful basis for processing your personal data. There
are different lawful bases depending on the stage at which I am processing your data, as
explained below:
If you are currently having therapy or coaching, or if you are in contact with me to
consider therapy or coaching, I process ordinary personal data where this is
necessary to take steps at your request before entering into a contract, or for the
performance of our contract.If you have had therapy or coaching with me and it has now ended, I rely on
legitimate interests where it is necessary to retain and use limited records for
professional, insurance, legal, safeguarding, regulatory or continuity-of-care reasons.Some information you share with me may be special category personal data,
including information about your physical or mental health, relationships, sexuality,
religion, ethnicity or other sensitive matters. For this information, I identify both an
Article 6 lawful basis and a separate Article 9 condition under the UK GDPR. Where
relevant, I process this information because it is necessary for the provision of
counselling, coaching or related professional services, for safeguarding, or for the
establishment, exercise or defence of legal claims. I will only collect and use
information that is necessary, proportionate and relevant to the service I provide.
How I Use Your Information
Initial contact
I collect information such as relationship status, children, GP details, medication, and any relevant risk history only where it is necessary to assess suitability, support safe and effective work, and meet my professional, legal, safeguarding, and record-keeping obligations.
When you contact me with an enquiry about my counselling and/or coaching services, I will collect only the information that is necessary to respond to your enquiry, assess whether I may be able to offer a suitable service, and discuss next steps. This may include your name, contact details, date of birth, GP contact details, emergency contact details, and brief information about your physical or mental health where this is relevant. I will not ask for more sensitive information than is needed at this stage. Alternatively, your GP or another health professional may send me your details when making a referral, or a parent, carer or trusted individual may provide your details when making an enquiry on your behalf. If you decide not to proceed, I will ensure that all personal data relating to your enquiry is deleted within one calendar month of being notified, unless I am required to retain it for legal, safeguarding, regulatory or professional reasons. If you would like me to delete this information sooner, please let me know.
While you are accessing therapy services
You can be reassured that what you discuss with me is confidential, subject to the limits explained in this privacy notice and in clause 9 of your signed Client Agreement Form. I may need to break confidentiality where there is a serious risk of harm to you or another person, where safeguarding concerns arise, where I am required or authorised to do so by law, where I need to prevent or detect a serious crime, or where disclosure is necessary in connection with a legal claim or professional complaint. I will always aim to speak with you about this first, unless safeguarding concerns, legal requirements or the urgency of the situation prevent me from doing so.
I will keep a record of your personal details to help my counselling services run smoothly. These details are kept securely on my Apple devices (MacBook Air and iPhone) using AES- 256-bit encryption. They are not shared with any third party, except where disclosure is required by law, for safeguarding purposes, or with your consent.
I will keep written notes of each session. These are stored in a Microsoft 365 Word document and are password-protected to provide an additional layer of security. I discuss my client work in regular clinical supervision, as required by professional good practice. Supervision helps me maintain safe, ethical and effective practice. I minimise identifying information wherever possible when discussing client work in supervision, and my supervisor is also bound by professional duties of confidentiality. Unless otherwise agreed in writing, I provide services to adults aged 18 and over. If I agree to work with a young person, I will explain how confidentiality, consent, parental responsibility, safeguarding and data protection will apply before the work begins.
Data Security
I take the security of the data I hold about you very seriously and make every effort to keep it secure in line with the UK GDPR, the Data Protection Act 2018, and the BACP Ethical Framework. Personal information and session notes are stored electronically on secure, password protected devices and systems, and are protected using appropriate technical and organisational measures (for example, encryption, strong passwords, access controls and secure backups). Where I use cloud or backup services, I choose providers with suitable security safeguards and enable multifactor authentication where available.
Duty of care to protect your data
Unfortunately, the transmission of information via the internet cannot be completely secure. I have security measures in place to protect your personal data, but I cannot guarantee the security of data transmitted to me electronically; any transmission is at your own risk. Once I have received your information, I will use my policies and procedures, as far as reasonably possible, to prevent unauthorised access.
Access to your personal data is restricted to me (the data controller) only, unless disclosure is required by law, for safeguarding purposes, or with your consent. I make every effort to ensure that appropriate technical and organisational measures are in place to protect your personal data against accidental loss, destruction, damage, alteration, unauthorised access or disclosure.
Data retention
I retain counselling and coaching records for 7 years after therapy or coaching has ended, unless a longer retention period is required for legal, safeguarding, regulatory, insurance or professional reasons. This retention period is intended to support continuity of care, accountability, safeguarding, professional standards and the handling of any legal or regulatory issues that may arise. After this period, records will be securely deleted where it is no longer necessary to retain them. For security reasons, I do not retain text messages or WhatsApp messages for longer than necessary. If relevant information is contained in a text message, WhatsApp message or email, I will transfer the relevant content to my encrypted client notes and password-protected client document, and then delete the original message or email when it is no longer needed.
Third-party Software
I use carefully selected third-party service providers to support my practice. Where a provider processes personal data on my behalf, I aim to ensure that appropriate data protection terms, confidentiality obligations and security arrangements are in place. Some providers may process or store data outside the UK. Where this happens, I rely on appropriate transfer safeguards required by data protection law.
Email:
I use a secure email service to send and receive email. Please note that email communication cannot be guaranteed to be completely secure, particularly where messages are sent to or received from providers outside the same secure system.
Website:
My website is hosted by a third-party provider. Personal data may be processed for website hosting, infrastructure, and enquiry-handling purposes.
Scheduling:
I use online scheduling and calendar tools to coordinate availability and appointment logistics. Appointment information may be processed for this purpose.
Cookies/contact forms:
My website may use essential cookies or similar technologies needed for the website to function. If contact forms are used, the information you submit will be processed for the purpose of receiving and responding to your enquiry. I will not use non-essential cookies or marketing technologies without providing appropriate information and, where required, obtaining consent.
Clinical notes and administration:
I use secure office and record-keeping systems for data collection, clinical note-taking, and general administration.
Video conferencing:
I use secure video-conferencing services to provide online counselling and coaching sessions where agreed. Session information may be processed for this purpose. I use appropriate security settings, such as passwords and waiting rooms where available, to help protect client confidentiality.
Accounting:
I use accounting software and professional accountancy support where necessary to manage my business records and financial obligations. Limited personal data, such as payment-related information, may be processed for this purpose.
CRM / email marketing:
I may use CRM and email marketing software to store limited contact details, including email addresses, for the purpose of managing communications and sending blog updates or practice news to people who have opted in. Consent can be withdrawn and you can unsubscribe at any time.
I review the third-party services I use from time to time to ensure they remain appropriate for the nature of my practice and the sensitivity of client information. I restrict the information shared with each provider to what is necessary for the relevant purpose.
Under data protection law, you have rights in relation to the personal information I hold about you. These rights include the right to be informed about how your information is used, the right to request access to your personal information, the right to ask for inaccurate or incomplete information to be corrected, the right to ask for your information to be erased in certain circumstances, the right to ask me to restrict how I use your information in certain circumstances, the right to object to processing in certain circumstances, and the right to data portability where this applies.
You also have the right not to be subject to a decision based solely on automated processing, including profiling. I do not use automated decision-making or profiling in relation to counselling or coaching clients.
You can make a request about your personal information verbally or in writing. I may need to ask you for information to confirm your identity before responding. I will usually respond within one calendar month of receiving your request. If your request is complex, or if I have received several requests from you, I may need longer to respond, but I will let you know if this applies.
Some rights are not absolute and may not apply in every situation. For example, I may need to retain certain information where this is required for legal, safeguarding, regulatory or professional reasons, or where it is necessary in relation to a legal claim. If I am unable to comply with your request, I will explain why, unless I am prevented from doing so by law. If you would like to exercise any of your data protection rights, please contact me using the contact details provided in this privacy notice.
Data Protection Complaints
