Privacy Policy
Last updated: 10 October 2026
Website: www.headroomcounselling.co.uk
Practitioner: Lorna Tredget
Practice name: Headroom Counselling
1. About this privacy policy
I am an independent psychotherapist and supervisor providing psychotherapy to young people aged 11 and over as well as adults. I also provide professional supervision for therapists and reflective supervision for clergy, educators, nurses, doctors and other helping professionals.
In addition to working with individuals, I provide services commissioned by organisations, including churches, schools and GP practices.
I recognise the importance of privacy, confidentiality and trust in therapeutic and supervisory relationships. I am committed to handling personal information sensitively, securely and in accordance with applicable data protection legislation.
This Privacy Policy explains how I collect, use, store, protect and share personal information when you visit my website, contact me, engage my services or otherwise interact with my practice.
I comply with applicable data protection requirements, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 (PECR), as applicable.
2. Who is responsible for your personal information?
I operate as an independent sole practitioner so am responsible for your personal information.
Data controller: Lorna Tredget
Practice name: Headroom Counselling
Email: Lorna@headroomcounselling.co.uk
I am registered with the Information Commissioner's Office (ICO): https://ico.org.uk/esdwebpages/search
I am the data controller for any personal information I collect and maintain for my independent psychotherapy and supervision practice. This means I am responsible for determining the purposes for which that information is processed and ensuring that it is handled lawfully.
Where I provide services commissioned by a church, school, GP practice or another organisation, the respective data protection responsibilities will depend on the nature of the service, the records maintained and the contractual arrangements. I will clarify these responsibilities with the organisation where necessary.
3. What personal information do I collect?
The information I collect depends on the services you use and how you interact with me.
Website enquiries and communications
I may collect your name, email address, telephone number, the content of your enquiry and any other information you choose to provide. However, if you make an enquiry and I am unable to offer a service to you, your enquiry and any information related to it will be deleted.
I ask that you do not include detailed personal, medical, safeguarding or clinical information in initial emails unless it is necessary.
Psychotherapy
When providing psychotherapy, I may collect and maintain:
- Contact details and relevant personal information, including contact details for your GP.
- Information about your circumstances, presenting concerns and therapeutic needs.
- Physical and mental health information relevant to therapy.
- Brief clinical notes and records of therapeutic work.
- Appointment, consent and service-related records.
- Relevant safeguarding information.
- Relevant communications with you and, where appropriate and lawful, other professionals.
Professional and reflective supervision
When providing supervision, I may collect:
- Contact details and relevant professional information.
- Information about your professional role and practice.
- Supervision notes and records of reflective discussions.
I encourage supervisees to anonymise case material wherever possible. Identifiable information should only be shared where there is an appropriate and lawful reason.
Information from organisations
Where an organisation commissions my services, I may receive relevant information from that organisation, subject to the agreed arrangements and applicable law.
I will seek to collect only the information necessary to provide the service and meet my professional, contractual and legal responsibilities.
4. Why do I use personal information?
I use personal information for purposes including:
- Responding to enquiries and arranging consultations.
- Providing psychotherapy, professional supervision and reflective supervision.
- Maintaining appropriate clinical, supervision and administrative records.
- Managing appointments, cancellations, fees and payments.
- Meeting professional, ethical and safeguarding responsibilities.
- Complying with applicable legal, financial and record-keeping obligations.
- Managing and improving my website.
- Maintaining website security and preventing misuse.
- Responding to complaints, legal claims and data protection requests.
- Protecting individuals where there is a lawful basis to act concerning a safety or safeguarding concern.
I will not use personal information for purposes that are incompatible with the purposes explained in this policy without an appropriate lawful basis and any additional information or consent required by law.
5. My lawful basis for processing information
Under UK GDPR, the lawful bases relied upon are:
Contract: Processing necessary to provide psychotherapy services and manage appointments.
Legal Obligation:Processing required to comply with legal, regulatory, safeguarding, taxation, or professional requirements.
Legitimate Interests:Processing necessary for the effective administration of the practice while respecting your rights and freedoms.
Special Category Data:Health-related information is processed in accordance with Article 9 UK GDPR for the provision and management of health and therapeutic services, safeguarding, and where necessary for legal claims.
6. Confidentiality, supervision and safeguarding
Confidentiality is fundamental to my work. I handle information shared in therapy and supervision sensitively and do not routinely disclose it to other people. In my own supervision, confidentiality regarding the identity of situations and individuals is maintained.
However, confidentiality is not absolute. Information may need to be shared where:
- You have given appropriate consent.
- Disclosure is required by law or a court order.
- There is a significant safeguarding concern.
- There is a serious risk of harm to you or another person.
- Disclosure is otherwise necessary and lawful to meet a professional or legal responsibility.
I will consider each situation carefully, share only information that is necessary and proportionate, and document significant decisions where appropriate.
Where it is safe and appropriate to do so, I will discuss a proposed disclosure with you before sharing information.
Young people aged 11 and over
When working with young people, I take account of their privacy, rights, understanding, capacity and individual circumstances.
I explain confidentiality and its limits in an age-appropriate way. Information is not automatically shared with parents or carers simply because a young person is under 18.
Decisions about sharing information will depend on the circumstances, the young person's rights and understanding, applicable law, safeguarding responsibilities and any relevant arrangements agreed before therapy begins.
I discuss confidentiality arrangements with the young person and, where relevant, their parent or carer before therapy begins.
Work commissioned by organisations
When providing services for churches, schools, GP practices or other organisations, I maintain my own confidential therapy or supervision notes where appropriate.
The existence of a commissioning arrangement does not entitle the commissioning organisation to access those notes.
Any sharing of information with a commissioning organisation will be considered in accordance with applicable law, confidentiality obligations, the nature of the service and the arrangements agreed for that work.
Where necessary, I will clarify with the organisation and any individuals I am working with whether I am acting as an independent data controller, a joint controller or a processor for particular activities.
7. Who may receive personal information?
I do not sell personal information or share it for third-party marketing purposes.
Where necessary and lawful, I may share relevant information with:
- My own professional supervisor, where appropriate and consistent with confidentiality obligations.
- Relevant healthcare, education or safeguarding professionals.
- Parents or carers, where appropriate and lawful.
- Commissioning organisations, where disclosure is justified and consistent with agreed arrangements.
- Professional advisers, insurers, accountants or legal representatives.
- Website hosting, email, record-keeping, booking and payment service providers.
- Regulatory authorities, courts or public bodies where required or permitted by law.
Where service providers process personal information on my behalf, I take appropriate steps to ensure suitable contractual, confidentiality and security arrangements are in place.
I will not disclose more information than is reasonably necessary for the relevant purpose.
8. How I store and protect information
I take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
All devices are accessible only to me and are password protected to maintain secure electronic storage. Any brief notes kept on paper are stored in a locked filing cabinet and with no identifying information. Any messages received will be deleted after they have been read and any necessary action taken. careful handling of communications and appropriate arrangements with third-party service providers.
I take particular care with sensitive clinical and supervision information.
No electronic storage or transmission method can be guaranteed to be completely secure, but I take reasonable and proportionate steps to protect the information entrusted to me.
9. How long I retain personal information
I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of applicable legal, professional, safeguarding, insurance and record-keeping requirements.
Clinical notes are kept for 7 years after the date of the last session for adults or up until a young person is 25. Information is securely deleted or destroyed when it is no longer required, unless there is a lawful reason to retain it.
Financial records are kept for 6 years in line with HMRC requirements.
10. Your data protection rights
Subject to applicable legal conditions and exemptions, you may have the right to:
- Access personal information I hold about you.
- Rectification of inaccurate or incomplete information.
- Erasure of personal information in circumstances where the right applies.
- Restriction of certain processing.
- Object to processing carried out on certain lawful bases.
- Data portability for certain information such are reports or letters, if that would be helpful to you.
- Withdraw consent where processing is based on consent.
These rights are not absolute. For example, I may need to retain certain records to meet legal or professional obligations. There may also be restrictions on disclosing information where doing so would adversely affect another person's rights or where a legal exemption applies.
To exercise your rights, please contact me using the details in Section 2. I may need to verify your identity before responding.
I will respond within the applicable statutory timeframe, usually one month.
11. Data protection concerns and complaints
If you have a concern or complaint about how I handle your personal information, please contact me via email at Lorna@headroomcounselling.co.uk.
I take complaints seriously and will acknowledge and investigate your complaint and respond as quickly as possible.
If I cannot resolve your concern, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Complaints information: https://ico.org.uk/make-a-complaint/
Their helpline is: 0303 123 1113
Website: https://ico.org.uk/
12. Personal data breaches
If a personal data breach occurs, I will take appropriate steps to investigate, contain and address it.
Where required by law, I will notify the ICO within 72 hours and affected individuals within the applicable statutory requirements.
13. Website analytics, cookies and embedded content
Some technologies are essential for the secure and effective operation of my website. Others may be used for analytics, embedded media, functionality or tracking.
These technologies may be provided by third parties, which may receive information when you visit relevant pages.
Where consent is required, you will be able to accept or reject the relevant technologies and change your preferences through the website's consent mechanism.
14. Links to other websites and International Transfers
My website may contain links to external websites, and I am not responsible for the privacy practices or content of those websites. You may wish to review their privacy notices before providing personal information.
Some third-party service providers, including Microsoft Teams who I use for online therapy sessions, may store or process information outside the United Kingdom.
These services are also bound by a data processing agreement that requires them to protect your data. Further information about relevant providers and safeguards can be requested using the contact details in this policy.
15. Changes to this policy
I may update this Privacy Policy to reflect changes in my practice, website, technology or legal obligations.
The latest version will be published on my website, with the date of the most recent update shown at the beginning of the policy.
16. Contact me
If you have questions about this policy, wish to exercise your data protection rights or want to raise a privacy concern, please contact:
Lorna Tredget
Headroom Counselling