Privacy Policy

How I handle your information

These documents explain how Lisa Hopcroft Counselling collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.

Privacy Policy

Last updated: 13 June 2026

1. Who I am

Lisa Hopcroft Counselling is a private therapy practice based in the UK. I am Lisa Hopcroft, a qualified counsellor providing therapeutic services to children, young people, and adults.

Contact email: lhopcroftcounselling@gmail.com

ICO registration number: ZB597581

You can verify my registration on the ICO register at ico.org.uk.

Website:https://www.lisahcounselling.co.uk/

Compliance information:https://lisahopcroftcounselling.policydiary.co.uk

2. What personal data I collect

When you work with Lisa Hopcroft Counselling, I may collect and process the following types of personal data:

Contact and identification information:

  • Your name, address, telephone number, and email address

  • Emergency contact details

  • For clients under 18: parent or guardian contact details

Health and therapy-related information:

  • The reasons you are seeking therapy (presenting issues)

  • Relevant medical history and current medications

  • Information about your mental health and emotional wellbeing

  • Session notes documenting our therapeutic work together

  • Risk assessments and safety plans where appropriate

  • For young clients: relevant school or educational information, family circumstances

Administrative information:

  • Appointment dates and times

  • Payment records and invoices

  • Correspondence between us

Important notice about special category data:

Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This includes any information about your physical or mental health. Because this data is particularly sensitive, it receives enhanced legal protection, and I take extra care to keep it secure.

Website enquiries:

If you contact me through my website, I collect your name and email address when you submit the contact form. This website runs with SquareSpace, and any installed plugins may process personal data. The website is built on SquareSpace, which may collect certain technical data about visitors including basic analytics.

3. How I collect your data

I collect personal data directly from you in the following ways:

  • At first contact: When you telephone, email, or use the website contact form to enquire about therapy

  • During intake: When you complete assessment forms or provide information at our initial session

  • During therapy sessions: Through our conversations and therapeutic work together

  • Via ongoing communication: Through emails, telephone calls, or messages between sessions

For clients under 18:

I may also collect information from parents or guardians during the consent process and throughout therapy where appropriate. In some cases, with your consent, I may receive relevant information from schools or other professionals involved in your care.

4. Why I process your data — lawful basis

Under UK data protection law, I must have a valid legal reason (known as a "lawful basis") to process your personal data. Because therapy involves health-related information, I need two separate legal bases:

Article 6 basis — why I can process your personal data generally:

Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.

This means I need to process your data to provide the therapy services you have requested. Without this information, I would not be able to offer you safe and effective therapeutic support.

Article 9 basis — why I can process your health data specifically:

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes). This processing is carried out by a qualified counsellor subject to a professional duty of confidentiality.

Special considerations for clients under 18:

For children and young people, I will obtain appropriate consent before therapy begins:

  • Children aged 16 and 17: Can generally consent to their own therapy

  • Children under 16: May be able to consent to their own therapy if they demonstrate sufficient understanding and maturity to make this decision (known as "Gillick competence"). This is assessed individually.

  • Where a child cannot consent independently: A parent or guardian with parental responsibility will provide consent on their behalf

Even where a parent provides consent for therapy, the child or young person remains the data subject. This means their rights under data protection law belong to them, not their parents.

5. Professional obligations and supervision

I am required by my professional body to attend regular clinical supervision. Supervision helps me reflect on my therapeutic work and ensures I am providing you with the best possible care.

When I discuss my work with my supervisor:

  • Your name and any identifying details are not shared with my supervisor

  • I use anonymised or pseudonymised case material only — this means I change or remove any information that could identify you

  • My supervisor is a qualified professional bound by the same confidentiality obligations as I am

  • My supervisor is also bound by their own professional body's ethical framework

Supervision is a confidential professional space, and the same care I take with your information applies to how my supervisor handles any material I share with them.

6. Clinical will — what happens to your records if I am unable to practise

I am currently putting clinical will arrangements in place. A clinical will ensures that if I become suddenly unable to practise due to serious illness, incapacity, or death, there is a trusted professional who can:

  • Securely manage and eventually destroy your records

  • Contact you to let you know what has happened (without revealing you are a therapy client to anyone else)

  • Provide referral information if you need ongoing support

Once these arrangements are finalised, I will update this policy and inform you of the details.

7. Who I share your data with

I take your confidentiality seriously and keep the sharing of your data to an absolute minimum.

Clinical supervision:

As explained above, I share anonymised case material with my clinical supervisor. Your name and identifying details are never disclosed.

Third-party service providers:

I use the following third-party services which may process your data:

  • SquareSpace— the company that built and hosts my website

  • Google Meet — for online therapy sessions

Each of these services is bound by a data processing agreement or equivalent contractual terms. I can provide links to their privacy policies on request.

I never sell your personal data.

When I may need to share your information without consent:

In rare circumstances, I may need to share your information with external agencies such as safeguarding services, the police, or medical professionals. I explain these circumstances in Section 12 (Confidentiality exceptions) below.

8. International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

  • SquareSpace

  • Google Meet (Google LLC, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards. These are legal mechanisms approved under UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision, which is why these additional safeguards are necessary.

You can request a copy of the relevant transfer safeguards by contacting me at lhopcroftcounselling@gmail.com

9. How long we keep your data

I keep your data only for as long as necessary. The retention periods below reflect legal requirements and my professional obligations:

Therapy records (adult clients):

7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

Therapy records (clients under 18 at the time of therapy):

Until the client reaches the age of 25. This extended period ensures that young people have the opportunity to access their records as adults, and accounts for the longer limitation period that applies to claims involving minors.

Financial records:

6 years, as required by HMRC.

Website enquiries (non-clients):

12 months from the date of your enquiry. If you do not become a client, I will securely delete your contact details after this period.

How records are destroyed:

At the end of the applicable retention period:

  • Paper records are shredded using a cross-cut shredder

  • Electronic records are permanently deleted using secure deletion software

10. Your rights under UK GDPR

You have the following rights regarding your personal data. These rights apply to all clients, including children and young people:

The right to be informed: You have the right to know how I collect and use your personal data. This privacy policy fulfils that obligation.

The right of access: You can ask for a copy of the personal data I hold about you. This is known as a "subject access request." Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information.

The right to rectification: If any of your personal data is inaccurate or incomplete, you can ask me to correct it.

The right to erasure: In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I need to keep records to comply with professional guidelines or insurance requirements.

The right to restrict processing: You can ask me to limit how I use your data in certain situations, for example while I am investigating a complaint.

The right to data portability: In some cases, you can ask me to transfer your data to another organisation in a commonly used electronic format.

The right to object: You can object to certain types of processing, although this is unlikely to apply to therapy records processed under the contract basis.

Rights related to automated decision-making: I do not use automated decision-making or profiling in my practice.

Special note for parents of clients under 18:

The child or young person is the data subject, which means these rights belong to them. If a parent requests access to a child's therapy records:

  • For children who gave their own consent (Gillick competent): The child's permission is generally required before records can be shared with parents

  • For younger children: I will consider what is in the child's best interests before releasing any information to parents

  • In all cases, I will consider safeguarding implications before sharing records

To exercise any of these rights, please contact me at lhopcroftcounselling

11. Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take any concerns about how I handle your data seriously and will respond promptly.

To make a complaint:

  • Email me at lhopcroftcounselling@gmail.com

I aim to respond to complaints within 28 days.

If you are not satisfied with my response:

You have the right to escalate your complaint to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Telephone: 0303 123 1113

  • Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12. Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are limited circumstances where I may need to share information without your consent:

Risk of serious harm: If I believe you or someone else is at immediate risk of serious harm, I may need to contact emergency services or other appropriate professionals.

Safeguarding concerns: If I become aware of concerns about the safety or welfare of a child or vulnerable adult, I have a legal and ethical duty to share this information with relevant safeguarding agencies. Given that I work primarily with children and young people, I take safeguarding responsibilities particularly seriously.

Court order: If a court orders me to disclose information, I am legally required to comply.

Terrorism-related concerns: Under the Terrorism Act 2000, I am required to report any information relating to suspected terrorism.

In all cases:

I will always try to discuss the situation with you first, unless doing so would itself put someone at risk. Where possible, I will tell you what information I need to share and with whom.

13. Changes to this policy

I review this privacy policy annually and whenever my practices change significantly.

Data Retention Policy

Lisa Hopcroft Counselling

Last updated: 13 June 2026

Introduction

This policy explains how long I keep personal information about clients and enquirers at Lisa Hopcroft Counselling, why I keep it for those periods, and how I dispose of it securely when it is no longer needed.

I am committed to keeping your information only for as long as necessary and to disposing of it safely and confidentially when the retention period ends.

Why I Retain Your Data

I keep records of our therapeutic work and related information for several important reasons:

  • Legal obligations — certain records must be kept to comply with UK law, including tax and accounting requirements

  • Professional standards — as a counsellor in private practice, I am expected to maintain adequate records to support the quality of care I provide

  • Insurance requirements — professional indemnity insurance requires me to retain records in case a legal claim is made at a later date

  • Your ongoing care — if you return to therapy after a break, having access to previous notes supports continuity of your care

  • Safeguarding — particularly when working with children and young people, records may be needed to support safeguarding processes

Retention Periods

Type of Record Retention Period ReasonTherapy records (adult clients)7 years after our last session line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Therapy records (clients under 18 at time of therapy)Until the client reaches the age of 25, or 7 years after our last session — whichever is longer This extended period allows young people to access their records as adults and accounts for the longer limitation period for claims by minors

Enquiry and contact form data (non-clients)12 months from last contact To allow reasonable time for you to decide whether to begin therapy

Website contact form submissions 12 months, unless you become a client If you become a client, your enquiry becomes part of your client record

Financial records and invoices 6 years from the end of the financial year HMRC legal requirement

Insurance records 7 years To support any insurance claims or queries

Contracts and consent forms Same period as the associated therapy records These form part of your client file

A Note on Retention for Clients Under 18

As my practice works primarily with children and young people, I want to be clear about why I retain records for longer when therapy took place during childhood:

  • Legal claims — under the Limitation Act 1980, a young person has until their 21st birthday (or later in some circumstances) to bring certain legal claims. Retaining records until age 25 ensures I can respond to any such claim.

  • Access requests — as a young person matures, they may wish to access their therapy records to understand their own history. Keeping records until age 25 allows this.

  • Safeguarding continuity — if safeguarding concerns arise later, historical records may be important.

What I Retain

The records I keep typically include:

  • Contact details — your name, address, telephone number, email address

  • Emergency contact information — details of someone I can contact in an emergency

  • Session notes — my written records of our therapy sessions

  • Consent and agreement forms — including parental or guardian consent where applicable

  • Assessment and intake information — initial information you provided when starting therapy

  • Correspondence — emails, letters, or messages between us relating to your therapy

  • Payment records — invoices and records of payments received

  • Safeguarding records — any records relating to safeguarding concerns or disclosures

How Your Data Is Stored

I keep both electronic and paper records. All records are stored securely:

Electronic records:

  • Stored on encrypted, password-protected devices

  • Access restricted to me only

  • Regular security updates applied

Paper records:

  • Kept in a locked filing cabinet

  • Located in a secure room

  • Access restricted to me only

Supervisor access: My clinical supervisor receives anonymised case material only as part of my professional development and to ensure I provide you with the best possible care. They do not have access to your name or identifying details.

Clinical Will Arrangements

I am currently putting arrangements in place for a clinical will — this is a plan for what happens to client records if I become unable to continue practising due to serious illness, incapacity, or death.

Once these arrangements are finalised, I will update this policy and inform current clients. This ensures your records will be handled appropriately and confidentially in any circumstances.

Your Right to Erasure

Under UK GDPR, you have the right to request that I delete your personal data. However, this right is not absolute.

I may need to decline or partially decline an erasure request where:

  • I am required to keep records by law (for example, financial records for HMRC)

  • Retention is necessary for the establishment, exercise, or defence of legal claims

  • Retention is required to meet professional standards expected of counsellors in private practice

If I cannot fully comply with an erasure request, I will always explain my reasons clearly and in writing. I will delete any data that is not subject to these restrictions.

Secure Disposal

When the retention period ends, I dispose of your records securely:

Paper records:

  • Shredded using a cross-cut shredder

  • Disposed of confidentially

Electronic records:

  • Permanently deleted using secure deletion software

  • Deleted from all devices and backup systems

I keep a confidential log of when records are destroyed, without recording any personal details.

Changes to This Policy

I may update this policy from time to time to reflect changes in law or my practice.

Questions or Complaints

If you have any questions about how long I keep your data or how I dispose of it, please contact me:

Lisa Hopcroft Email: lhopcroftcounselling@gmail.co.

If you are unhappy with how I have handled your data, you have the right to complain to the Information Commissioner's Office (ICO):

Website: https://ico.org.uk Telephone: 0303 123 1113

My ICO registration number is ZB597581.

GDPR Statement

Last updated: 13 June 2026

Our Commitment to Your Privacy

At Lisa Hopcroft Counselling, I believe that protecting your personal information is an essential part of the trust we build together in therapy. Privacy isn't just a legal requirement — it's fundamental to creating a safe space where you can speak openly. This statement explains, in straightforward terms, how I look after your information.

What Information I Collect

When you work with me, I may collect and keep the following information:

  • Your name and contact details (address, phone number, email)

  • Emergency contact information

  • Details about what brings you to therapy (your presenting issues and concerns)

  • Session notes recording our work together

  • Relevant medical or health history that helps me support you effectively

  • Payment information (for invoicing and record-keeping)

If you are under 18, I will also hold details of your parent or guardian who has given consent for our work together.

Why I Collect Your Information

I need to collect and use your personal information so that I can provide you with therapy. The legal reasons that allow me to do this are:

For general personal data: Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. In plain terms, I need your information to fulfil our agreement that I will provide therapy to you.

For health-related information: Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional DPA 2018 Schedule 1 condition is Part 1, paragraph 2 (health or social care). This recognises that therapy involves sensitive information about your mental and emotional health, and allows me to process it responsibly as a qualified counsellor bound by professional confidentiality obligations.

Professional Obligations and Supervision

As part of maintaining professional standards, I discuss my work in clinical supervision. This is standard practice for counsellors and helps ensure I provide you with the best possible support.

Your identity is protected: I do not share your name or any identifying details with my supervisor. My supervisor receives anonymised case material only — meaning they hear about therapeutic themes and my approach, not about you as an individual. My supervisor is bound by their own professional body's confidentiality obligations.

Clinical Will Arrangements

I am currently putting arrangements in place for a clinical will — a plan that ensures your records are handled respectfully and confidentially should I become unexpectedly unable to continue practising. Once these arrangements are finalised, I will let you know how this works. The person appointed will be bound by strict confidentiality and will only contact you to let you know about the situation and discuss your records.

Working with Under-18s: Information for Young People and Parents

My practice works primarily with children and young people, so it's important to be clear about how I handle information in these circumstances.

Consent

For children under 13, I require consent from a parent or guardian before therapy can begin. For young people aged approximately 13–16, I assess whether they have sufficient understanding to consent to therapy themselves (sometimes called "Gillick competence"). This means a young person who fully understands what therapy involves may be able to consent on their own behalf. I discuss this openly with families at the start of our work.

Who the information belongs to

Even when a parent has given consent for therapy, the child or young person is the "data subject" — meaning the information belongs to them, not to their parent. This is important because:

  • If a parent requests to see their child's therapy records, I cannot automatically share these. I must consider the young person's own wishes and what is in their best interests.

  • As young people mature, their right to control their own information grows.

I always try to support open communication between young people and their families, but the young person's confidentiality and trust remain my priority.

How long I keep records for under-18 clients

If you were under 18 when we worked together, I keep your records until you reach the age of 25 or for 7 years after our last session — whichever is longer. This extended period ensures you can access your records as an adult if you wish to.

Who Else May See Your Information

Beyond myself, your information may be seen by:

  • My clinical supervisor — anonymised case material only, with no identifying details

  • Service providers who help run my practice:

    • SquareSpace- website management

    • Google Meet — if we have online sessions together

  • Statutory authorities — only where I am legally required to share information (see below)

Some of these services (WordPress and Google Meet) are provided by companies based in the USA. Where data is transferred outside the United Kingdom, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR and the Data (Use and Access) Act 2025. You can request a copy of the relevant transfer safeguards by contacting me.

When I Might Need to Break Confidentiality

Everything you share with me is confidential, with some important exceptions. I may need to share information without your consent if:

  • I believe there is a serious risk of harm to you or someone else

  • I have safeguarding concerns about a child or vulnerable adult

  • I receive a court order requiring me to release information

Wherever possible, I will discuss this with you first and explain what I need to do and why. Breaking confidentiality is always a last resort.

How Long I Keep Your Records

For adult clients: I keep your records for 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

For clients who were under 18: I keep your records until you reach the age of 25, or for 7 years after our last session — whichever is longer. This ensures you can request access to your records once you become an adult.

How records are stored and disposed of:

  • Electronic records are encrypted and password-protected

  • Paper records are kept in a locked filing cabinet in a secure room

  • Only I have access to your records

  • At the end of the retention period, paper records are shredded and electronic records are permanently deleted using secure deletion software

Your Rights

You have rights over your personal information. In plain terms, you can:

  • See your records — ask me for a copy of what I hold about you

  • Correct errors — if something is inaccurate, let me know and I'll put it right

  • Request deletion — in some circumstances, you can ask me to delete your information. However, I may need to keep certain records for legal or insurance reasons, even if you'd prefer I didn't. I'll always explain why if this applies.

  • Restrict or object to processing — you can ask me to limit how I use your information in certain situations

  • Data portability — receive your information in a format you can take elsewhere

If you're under 18, these rights belong to you — though depending on your age and understanding, your parent or guardian may exercise them on your behalf.

Making a Complaint

If you're unhappy with how I've handled your information, please speak to me first. I take concerns seriously and will do my best to resolve them.

You can contact me at: lhopcroftcounselling@gmail.com

Under the Data (Use and Access) Act 2025, you also have the right to complain directly to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Telephone: 0303 123 1113

Lisa Hopcroft Counselling ICO Registration: ZB597581 Website: https://www.lisahcounselling.co.uk/

Cookie Policy

Last updated: 13 June 2026

What are cookies

Cookies are small text files that websites place on your device when you visit. They help websites work properly and can remember your preferences. Some cookies are deleted when you close your browser (session cookies), while others remain on your device for longer (persistent cookies).

Cookies we use

Essential cookies (strictly necessary)

These cookies are necessary for the website to function and cannot be switched off. They do not store any personally identifiable information. Essential cookies include those that:

  • Keep the website secure

  • Remember your cookie preferences

  • Enable basic website functionality

Consent is not required for essential cookies because the website cannot work properly without them.

Statistical and analytics cookies

We do not currently use any analytics or statistical cookies on this website.

Advertising and tracking cookies

We do not use any advertising or tracking cookies on this website.

Third-party cookies

This website is built using SquareSpace who may set cookies to collect basic technical data about how visitors use the website. This helps ensure the website works properly.

We do not control the cookies set by these third parties. You can find more information about their cookie practices in their respective privacy policies.

How to opt out or manage cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

  • View what cookies are stored on your device

  • Delete cookies individually or all at once

  • Block cookies from specific websites

  • Block all cookies from being set

  • Set your browser to notify you when a cookie is being placed

Please be aware that blocking essential cookies may affect how this website functions.

Browser-specific instructions:

  • Chrome: Settings > Privacy and security > Cookies and other site data

  • Firefox: Settings > Privacy & Security > Cookies and Site Data

  • Safari: Preferences > Privacy > Manage Website Data

  • Edge: Settings > Cookies and site permissions

For more detailed guidance on managing cookies, visit www.aboutcookies.org.

Cookie consent

We do not currently use a cookie consent tool on this website. This is because we only use essential cookies that are strictly necessary for the website to function, and the Data (Use and Access) Act 2025 confirms that consent is not required for these cookies.

If we introduce any cookies that require your consent in the future (such as advertising or tracking cookies), we will implement an appropriate consent mechanism and update this policy.

Your rights

Under UK data protection law, including the Privacy and Electronic Communications Regulations (PECR) as amended by the Data (Use and Access) Act 2025, you have the right to:

  • Know what cookies are being used and why

  • Opt out of statistical cookies at any time without affecting website functionality

  • Refuse or withdraw consent for non-essential cookies

  • Manage cookies through your browser settings

Updates to this policy

We will update this cookie policy if our use of cookies changes. Any significant changes will be noted with a new "last updated" date at the top of this page.

Contact

If you have any questions about how we use cookies, please contact me:

Lisa Hopcroft Lisa Hopcroft Counselling

Email: lhopcroftcounselling@gmail.com

Website: https://www.lisahcounselling.co.uk/

ICO registration number: ZB597581

How to control or opt out of cookies

This website does not use advertising or tracking cookies. Only essential cookies needed for the site to function are used. You can still control or clear cookies through your browser settings at any time.

Browser controls: All major browsers let you block or delete cookies. See instructions for Chrome, Firefox, Safari, and Edge.