Counselling by Nicola Stewart

 

As BACP accredited counsellor I adhere to the 'Ethical Framework for the Counselling Professions 2026' which commits members to uphold ethical principles, work ethically within all relationships and demonstrate core principles when working with clients. 

 

The Framework (as adopted from 3rd November 2026) 3.1 states counsellors will 'Protect the confidentiality and privacy of those accessing our services'.  Client confidentiality and the prevention of unauthorised disclosure of information that could identify a client is therefore an obligation for all practitioners.

 

In light of the Data Protection Act (2018) and the UK General Data Protection Regulation (UK GDPR 2021) I have prepared this statement for my clients, as their contractor.  This statement sets out how I handle the information of my clients.   I am registered with the ICO. ZA316034.

 

 

Description of processing

 

The following is a broad description of the way I process your personal information. To understand how your own personal information is processed you may need to refer to any personal communications you have received, check any privacy notices that I may have provided.

 

 

Reasons/purposes for processing information

 

I process personal information to enable me to provide mental health counselling, to advertise my services, to maintain my records.    

 

 

Type/classes of information processed

 

I process information relevant to the above reasons/purposes. This information may include:

• personal details

• family, lifestyle and social circumstances

• employment and education details

 

 

I also process sensitive classes of information that may include:

 

• physical or mental health details

• racial or ethnic origin

• religious or other beliefs of a similar nature

 

Who the information is processed about 

 

I process personal information about my

• clients

• suppliers

• business contacts

• professional advisers

 

 

Who the information may be shared with

 

I sometimes need to share the personal information I process with the individual them self (as a SAR) or with other organisations. This is only done with explicit consent.  The only exception to this is if I feel my client is at risk of significant harm and I have a duty of care to share this concern with the relevant body.  Where this is necessary I am required to comply with all aspects of the Data Protection Act (DPA). What follows is a description of the types of organisations I may need to share some of the personal information I process with for one or more reasons.

 

Where necessary or required I may share information with:

• healthcare professionals

• social and welfare organisations 

• central government

• business associates

• service providers

• Local Safeguarding Children Board

• educators

​

Supervision and consultation 

Client information may be discussed in supervision or consultation, with identifying details anonymised and with confidentiality protected.

 

Clinical will and continuity

In the event I am unable to practice due to illness or my own death I have in place a Clinical Will to ensure my clients are advised and support/signposting offered.  My Clinical Executor is a nominted BACP accredited Clinical Supervisor and Counsellor.
 

 

 

On termination of school contracts I will:

 

• return all information pertaining to the contract services

• destroy files relating to client contact details

 

 

I confirm I am fully responsible for:

 

• making sure I comply with the Data Protection Act

• being trained in how to handle personal information

• When collecting personal information, I tell people how I will use it

• Having a process in place so I can respond to requests for the personal information I hold (with some exceptions/redaction of client notes, which are subject to confidentiality)

• Keep records of people's personal information up to date and don't keep it longer than necessary (6 years after termination of contract)

• I have measures in place to keep the personal data I hold safe and secure.

 

 

 

Working with children

 

When working with children my privacy notices are clear, and presented in plain, age-appropriate language.  I hold a full clear enhanced portable DBS certificate. 001785140214

 

I use child friendly ways of presenting privacy information, such as: diagrams, cartoons, graphics and videos, dashboards, layered and just-in-time notices, icons and symbols.

 

I explain to parents that the information I collect will enable me to offer counselling services to children and why I require the personal data I have asked for.  I will never share this data with a third party unless the child is considered at risk, in this case I will share this information with the Local Safeguarding Team in line with my Safeguarding Policy. This is explained to parents and children at the start of our work together.  Data collected regarding a child referred for counselling will be held at my Private Practice in a secure environment and not shared with any other party without explicit consent of parents.

​

 

Use of Digital Resources and Artificial Intelligence (AI)

 

I may use online search engines, digital resources and AI-assisted tools and search engines that incorporate AI-generated responses, to support general professional research, the development of therapeutic and psychoeducational resources, and reviews of professional guidance, ethical standards and practice compliance.

​

I do not use AI tools to create, analyse or summarise individual clients’ clinical notes, counselling sessions or case material and I do not input identifiable client information or confidential client disclosures into public AI tools or search engines. 

​

I take reasonable steps to ensure that my use of digital resources is consistent with applicable data protection legislation and my professional and ethical responsibilities, including the BACP Ethical Framework.

 

 

My website

 

The contact page of my website collects the enquirers email address and enquiry type. This information is emailed to me and I will respond to enquiry.  I will not pass your contact details to any third party.  This website is hosted by Wix.com - see their privacy statement here including their cookie policy.

 

Links to other websites

 

My website contains links to other websites run by other organisations. This privacy policy applies only to my website‚ so I encourage you to read the privacy statements on the other websites you visit. I cannot be responsible for the privacy policies and practices of other sites even if you access them using links from this website.

​

 

Payments

​

Payments for services are made through a third party company 'Stripe' - their privacy policy can be viewed here.

​

​

 

Calendar bookings

​

Appointments are booked using a third party company 'Calendly' - their privacy policy can be viewed here.

​

​

 

Web based meetings / training / counselling

​

Web based on-line sessions are hosted via a third party company Microsoft TEAMS - their privacy policy can be viewed here.

​

​

Complaints Procedure

 

I aim to provide a professional, respectful and safe counselling service. If you have any concerns about our work together, I encourage you to raise them with me directly, either verbally or in writing, so that we can explore them and work towards a resolution where possible. Formal complaints can be made in writing and will be considered fairly, with appropriate confidentiality and a timely response. If you remain dissatisfied or wish to raise a concern directly with the British Association for Counselling and Psychotherapy (BACP), you can find information about the complaints procedure here. You do not need to complete my internal complaints process before contacting BACP.

 

 

Review of this Policy

 

I keep this Policy under regular review. This Policy was last updated in October 2026.