Your privacy is extremely important to me. You can be confident that any personal information you share will be kept safe, secure, and used only for the purpose for which it was provided. I follow all relevant data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This privacy notice explains how I handle your personal information from your first point of contact through to after your therapy has ended. It outlines:

• Why I am able to process your information and the purposes for doing so
• Whether you are required to provide certain information
• How long your data is stored
• Who, if anyone, may receive your information
• Your rights under data protection law

If you have any questions about this policy, I’m happy to discuss them with you. You can contact email me at linda@thewhitelotus.co.uk

As the person who collects, stores, and manages your personal data, I act as the data controller. I am registered with the Information Commissioner’s Office (ICO), registration number ZC086461.

Initial Contact

When you get in touch to enquire about my counselling services, I collect only the information needed to respond to your enquiry. In some cases, your GP or another health professional may send me your details as part of a referral, or a parent or trusted individual may provide your information on your behalf.

If you choose not to proceed with counselling, all personal information will be deleted within one week of your confirmation. If you would prefer it to be deleted sooner, please let me know.

Duration of Therapy

Everything you share with me during counselling is confidential. I will only break confidentiality if you give your consent or if I am legally required to do so. I will always discuss this with you first wherever possible, unless safeguarding concerns prevent me from doing so.

This section outlines the categories of personal information collected and the purposes for which such information is processed

If you decide to work with me, I will need certain information to provide you with a safe and professional counselling service. This may include:

• Your name, address, and date of birth
• Details of anyone you live with
• Your occupation
• Your telephone number and your preferences for voicemail/text contact
• Your email address
• The name and surgery of your registered GP
• Any relevant current or previous health concerns
• Medication you are taking
• Details of any other health professionals involved in your care

If you are considering or currently receiving therapy, I process this information because it is necessary for delivering the service you have requested — in other words, for the performance of our contract.

Lawful Basis for processing your personal information

Data protection law requires that I have a lawful basis for processing your personal data. The basis depends on the stage of our work together:

• During or prior to therapy: I process your personal data because it is necessary for the performance of our contract.
• After therapy has ended: I rely on legitimate interest to hold and use your information.

GDPR require that any sensitive personal information you share during counselling is handled with the highest level of care. This type of information is known as special category personal information. I process this information on the basis of your explicit consent at the start of our work together.

After our sessions, I retain counselling records only when it is necessary to do so. The lawful basis for keeping these records is the legitimate need to reference them in the future for the purpose of defending against potential legal claims. Records are stored securely and accessed only when required for this specific purpose.

Following Completion of Therapy

Your counselling records will be stored securely for five years following completion of our work together (for younger clients, records are held for five years after your eighteenth birthday), in line with my insurance requirements. After this time, they will be permanently destroyed.
If you would prefer your information to be deleted sooner, please let me know.

Data Sharing with Third Parties

Your personal data is not routinely shared with third parties. However, limited information may appear on documents such as on bank statements if you pay by bank transfer. I take all reasonable steps to ensure that any third parties involved in handling your data are compliant with data protection legislation.

Your Rights

I aim to be as open and transparent as possible. Under data protection law, you have the right to:

• Request access to the personal information I hold about you
• Ask me to correct any inaccuracies
• Ask me to delete your information
• Request restrictions on how your data is used
• Object to certain types of processing

More details about your rights can be found at ico.org.uk/your-data-matters.

If I hold information about you, I will:

• Explain what I hold and where it came from
• Tell you why I am storing it and for how long
• Tell you who it may be disclosed to
• Provide a copy in an understandable format

To make a request, please write to linda@thewhitelotus.co.uk

If you have concerns about how your data has been handled, please contact me using the details above. I welcome any suggestions for improving my data protection practices.

If you wish to make a formal complaint, you can contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Data Security

I take the security of your data very seriously. Your personal details are stored securely on password‑protected devices (phone and laptop) and are never shared with any third party.

I also keep brief written notes of each counselling session. These are stored separately in a locked filing cabinet to ensure your confidentiality and safety.