Your privacy

Privacy Policy

Last updated: 6 November 2026

Who I am

As You Are Therapy is the private counselling practice of Hannah Fleetham, a Registered Member of the British Association for Counselling and Psychotherapy (MBACP, membership number 421545). I am the "data controller" for the information you share with me, which means I'm responsible for deciding how it is used and for keeping it safe.

I am registered with the Information Commissioner's Office (ICO). Registration number: [add your ICO number].

What information I collect

When you get in touch: your name, your contact details (email address and/or phone number), and anything you choose to tell me in your message or during our free introductory call.

If we work together:

• your name, date of birth and contact details
• the address you usually join sessions from
• the name and contact details of your GP and an emergency contact
• brief session notes, which may include information about your physical or mental health, relationships and life circumstances
• a record of session dates and payments

Information about your health is known as "special category" data under UK data protection law, and it is given extra protection. I only record what is necessary to support our work together.

Why I use your information, and the legal basis

• To respond to your enquiry and arrange an introductory call: this is in our mutual legitimate interests.
• To provide counselling: this is necessary to carry out our agreement (contract) to work together.
• To keep session notes that may include health information: this is necessary for the provision of health care, under Article 9(2)(h) of the UK GDPR, and I am bound by the professional duty of confidentiality set out in the BACP Ethical Framework.
• To contact your GP or emergency contact: I would only do this if I were seriously concerned about your safety and couldn't reach you. This is necessary to protect your vital interests, and wherever possible I would tell you first.
• To keep payment records: this is necessary to meet my legal obligations, for example to HMRC.

I will never use your information for marketing, and I will never sell it.

How I keep your information safe

• Digital records are stored securely and protected by passwords.
• Any paper records are kept in a locked cabinet.
• Sessions take place on Doxy.me, a secure video platform designed for healthcare. Sessions are not recorded.
• Emails are sent and received using Gmail, and calls and texts are made from a password-protected phone. Email and text are not completely secure, so please bear this in mind when deciding what to share in writing. You're welcome to keep messages brief and save the detail for our sessions.

Who I share your information with

Your information is confidential. I don't share it with anyone except in the situations below.

Clinical supervision. In line with the BACP Ethical Framework, I have regular supervision with a BACP accredited supervisor. This supports me to work safely and well. I may discuss our work in supervision, but I never share your name or any details that could identify you. My supervisor is also bound by confidentiality.

The limits of confidentiality. There are rare circumstances in which I may need to share information without your consent:

• if I believe you, or someone else, are at serious risk of harm
• if I have concerns about the safety of a child or a vulnerable adult
• if I am required to by law, for example by a court order, or in relation to terrorism or money laundering

Wherever possible and appropriate, I would talk with you first before sharing anything. We will go through this together at the start of our work.

Payments

Payment is by bank transfer. I keep a record of the payments made to me, which may include the name on your bank account, for my accounts and tax records. I don't store your bank card or account details beyond what appears on my bank statement.

How long I keep your information

• Session notes and records: kept for 7 years after our work together ends, then securely destroyed. Paper records are shredded and digital records are permanently deleted.
• Enquiries that don't lead to counselling: deleted within [3 months] of our last contact.
• Financial records: kept for as long as HMRC requires.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the information I hold about you
• ask me to correct anything that is inaccurate
• ask me to delete your information, where I don't have a legal or professional reason to keep it
• ask me to restrict how I use your information, or object to my using it
• ask for your information to be transferred to you or someone else

To make any of these requests, please contact me by email or phone. I will respond within one month, and there is no charge.

This website

This website doesn't use cookies, analytics or tracking. It loads its fonts from Google Fonts, which means your browser connects to Google's servers, and Google may receive your IP address. The company that hosts the website may also keep standard technical logs, such as IP addresses, for security purposes.

Making a complaint

If you're unhappy with how I've handled your information, please talk to me first and I'll do my best to put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

I may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.