top of page

Privacy Policy

Image by Annie Spratt

Privacy policy

HKR Counselling | Helen Robertson Owner contact: hkrcounselling@gmail.com ICO registration: ZA807433 Last updated: 25 June 2026

Your privacy matters to me. This policy explains what personal information I collect when you visit hkrcounselling.com or engage my counselling services, how I use it, and what rights you have.

I am the data controller for the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What personal data I collect

I may collect the following:

  • Contact details: name, address, email address, and phone number

  • Health and wellbeing information shared during sessions or intake

  • GP details

  • Session notes (coded with your initials and date of first session)

  • Communications: emails, text messages, and voicemails

Health and wellbeing information is special category data under UK GDPR. I treat it with additional care and collect it only where necessary to provide my counselling service.

Why I collect it and the legal basis

I process your personal data under the following lawful bases:

Performance of a contract (Article 6(1)(b)): to register you as a client and deliver the counselling service we have agreed.

Legal obligation (Article 6(1)(c)): where the law requires me to retain or share information.

Legitimate interests (Article 6(1)(f)): to manage my practice, respond to enquiries, and keep appropriate records.

For special category (health) data, I rely on Article 9(2)(h) of the UK GDPR: processing necessary for the provision of health or social care treatment by a professional subject to a duty of confidentiality.

How I use your data

I use your personal data only to provide my counselling service and to communicate with you about it. I will not share your details with any other person or organisation without your knowledge and consent, except where required by law.

If there is a safeguarding concern, or a perceived risk of harm to you or another person, I may share relevant information with appropriate third parties. I will always aim to discuss this with you first unless doing so would put someone at risk.

Third parties who process your data

Microsoft processes emails sent to or from my Gmail account and is subject to its own privacy policies. I recommend that you do not share sensitive personal information by email.

I also use [cloud storage provider] to store client records securely. A data processing agreement is in place with this provider.

How long I keep your data

Type of dataRetention period

Session notes7 years from your last session, then securely shredded

Contact details7 years from your last session, stored separately from your notes

Emails, texts, and voicemailsUp to 7 days after your sessions end, then deleted

I may retain data beyond these periods in the event of a complaint or dispute.

How I keep your data secure

All electronic devices that hold personal data are password protected and stored securely. I take reasonable steps to prevent loss, theft, unauthorised access, disclosure, copying, or modification of your information.

Your rights

Under UK data protection law, you have the right to:

Access: request a copy of the personal data I hold about you.

Rectification: ask me to correct inaccurate or incomplete data.

Erasure: ask me to delete your data in certain circumstances, unless I have a legal obligation to retain it.

Portability: request that I transfer data I hold about you to another organisation.

Restriction: ask me to limit how I use your personal data.

Object: challenge certain types of processing, including direct marketing.

Automated decision-making: request a review if you believe automated processing has been applied incorrectly.

Be informed: receive clear information about how I collect, use, and store your data. This policy fulfils that right.

To exercise any of these rights, please contact me at hkrcounselling@gmail.com. I may need to verify your identity before I can respond.

How to raise a complaint

If you have a concern about how I handle your personal data, please contact me directly at hkrcounselling@gmail.com.

Here is what will happen:

  1. I will acknowledge your complaint within 30 days of receiving it.

  2. I will investigate the matter and keep you informed throughout.

  3. I will let you know the outcome without unnecessary delay.

If you are unhappy with my response, or if you would prefer to go straight to the regulator, you have the right to make a complaint to the Information Commissioner's Office (ICO):

Cookies

Please see my separate cookie policy for information on how this website uses cookies.

Changes to this policy

I reserve the right to update this policy at any time. The date at the top of this page will always reflect when it was last reviewed. Your continued use of this website after any changes constitutes acceptance of the updated policy.

Acceptance

By engaging my counselling services, you confirm that you have read and understood this policy and that you consent to your personal information being collected, stored, and used as described here.

bottom of page