Privacy Policy

Living CALM

Gail Worthy – MBACP

1. Introduction

Welcome to Living CALM ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).

As a therapeutic practice dealing with sensitive personal and health information, we understand the importance of confidentiality and take our data protection responsibilities seriously.

2. Who We Are

Practitioner Name: Gail Worthy

Professional Title: Counsellor and Breath Work Coach

Email: talk2livingcalm@myyahoo.com

Phone: 07701330705

Website: www.livingcalm.co.uk

Professional Accreditation: Member of the British Association for Counselling and Psychotherapy (BACP)

ICO Registration Number: ZA361712
Date Registered: 09 May 2018
Registration Expires: 08 May 2027
Payment Tier: Tier 1

Insurance: Fully insured

DBS: Enhanced DBS clearance held

Contact Address for Data Protection Purposes: Available on request

3. What Data We Collect

We collect and process the following types of personal data:

A. Information You Provide to Us:

Personal Information:

Full name, date of birth, age
Contact details (address, email address, phone number)
Emergency contact information
GP details and other healthcare professionals involved in your care

Health and Therapeutic Information:

Medical history and current health conditions
Mental health history
Current medications
Previous counselling or therapy experience
Information about your reasons for seeking therapy
Session notes and therapeutic records
Assessment information
Goals and progress in therapy
Information relevant to specific areas of focus (including anxiety, bereavement, infertility, menopause, domestic abuse, and other concerns you may bring)

Financial Information:

Payment details for session fees
Billing information
Insurance information (if applicable)

Communication Records:

Emails, text messages, and other correspondence
Phone call records
Contact form submissions
Appointment booking information
Discovery session records

B. Information We Collect Automatically:

Website Usage Data:

IP address and browser type
Device information and operating system
Pages visited on our website
Date and time of visits
Referring website
Cookies and similar technologies (see our Cookie Policy)

4. How We Use Your Data

We process your personal data for the following purposes:

Primary Purposes:

Providing Therapeutic Services: To deliver counselling, breath work coaching, and related therapeutic services
Appointment Management: To schedule, confirm, and manage appointments, including discovery sessions
Client Care: To maintain therapeutic records and track progress
Communication: To respond to inquiries and communicate about services
Billing and Payments: To process payments and maintain financial records
Clinical Supervision: To receive professional supervision (as required by BACP)
Safeguarding: To fulfil safeguarding obligations for children and vulnerable adults

Legal Basis for Processing:

We process your data based on:

Consent: Where you have given explicit consent (particularly for sensitive health data)
Contract: Performance of our contract to provide therapeutic services
Legal Obligation: Compliance with legal requirements (safeguarding, court orders, etc.)
Vital Interests: To protect your vital interests or those of another person
Legitimate Interests: For legitimate practice management purposes

The DUAA introduced a new "recognised legitimate interests" lawful basis under Article 6(1)(ea) UK GDPR. Where applicable, we may rely on this basis for processing that serves recognised legitimate interests such as protecting public security or ensuring the safety of clients.

Special Category Data:

As a therapeutic practice, we process special category data including:

Health and mental health information
Information about ethnicity, religion, sexual orientation (where relevant to therapy)
Information about criminal convictions (where relevant, e.g., safeguarding)

We process this data with your explicit consent and for the provision of health treatment (Article 9(2)(h) UK GDPR).

5. Data Sharing and Disclosure

We maintain strict confidentiality. However, we may share your data in the following circumstances:

A. Routine Sharing:

Clinical Supervision: Anonymous or pseudonymised case discussions with my professional supervisor (as required by BACP accreditation)
Healthcare Professionals: With your GP or other healthcare providers (with your explicit consent)
Service Providers: Trusted third parties who assist in our operations (IT services, payment processors, email services)

B. Legal Obligations – Confidentiality Exceptions:

We may disclose information without your consent when:

Safeguarding: There is a risk of serious harm to you or others
Legal Requirements: Required by law, court order, or regulatory body
Terrorism: Prevention of terrorism (under Counter-Terrorism legislation)
Drug Trafficking: Prevention of drug trafficking offences
BACP Requirements: To comply with BACP Ethical Framework requirements

C. With Your Consent:

Insurance companies (if claiming through insurance)
Other therapists or specialists involved in your care
Family members or support persons (where appropriate)

We do NOT sell your personal data to third parties.

6. Data Retention

We retain your personal data according to the following schedule:

Therapeutic Records:

Adults: 7 years after the last session (BACP recommendation)
Clinical Supervision Records: 7 years

Financial Records:

Payment Records: 7 years (for tax and accounting purposes)
Invoices: 7 years

Website and Inquiry Data:

Inquiries (no service): 2 years from initial contact
Cookies: As per our Cookie Policy

Secure Destruction:

After these periods, data is securely destroyed through:

Shredding paper records
Secure digital deletion
Ensuring data cannot be reconstructed

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Your Data Protection Rights:

Right to Access: Request copies of your personal data and therapeutic records
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements)
Right to Restrict Processing: Request limitation of how we use your data
Right to Data Portability: Request transfer of your data to another provider (where technically feasible)
Right to Object: Object to processing of your data
Rights Related to Automated Decision-Making: Not applicable to our practice (we don't use automated decision-making)

New Right to Complain (DUAA 2025):

From 19 June 2026, you have a specific right to complain to us about any infringement of your data protection rights. We are required to acknowledge your complaint within 30 days of receipt and provide a full response without undue delay.

How to Exercise Your Rights:

Email: talk2livingcalm@myyahoo.com
Phone: 07701330705
Post: Available on request

Response Time: We will respond within 30 days of receiving your request.

No Fee: Usually free, unless requests are manifestly unfounded or excessive.

Special Considerations for Therapeutic Records:

You have the right to access your therapy records
In rare circumstances, access may be limited if it could cause serious harm to your physical or mental health
We may need to verify your identity before releasing information
Third-party information may be redacted to protect others' privacy

8. International Data Transfers

Where We Store Your Data:

Primary Storage: UK-based systems and physical records
Email: May use email services that process data outside the UK
Online Counselling Platforms: May use platforms with international servers

Safeguards:

If we transfer your data outside the UK, we ensure appropriate safeguards:

Adequacy decisions by the UK government
Standard contractual clauses
Explicit consent for specific transfers

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

Physical Security:

Practice Location: Private, dedicated therapy room providing a space of calm and warmth
Secure Storage: Locked filing cabinets for paper records
Controlled Access: Practice room is secure and confidential

Digital Security:

Password Protection: All electronic devices and files are password-protected
Encryption: Sensitive data is encrypted
Secure Email: Encrypted email for sensitive communications
Antivirus Software: Up-to-date security software
Regular Backups: Secure backup systems
Secure Internet: Password-protected Wi-Fi

Organisational Measures:

Confidentiality Agreement: Bound by BACP Ethical Framework
Training: Regular data protection and confidentiality training
Professional Indemnity Insurance: Fully insured
Professional Supervision: Regular supervision to ensure best practice
Enhanced DBS: Current enhanced DBS clearance held

Breach Procedures:

In the event of a data breach:

Immediate containment and assessment
Notification to ICO within 72 hours (if required)
Notification to affected individuals (if high risk)
Documentation and review to prevent recurrence

10. Cookies and Website Technologies

Our website uses cookies and similar technologies:

Types of Cookies We Use:

Necessary Cookies: Essential for website functionality; cannot be disabled; no personal data stored
Analytics Cookies: Help us understand website usage; anonymous data collection; improve website performance
Preference Cookies: Remember your settings and preferences; enhance user experience
Marketing Cookies: Not currently used on our website

The DUAA has updated cookie rules, allowing the setting of some types of cookies without consent, such as those used to collect information for statistical purposes and improve website functionality.

Managing Cookies:

You can control cookies through:

Browser settings
Cookie consent banner on our website
Deleting cookies manually

For detailed information, see our separate Cookie Policy.

11. Online Counselling and Teletherapy

If you use our online or telephone counselling services:

Additional Data Collected:

Video/audio call recordings (only with explicit consent)
Platform usage data
Connection quality information
Chat transcripts (if applicable)

Platforms Used:

Secure video conferencing platforms
Telephone services
Email and text messaging

Security Considerations:

We use encrypted platforms where possible
You are responsible for your own internet security
We recommend using private, secure connections
Sessions are conducted from a private space

Studies suggest that online therapy is just as effective as in-person therapy, and we offer both to work around your individual needs and circumstances.

12. Clinical Supervision

As required by BACP accreditation:

What This Means:

I receive regular professional supervision
Case discussions are confidential and anonymised
Supervisor is also bound by confidentiality
This is for quality assurance and ethical practice

Data Shared in Supervision:

Anonymised client information
Therapeutic approaches and challenges
Professional development needs
Ethical considerations

13. Complaints and Concerns

We take feedback seriously and have a complaints procedure:

Informal Resolution:

Discuss concerns directly with Gail Worthy
Email: talk2livingcalm@myyahoo.com
Phone: 07701330705

Formal Complaints:

Written complaint to our contact address (available upon request)
Investigation within 28 days
Written response with outcome
Opportunity for discussion

BACP Complaints:

If unresolved, you can contact:

BACP Professional Conduct Department
For ethical complaints about practice

14. How to Make a Data Protection Complaint

If you have concerns about how we handle your personal data, you have the right to make a complaint. We take all complaints seriously and are committed to resolving them fairly and promptly.

Email: talk2livingcalm@myyahoo.com
Phone: 07701330705
Post: Available on request
Website Contact Form: www.livingcalm.co.uk

What to Include in Your Complaint:

When making a data protection complaint, please provide:

Your full name and contact details
Client reference number (if applicable)
Clear details of your data protection concern
What has happened and when
The effect it has had on you
Copies of relevant documents or correspondence
What outcome you are seeking

Our Complaints Handling Process:

Step 1 – Acknowledgment (Within 30 Days)
We will acknowledge receipt of your complaint within 30 days of receiving it. This acknowledgment will:

Confirm we have received your complaint
Provide a reference number
Explain who will handle your complaint
Give you an expected timeframe for a full response

Step 2 – Investigation
We will:

Investigate your complaint thoroughly
Review our data protection practices
Take appropriate steps to address your concerns
Keep you informed of progress
Deal with your complaint without undue delay

Step 3 – Response
We will provide you with:

A full written response to your complaint
Explanation of our findings
Any actions we have taken or will take
Timeline for implementation where applicable
Information about further steps if you remain dissatisfied

Step 4 – Keep You Informed
If our investigation takes longer than expected, we will:

Keep you updated on progress
Explain any delays
Provide a new timeframe for response

Timeline:

Acknowledgment: Within 30 days of receipt
Full Response: Within one calendar month (or we will inform you of expected timeframe)
Complex Cases: We will keep you informed of progress

If You're Not Satisfied:

If you are unhappy with our response or if we haven't responded within the expected timeframe, you have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office (ICO)

Website: www.ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Email: icocasework@ico.org.uk
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Before contacting the ICO:

Please give us the opportunity to resolve your complaint first
Wait for our response (up to one month)
If you've received our response but remain unsatisfied, you can then escalate to the ICO
Provide the ICO with copies of your complaint and our response

Complaints Log:

We maintain a confidential record of all data protection complaints we receive, including:

The nature of the complaint
Actions taken
Outcomes and resolutions
Timeline of handling

This helps us improve our data protection practices and demonstrate compliance with DUAA 2025.

15. Changes to This Privacy Policy

We may update this privacy policy from time to time:

How We'll Notify You:

Post changes on this page with updated date
Significant changes will be communicated directly
Updated policy will be accessible from website footer
Continued use of services constitutes acceptance

Review Schedule:

This policy is reviewed:

Annually (every 12 months)
When legislation changes
When our services change
Following any data breaches or incidents

Last Updated: August 2026
Next Review Due: August 2027

16. Contact Us

If you have any questions about this privacy policy or our data protection practices:

Email: talk2livingcalm@myyahoo.com
Phone: 07701330705
Post: Available on request

Website: www.livingcalm.co.uk

Professional Body:
British Association for Counselling and Psychotherapy (BACP)
BACP House, 15 St John's Business Park, Lutterworth, Leicestershire, LE17 4HB
www.bacp.co.uk

17. Key Definitions

Personal Data: Any information relating to an identified or identifiable person
Special Category Data: Sensitive data including health, ethnicity, religion, sexual orientation
Processing: Any operation performed on personal data (collecting, storing, using, etc.)
Data Controller: Gail Worthy (determines purposes and means of processing)
Data Processor: Third parties who process data on our behalf
Consent: Freely given, specific, informed, and unambiguous agreement

18. Your Responsibilities

When using our services, you agree to:

Provide accurate and up-to-date information
Inform us of any changes to your contact details
Use secure communication methods
Respect appointment cancellation policies
Pay fees as agreed
Use online platforms responsibly

19. Additional Information for Specific Services

Discovery Sessions:

We offer a free 30-minute discovery session so that you can ask any questions and make an informed choice before you decide. Information gathered during discovery sessions is:

Used to assess whether our services are right for you
Stored securely
Retained only if you proceed to therapy (otherwise deleted within a reasonable period)

Breath Work Coaching:

Breath work coaching sessions may involve:

Discussion of physical and emotional wellbeing
Information about your breathing patterns and physical responses
Records kept separately from counselling notes where appropriate

Areas of Focus:

Our work may involve exploring sensitive topics including anxiety, bereavement, infertility, menopause, domestic abuse, and other concerns. All information shared is treated with the utmost confidentiality.

Corporate or Organisational Referrals:

Where sessions are arranged through an organisation:

Billing information may be shared with the referring organisation
Session content remains confidential
Aggregate usage reports only (no individual identification)

This Privacy Policy is compliant with:

✅ UK General Data Protection Regulation (UK GDPR)
✅ Data Protection Act 2018
✅ Data (Use and Access) Act 2025 (DUAA)
✅ Privacy and Electronic Communications Regulations (PECR)
✅ BACP Ethical Framework for the Counselling Professions

Thank you for trusting Living CALM with your care.

Book Now