Data Protection & Privacy Policy

Kelly Tomlinson Counselling

1. Data Controller

‘Kelly Tomlinson Counselling’ is the data controller responsible for your personal information. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

2. What Data We Collect

We collect and process personal data including your name, contact details, date of birth, and special category data (health/mental health information) for the purpose of providing counselling services. This data is processed on the lawful basis of contract and, where applicable, explicit consent for special category health data under Article 9 UK GDPR.

3. How We Use Your Data

Your data is used solely to deliver and administer your counselling sessions, maintain clinical records, comply with our professional obligations (e.g. safeguarding duties), and — where required — liaise with supervising bodies. We will never sell your data or use it for marketing purposes.

4. Data Retention

Counselling records are retained for 7 years following the end of the therapeutic relationship, in line with professional guidance from BACP. Records are then securely destroyed.

5. Your Rights

You have the right to access, rectify, or erase your personal data; to restrict or object to processing; and to data portability, subject to applicable exemptions. To exercise any of these rights, please contact us using the details below.

6. Data Protection Complaints

Under the Data (Use and Access) Act 2025 (Section 164A, Data Protection Act 2018, in force 19 June 2026), you have a statutory right to raise a data protection complaint directly with us before escalating to the Information Commissioner’s Office (ICO).

If you have a concern about how we have handled your personal data, please submit your complaint in writing to: This email address is being protected from spambots. You need JavaScript enabled to view it.

• We will acknowledge your complaint within 30 days of receipt.
• We will investigate and provide a full response without undue delay.
• You will be kept informed throughout the process.

If you remain dissatisfied with our response, you may then escalate your complaint to the ICO at ico.org.uk or by calling 0303 123 1113.

7. Contact

Data Controller: Kelly Tomlinson
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.