Privacy Statement
I take the privacy of personal data very seriously and have written this policy in line with the GDPR regulation (2018) and the Data Use and Access Act (2025) (DUAA). Further information regarding data handling can be sourced at: https://ico.org.uk/for-the-public/
The main principles of GDPR
Personal data must be:
Processed lawfully
Collected purely for specific and clearly stated legitimate purposes
Sufficient for purpose and limited to what is necessary for that purpose
Accurate and up to date
Stored only for the period of time that is necessary, and no longer
Processed and stored in a manner that ensures appropriate security of the personal data.
The term personal data applies to any identifiable information which is kept by me about you, which will be collected to help me to contact you to follow up from an initial enquiry, arrange or change session times and have valuable information in case of an emergency or crisis. This includes, but is not limited to:
Your phone number and text messages/call logs on my phone (stored using a code rather than your name),
Emails and your email address,
Forms which may be stored electronically or printed out to complete by hand. These will contain data such as name, address, phone number and email, next of kin/emergency contact, GP name and address, health information, medication and allergies and any additional notes you feel comfortable to share.
I keep very brief notes of our sessions. These are on paper and are stored securely and anonymously.
I will keep basic records and counselling notes for five years after our work has ended, or when I last heard from you. Paper notes will be shredded or burnt and any electronic communication including web forms, emails and text messages will be deleted.
Your name, telephone number and e-mail address may be stored electronically so that I can contact you with regard to arranging counselling sessions. I will not contact you for any other reason and will not pass your information onto third parties, unless there is a serious concern that you or somebody else is at risk of harm which requires a confidentiality breach or legal obligation, such as those relating to safeguarding, child protection or terrorism.
Part One: Your data protection rights
I process personal data about you in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the Data Use and Access Act (2025) (DUAA). This is the key information you may need to know.
Name of data controller: Ms Meriel Jenifer Whale
ICO registration number: ZA489230
Under UK data protection law, you have the following rights in relation to your personal data:
• Right of access: you can request a copy of the personal data I hold about you.
• Right to rectification: you can ask me to correct any inaccurate information.
• Right to erasure: in certain circumstances, you can ask me to delete your data.
• Right to restriction: you can ask me to restrict how I use your data while a concern is being investigated.
• Right to data portability: where processing is based on consent or contract, you can ask for your data in a portable format.
• Right to object: you can object to processing carried out on the basis of legitimate interests.
Data protection complaints
To raise a data protection concern, please contact me at merielwhale@protonmail.com. I will acknowledge your concern within 30 days and respond as promptly as possible. If your complaint is not resolved to your satisfaction or you remain dissatisfied, you have the right to raise a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. Please note that this covers concerns about data handling only, not about the therapeutic relationship or professional conduct.
Data breaches
In the unlikely event of a data breach affecting your information, I will assess the risk and, where required, report it to the Information Commissioner's Office and inform you directly without undue delay.
I do not share your information with any third parties except in the following situations:
• I may discuss your work in clinical supervision, in an anonymised form wherever possible.
• I may share your information with relevant professionals or authorities if I believe that you or another person is at risk of serious harm.
• I may share your information where required to do so by law.
• I will share your name and contact details with my clinical executor, so they may contact you in the event of my death or incapacity.
This notice forms part of my working agreement with you.