Data Protection and Privacy Policy

Effective date: Sept 2026
Last reviewed: 28 Oct 2026

1. Introduction

At Light and Shade, we are committed to protecting your privacy, maintaining confidentiality and handling your personal information with care, respect and professionalism.

This policy explains how we collect, use, store, protect and share personal information when you visit our website, contact us, enquire about counselling or receive counselling services.

We recognise that counselling may involve highly personal and sensitive information. We take appropriate steps to protect this information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

This policy also explains how we use artificial intelligence (AI), where applicable, and how we plan for continuity of care through professional arrangements, including a clinical will.

2. Who We Are

The data controller responsible for your personal information is:

• Light and Shade CCS Ltd
• Counsellor / practice owner: Joanne Gibson
• Contact email: Joannegibson@lightandshadeccs.co.uk
• ICO registration number: ZB886478

The data controller determines how and why your personal information is processed.

If you have questions about this policy or how your information is handled, please contact us using the details above.

3. What Information We Collect

Depending on your contact with us, we may collect the following information:

Personal and contact information

• Name, email address, telephone number and contact preferences.
• Information submitted through website forms or booking enquiries.

Counselling and clinical information

• Information you choose to share during counselling.
• Session notes, assessments, therapeutic goals and relevant correspondence.
• Information relating to your emotional wellbeing, mental health or physical health.
• Relevant safeguarding information and, where necessary, information about risk.

Administrative information

• Appointment records, cancellations, payment details and invoices.
• Records of consent, agreements and communications about your counselling.

Website information

• IP address, device information, website usage and cookie data, where collected.
• Information submitted through contact forms or other website features.

Health information and certain other sensitive information may constitute special-category personal data under the UK GDPR and receive additional protection.

4. How and Why, We Use Your Information

We process personal information for purposes including:

• Responding to enquiries and arranging appointments.
• Providing counselling and maintaining appropriate clinical records.
• Managing payments and administrative requirements.
• Maintaining professional standards, supervision and appropriate clinical governance.
• Managing safeguarding concerns and responding to emergencies where necessary.
• Meeting legal, regulatory, insurance and professional obligations.
• Maintaining website security and improving website functionality.
• Planning for continuity of care if the counsellor becomes unavailable.

We collect only information that is reasonably necessary for these purposes.

5. Our Lawful Basis for Processing

We identify an appropriate lawful basis for each processing activity. Depending on the circumstances, this may include:

• Contract: to arrange and provide agreed counselling services.
• Legitimate interests: to manage and protect the practice, where those interests are not overridden by your rights.
• Legal obligation: where processing is required by law.
• Vital interests: where necessary to protect someone’s life in circumstances permitted by law.
• Health or social care: where the relevant legal conditions for processing health information are met.
• Explicit consent: where appropriate and required for a particular activity, such as certain optional uses of sensitive information.

Because counselling involves sensitive information, an appropriate condition under Article 9 of the UK GDPR must also be identified when special-category data is processed. The relevant basis will depend on the nature and purpose of the processing.

We do not assume that consent is the lawful basis for every aspect of counselling record-keeping. Where we rely on consent, you may withdraw it, although this will not retrospectively invalidate processing carried out lawfully before withdrawal.

6. Confidentiality and Disclosure

Confidentiality is central to our counselling relationship.

We will not routinely share information about your counselling with third parties without an appropriate legal basis.

Information may be disclosed where:

• You have given valid consent.
• Disclosure is required by law or a court order.
• There is a serious concern about the safety or welfare of you or another person.
• Disclosure is otherwise legally justified and necessary for safeguarding or another recognised purpose.

Where practicable and appropriate, we will discuss a proposed disclosure with you before making it. This may not be possible where doing so could increase risk, prejudice an investigation or breach a legal obligation.

We share only information that is necessary and proportionate to the circumstances.

7. Use of Artificial Intelligence (AI)

We may use carefully selected AI-enabled tools to support limited administrative, website or professional tasks. The tools used, and the purposes for which they are used, will depend on the services actually adopted by the practice.

Potential uses may include:

• Drafting or improving general website content.
• Assisting with administrative correspondence.
• Organising non-identifying information.
• Supporting general professional learning or administrative efficiency.

Client confidentiality remains a priority. We will not enter identifiable client information, counselling session notes, case histories or other confidential clinical material into public or consumer AI tools unless the proposed processing has been appropriately assessed, is lawful, has suitable safeguards, and any required consent or other legal conditions have been satisfied.

We will not allow AI services to processes personal information on our behalf,

AI-generated material may be inaccurate, incomplete or misleading. Any AI-assisted material used in professional practice will be subject to appropriate human review. No client information is in put into any AI tool. The agency has a separate AI policy. Refer to the website.

AI will not replace the therapeutic relationship, professional judgement or the counsellor’s responsibility for clinical decisions. We will not use AI to make decisions about a client’s care that have legal or similarly significant effects where this would breach applicable data protection law.

AI will not be used to process your personal information in any way

You may contact us to ask whether AI is used in connection with your information and what safeguards apply.

8. Clinical Will and Continuity of Care

To support the welfare of clients and ensure appropriate professional continuity, the counsellor may maintain a clinical will or equivalent professional continuity plan.

A clinical will is an arrangement intended to guide appropriate action if the counsellor dies, becomes incapacitated or is otherwise unable to continue practising.

Depending on the circumstances and the arrangements in place, this may involve an appointed professional, executor, practice representative or other appropriately authorised person taking limited steps to:

• Inform relevant clients that counselling arrangements have changed or ended.
• Provide information about alternative support or referral options where appropriate.
• Identify and safeguard clinical records.
• Arrange the secure transfer, retention or disposal of records in accordance with applicable law and professional obligations.
• Address outstanding administrative matters and any necessary safeguarding concerns.

Any access to personal or clinical information under these arrangements will be restricted to what is necessary for the specific purpose and will be subject to appropriate confidentiality and security safeguards.

A clinical will does not give unrestricted access to counselling records. Information will only be disclosed or accessed where there is an appropriate legal basis, and the action is consistent with confidentiality obligations and applicable professional requirements.

We will take reasonable steps to ensure that records remain secure, accessible only to authorised persons and retained for the appropriate period if the practice closes or the counsellor is no longer able to practise.

9. How We Store and Protect Your Information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

Depending on the systems used, safeguards may include:

• Password-protected accounts and appropriate access controls.
• Secure electronic record-keeping systems.
• Encryption and secure data transmission where appropriate.
• Secure storage of paper records.
• Confidentiality arrangements with relevant service providers.
• Secure deletion and disposal procedures.
• Procedures for identifying and responding to data breaches.

No method of internet transmission or electronic storage can be guaranteed to be completely secure. However, we take reasonable and proportionate steps to protect your information.

10. Third-Party Services and Data Sharing

We may use trusted third-party providers for services such as website hosting, email, appointment booking, video counselling, payment processing, and IT support and our accountant.

Where these providers process personal information on our behalf, we will take appropriate steps to ensure that suitable data protection and confidentiality safeguards are in place.

We do not sell your personal information.

11. How Long We Keep Your Information

We retain personal information only for as long as necessary for the purposes for which it was collected, taking into account applicable legal requirements, professional guidance, insurance arrangements and the nature of the information.

Different retention periods may apply to:

• Counselling and clinical records.
• Enquiry and contact records.
• Appointment and financial records.
• Consent records and professional correspondence.
• Website analytics and technical logs.

Our retention arrangements will be documented and reviewed periodically. When information is no longer required, it will be securely deleted, destroyed or anonymised, unless a legal or other valid reason requires continued retention. Clinical notes are kept for 7 years after therapy ends, as per the ICO guidelines and our insurance provider. Children’s notes are kept for 7 years after their 18^th Birthday.

You may contact us for further information about the retention period applicable to your records.

12. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure of information where the legal requirements are met.
• Request restriction of processing in certain circumstances.
• Object to certain processing activities.
• Withdraw consent where processing is based on consent.
• Raise concerns about how your information is used. Please refer to the data protection complaints policy on the website.

These rights are not absolute. For example, some clinical records may need to be retained for legal, professional or safeguarding reasons, and certain information may be exempt from disclosure.

To exercise your rights, please contact Joanne Gibson. We may need to verify your identity before responding.

13. Cookies and Website Analytics

Our website may use essential cookies and, where applicable, analytics or other optional cookies to operate the website, understand its use and improve functionality.

Where required, we will request consent before using non-essential cookies or similar technologies. You can manage your preferences through our cookie settings, where available, or your browser settings.

14. Data Breaches

If a personal data breach occurs, we will assess the nature and seriousness of the incident and take appropriate steps to contain it, minimise harm and prevent recurrence.

Where required by law, we will notify the Information Commissioner’s Office (ICO) and affected individuals within the applicable timescales.

15. Complaints and Contact Details

If you have concerns about how your personal information is handled, please contact us in the first instance:

You also have the right to complain to the UK Information Commissioner’s Office (ICO).

Website: https://ico.org.uk/

We encourage you to raise concerns with us so that we can investigate and respond appropriately.

16. Changes to This Policy

We may update this policy to reflect changes in our practice, technology, professional obligations or applicable law.

The latest version will be published on our website, together with the date of the most recent update.

17. Important Information

This policy describes our intended approach to privacy and data protection. It should be read alongside any counselling agreement, confidentiality statement, consent documentation, safeguarding policy and relevant professional guidance.