Privacy Notice

Last updated: August 2026

This Privacy Notice explains how I collect, use, store and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

My handling of client information also reflects my professional responsibilities under the current BACP Ethical Framework for the Counselling Professions.

Data Controller

Natalie Wilkie
Counsellor, Psychotherapist and EMDR Therapist

Email: natalie@counselling-exeter.co.uk
Telephone: 07444 536080

I am the data controller responsible for personal information processed within my private practice.

I am registered with the Information Commissioner’s Office (ICO) and am an Accredited Counsellor with the British Association for Counselling and Psychotherapy (BACP).

Information Collected Through This Website

This website does not use contact forms, booking forms, user accounts or comment functionality.

If you contact me by email or telephone, I may collect personal information that you choose to provide, including:

• Your name
• Email address
• Telephone number
• Information relating to your enquiry

Please avoid sending sensitive personal or health information by email unless necessary, as ordinary email is not always a secure means of communication.

I use enquiry information to respond to you, discuss counselling, psychotherapy or EMDR services and, where appropriate, arrange appointments.

My lawful basis for processing initial enquiry information is normally legitimate interests, namely responding to enquiries about my professional services and administering my practice. Where processing is necessary in anticipation of entering into a therapy agreement with you, contractual necessity may also apply.

Client Information

If you become a client, I collect and process information reasonably necessary to provide counselling, psychotherapy and EMDR therapy safely and effectively.

This may include:

• Your name and contact details
• Date of birth where required
• GP or other relevant healthcare information
• Emergency contact details where appropriate
• Appointment and payment information
• Clinical and therapy records
• Information concerning your physical or mental health
• Risk and safeguarding information
• Relevant correspondence
• Signed agreements and consent records
• Psychological assessment or outcome-measure information where used
• Information required to meet professional, insurance, legal or regulatory obligations

Therapy records may contain special category personal data, particularly information concerning physical and mental health.

I recognise the particularly sensitive nature of this information and take appropriate steps to protect it.

I process client information where necessary for the provision and administration of therapy and the management of my professional practice. Depending upon the particular processing, my lawful basis may include performance of a contract, legitimate interests and/or compliance with a legal obligation.

Where I process special category personal data, I also ensure that an appropriate condition for processing such information applies.

Confidentiality and Sharing Information

Information disclosed during therapy is treated as confidential.

As part of safe and ethical practice, aspects of my clinical work may be discussed in professional clinical supervision. Wherever practicable, I do not use clients’ full names and identifying information is removed or minimised. My clinical supervisor is also bound by professional confidentiality and professional obligations.

Confidentiality cannot, however, be absolute.

There may be circumstances in which information needs to be shared, including:

• Where there is a serious risk of harm to you or another person
• Where child or vulnerable adult safeguarding concerns arise
• Where disclosure is required by law or an appropriate court order
• Where information can lawfully be disclosed in connection with the prevention, detection or investigation of serious crime
• Where I have another legal, professional or safeguarding responsibility requiring or permitting disclosure

Where appropriate, safe and legally permissible, I will aim to discuss a disclosure with you beforehand.

Where information is disclosed, I aim to share only information that is relevant, necessary and proportionate to the purpose.

I do not sell personal information or share it for third-party marketing purposes.

Clinical Records and Storage

I keep appropriate clinical and administrative records in accordance with my professional, legal, data protection and insurance responsibilities.

Electronic clinical records are stored securely using encrypted storage and appropriate access controls.

Where reasonably practicable, identifying information is separated from clinical information and initials, codes or other limited identifiers may be used.

Using initials or codes does not necessarily make information anonymous. Pseudonymised clinical information continues to be treated as confidential personal data.

I may also make paper process notes as part of my clinical work. Where practicable, these are identified using initials or codes rather than full identifying information and are stored securely.

Signed agreements and other paper documents requiring retention are kept in locked storage.

Specialist Clinical Systems

For some clients, I may use specialist clinical software where I consider this appropriate to support aspects of our therapeutic work.

This may include NovoPsych Psychometrics, which may be used to administer and record psychological questionnaires, clinical measures and outcome measures.

I may also occasionally use NovoNote, an AI-assisted clinical note-taking system, to support clinical record keeping. This may include dictating clinical notes or, in specific circumstances and following prior discussion and agreement with you, assisting with the recording, transcription or summarising of information from a therapy session.

I do not routinely record or transcribe therapy sessions. I will not intentionally record or transcribe a therapy session using an AI-assisted or specialist clinical system without discussing this with you beforehand and obtaining your agreement.

I remain responsible for your personal information. Where a specialist clinical service processes information on my behalf, it may act as a data processor.

I minimise identifying information entered into these systems wherever reasonably practicable. This may include using initials, codes or other limited identifiers rather than full identifying details.

I recognise that pseudonymised clinical information may still constitute personal data and continue to handle it accordingly.

Processing Outside the UK

NovoPsych Pty Ltd is based in Australia and provides NovoPsych Psychometrics and NovoNote.

Depending upon the particular service and data-location arrangements applicable to my account, information processed through these services may be stored or processed outside the United Kingdom, including in Australia.

NovoPsych states that its international data transfers are protected through appropriate mechanisms, including transfers to countries recognised as providing an adequate level of data protection and the use of contractual safeguards where required.

Where my use of a service involves a restricted transfer of personal information from the UK, I will take reasonable steps to ensure that an appropriate transfer mechanism or safeguard recognised under UK data protection law applies. This may include UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to recognised Standard Contractual Clauses, or another lawful transfer mechanism as applicable.

Where required, the relevant risks associated with the international transfer will also be considered in accordance with UK data protection requirements.

I periodically review the privacy, security and international data-transfer arrangements of third-party clinical systems that I use.

Further information about the current privacy and security arrangements of these services can be provided on request.

Recording or Transcription of Therapy Sessions

Therapy sessions are not routinely recorded or transcribed. I will not intentionally record or transcribe a therapy session using an AI-assisted or specialist clinical system without discussing this with you beforehand and obtaining your agreement.

If I propose to use a specialist system to record or transcribe all or part of a therapy session, I will discuss this with you beforehand.

I will explain why I am proposing its use and how the information will be processed so that you have an opportunity to ask questions before its use is agreed.

Where appropriate, I will seek your specific agreement before recording or transcribing a therapy session.

Where AI-assisted transcription or summarisation is used, I remain professionally responsible for reviewing the resulting clinical record and deciding what should appropriately form part of your record.

Temporary audio, transcripts or other intermediate material will not be retained by me for longer than necessary for their purpose unless there is a specific clinical, professional or legal reason to retain them.

AI-Assisted Tools

I may occasionally use AI-assisted tools for limited administrative or professional purposes, such as helping to organise information or assisting with the wording, structure or clarity of professional correspondence, letters or reports.

AI-assisted tools are not used as a substitute for therapy or my professional clinical judgement. I do not delegate clinical responsibility, autonomous risk assessment, diagnosis or decisions about a client’s therapy to an AI system.

I remain professionally responsible for reviewing the accuracy and appropriateness of any material produced with AI assistance.

When using an AI-assisted tool, I take steps to minimise the personal information involved.

Where it is practicable to do so, I use anonymised information when using general AI-assisted tools. Where full anonymisation is not practicable, I aim to provide only the minimum information reasonably necessary for the particular task and remove or minimise identifying information. I may use initials, codes or other pseudonyms where appropriate, but recognise that pseudonymised clinical information may still constitute personal data and therefore continue to treat it as confidential. I do not routinely provide general AI tools with information such as a client’s full name, address, telephone number, email address, full date of birth or case/claim reference number.

Where initials, codes or other pseudonyms are used, I recognise that clinical information may nevertheless remain personal data and treat it accordingly. I also aim to exclude unnecessary distinctive details that could make a client indirectly identifiable.

Where available, I use privacy settings designed to prevent client information provided for these purposes from being used to train general AI models.

Temporary AI conversations used for limited administrative or drafting purposes are deleted when I no longer require them, where deletion controls are available. Third-party providers may nevertheless have their own technical, security or legal retention periods.

I periodically review the privacy and security arrangements of AI-assisted services that I use.

Legal, Compensation and Third-Party Requests

There may be occasions when you, a solicitor, insurer, compensation body or another third party requests information or additional professional work.

Information will only be disclosed where there is an appropriate legal, professional or consent-based basis for doing so.

Where information is disclosed, I aim to provide only information that is relevant, necessary and proportionate.

Additional professional work such as preparing reports, formulations, chronologies, professional opinions or responses to specific questions may be chargeable separately in accordance with my Therapy Agreement and Terms & Conditions.

This is separate from your statutory right to access your existing personal information.

Police, Court and Statutory Requests

I do not automatically disclose therapy records simply because they have been requested by the police or another third party.

Requests from the police, courts or other statutory bodies are considered in accordance with my legal, ethical, safeguarding and data protection responsibilities.

Where appropriate, I may seek clarification about the purpose and legal basis of the request and the specific information required.

There may be circumstances in which I am legally required to disclose information, including in response to an appropriate court order or other legal requirement.

There may also be circumstances in which information can lawfully be shared without your consent, including certain safeguarding situations, the prevention, detection or investigation of serious crime or the protection of an individual from serious harm.

Where I have discretion about disclosure, I will consider whether it is necessary and proportionate.

Where appropriate and legally permissible, I will aim to discuss a disclosure with you.

Website Hosting and Technical Information

This website is hosted using WordPress.

The website and/or hosting provider may automatically process technical information such as IP addresses, browser and device information and server logs for security, reliability and operational purposes.

I do not use this information to identify individual visitors unless this is necessary for security or legal purposes.

Cookies

This website uses cookies necessary for its operation.

I do not intentionally use advertising or marketing cookies.

If the website’s use of cookies changes, this Privacy Notice and any necessary cookie information or consent arrangements will be updated accordingly.

Data Retention

I normally retain therapy records for six years following the end of therapy, in accordance with my professional, insurance and legal requirements.

After the relevant retention period, records are securely destroyed or deleted unless there is an appropriate legal, professional or insurance reason for retaining them for longer.

Enquiry information is retained only for as long as reasonably necessary.

Some financial and administrative records may need to be retained for different periods in order to meet legal, tax or business requirements.

Temporary working material does not necessarily need to be retained for the same period as the formal clinical record and will be securely destroyed or deleted when no longer required.

Your Rights

Under UK data protection law, you have rights in relation to your personal information.

Depending upon the circumstances, these may include:

• The right to access your personal data
• The right to request correction of inaccurate information
• The right to request erasure where applicable
• The right to request restriction of processing where applicable
• The right to object to certain processing
• The right to data portability where applicable

These rights are subject to conditions and exemptions and do not apply in every circumstance.

Subject Access Requests

You may request access to the personal data I hold about you by making a Subject Access Request (SAR).

A straightforward Subject Access Request will normally be provided without charge and within the timeframe required by data protection law.

I may need to confirm your identity before releasing information.

I may also need to review information and appropriately redact or withhold information where this is required or permitted by law, for example to protect another person’s rights.

A request does not become chargeable simply because I need to locate, retrieve, review or appropriately redact information in order to comply with a valid Subject Access Request.

There are limited circumstances in which data protection law permits a reasonable fee to be charged or a request to be refused or restricted.

A Subject Access Request is different from asking me to create a new report, therapeutic formulation, professional opinion, chronology or other professional material. Additional professional work may be chargeable in accordance with my Therapy Agreement and Terms & Conditions.

Data Security

I take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, inappropriate disclosure, alteration or destruction.

These include, where appropriate:

• Encrypted electronic storage
• Password and access controls
• Secure storage of paper records
• Locked storage for signed documents
• Data minimisation and pseudonymisation where practicable
• Careful selection and review of third-party services
• Secure destruction or deletion when information is no longer required

Complaints and Concerns

If you have concerns about how I have collected, used, stored, shared or otherwise handled your personal information, please contact me in the first instance so that I can investigate and respond.

You also have the right to raise a data protection concern or complaint with the Information Commissioner’s Office (ICO).

Concerns relating to my professional practice as a BACP member are separate from data protection complaints. I encourage you to raise concerns with me initially where appropriate. Clients may also have access to the applicable BACP Professional Conduct Procedure.

Changes to This Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in my practice, professional guidance, technology, third-party services or applicable law.

The current version will always be available on this website.

Last updated: August 2026