Anxiety Counselling in Farnham
Privacy Notice
Last updated: September 2026
Your privacy is important to me. This privacy notice explains what personal information I collect, why I collect it, how I use and protect it, how long I keep it and the circumstances in which it may be shared.
This notice applies when you visit my website, contact me about my services, or work with me for counselling, supervision or breathwork.
Sam Roberts, trading as The Farnham Counsellor, is the data controller for the personal information described in this notice.
If you have any questions about how your information is handled, you can contact me at:
What information might I collect?
The information I collect depends on why you contact me and which service you use.
It may include:
Your name and contact details
Your date of birth
Your address
Emergency contact details
GP or other relevant healthcare details
Information you provide when making an enquiry
Information relevant to the reason you are seeking counselling
Information discussed during our work together
Brief counselling or session notes
Appointment and payment information
Emails, forms, messages and other correspondence
Information relating to risk or safeguarding, where relevant
Health information relevant to breathwork or other wellbeing work
For supervision, relevant professional, training, placement or practice information
Counselling and breathwork may involve information that is particularly personal or sensitive, including information about your physical or mental health, relationships, family life, sexuality, gender, racial or ethnic background, religious or philosophical beliefs or other areas of your life.
Under data protection law, some of this is known as special category data and receives additional protection.
I aim to collect only the information that is reasonably necessary for the service I am providing.
Where does my information come from?
Most information comes directly from you.
Occasionally I may receive information from somebody else, for example:
A parent or guardian making an enquiry for a young person
A GP or another professional making a referral
An organisation or placement connected with supervision
Where appropriate, I will make you aware of information received from another source.
Why do I use your information?
I may use your information to:
Respond to enquiries
Decide whether I am able to offer an appropriate service
Arrange and manage appointments
Provide counselling, supervision or breathwork
Maintain appropriate professional records
Contact you about sessions
Process and record payments
Manage risk and safeguarding concerns
Meet my professional and ethical responsibilities
Meet legal, tax and insurance requirements
Deal with complaints, disputes or legal claims
Maintain the safety and security of my practice
Understand how my website is being used where you have consented to analytics cookies
I do not sell your personal information.
I do not use information disclosed during counselling, supervision or breathwork for marketing purposes.
My lawful basis for using your information
UK data protection law requires me to have a lawful basis for collecting and using personal information.
The basis I rely on depends on what I am using the information for.
Contract
When you contact me about potentially working together, and while I am providing a service to you, much of the information I use is necessary in order to take steps towards or fulfil our agreement.
Legitimate interests
I may use legitimate interests where it is reasonably necessary for the safe and effective running of my practice, including maintaining appropriate records, responding to enquiries, ensuring the security of my practice and retaining records after our work ends.
When relying on legitimate interests, I consider your privacy rights and whether my use of the information is reasonable and proportionate.
Legal obligation
I may need to use or retain information where this is necessary to meet a legal obligation, including tax, accounting and certain disclosure requirements.
Vital interests
In exceptional circumstances, information may need to be used or shared where this is necessary to protect somebody's life.
Special category information
Information relating to health and some other aspects of your life is classed as special category data.
For sensitive information that is necessary for the provision of counselling or related therapeutic work, I generally rely on the UK GDPR condition relating to the provision of health or social care or treatment, alongside my professional duty of confidentiality.
Different lawful conditions may apply in exceptional circumstances, for example where information is necessary for safeguarding, legal claims or vital interests.
Data protection consent is separate from the consent you give to take part in counselling, supervision or breathwork.
The ICO specifically recognises health or social care as an Article 9 condition for processing special-category information, subject to the relevant UK legal requirements.
Counselling and session notes
I keep brief notes to support safe, ethical and effective practice.
My notes are not intended to be a detailed transcript of everything discussed during a session. I record information that I consider relevant and necessary.
Records may include:
Your identifying details
Dates of sessions
Brief information about the work undertaken
Relevant risk or safeguarding information
Significant events or unusual reactions where appropriate
This also enables me to meet the record-keeping requirements of my professional insurance.
Confidentiality
What you share with me during counselling, supervision or therapeutic work is treated confidentially.
I attend regular clinical supervision as part of safe and ethical practice. I may discuss aspects of my work in supervision, but I use as little identifying information as possible. My supervisor is also bound by confidentiality.
There are some circumstances in which information may need to be shared. These may include:
Where you have asked or given me permission to share information
Where I believe there is a serious risk of harm to you or somebody else
Where there is a safeguarding concern involving a child or an adult at risk
Where I am required to disclose information by law or by a court order
Where a specific legal duty requires disclosure
Where disclosure is necessary in connection with a legal claim, complaint or insurance matter
Wherever it is safe and appropriate to do so, I would aim to discuss this with you before sharing information.
Who might I share information with?
Depending on the circumstances, limited information may be shared with:
My clinical supervisor
Your GP or another healthcare professional where necessary
Safeguarding services
Emergency services
Courts or other authorities where I am legally required to provide information
My professional insurer or legal adviser if a complaint or claim arises
Professional advisers such as my accountant, where relevant
Technology providers that help me operate my practice
I will only share information where there is a valid reason for doing so and will aim to share only the information that is necessary.
Services and technology I use
I use established technology providers to help manage my practice.
These may include:
Squarespace – to provide and host my website.
Google Workspace – for business email, forms and other practice administration.
Google Analytics – to help me understand how visitors use my website, where analytics cookies have been accepted.
Google Ads – to advertise my services and measure advertising performance where the relevant cookies and permissions apply.
Video-conferencing software – where sessions are provided online.
Payment services – where you choose to make a payment electronically.
These providers may process limited personal information on my behalf and operate under their own privacy and security arrangements.
I take reasonable steps to use appropriate services and security settings.
Website analytics, advertising and cookies
My website uses cookies and similar technologies.
Some cookies are essential for the website to work properly.
Other cookies, including analytics and advertising measurement cookies, are non-essential and are used where you have made the relevant choice through the website's cookie banner.
I use Google Analytics to understand things such as:
Which pages are visited
How visitors arrive at the website
How visitors move around the site
Whether website forms or other features are used
I also use Google Ads to advertise my services and help measure the effectiveness of advertising.
Website analytics and advertising information is not used by me to identify what an individual client has discussed during counselling or another session.
You can manage your choices through the cookie options provided on the website.
Online sessions
If we work online, some personal information will necessarily pass through the video-conferencing service used for the session.
I take reasonable steps to use appropriate privacy and security settings.
I do not routinely record online counselling or supervision sessions.
If there were ever a reason to record a session, I would discuss this with you and obtain your agreement beforehand.
Video doorbell
For safety and security, a Ring video doorbell is used at the property where face-to-face sessions take place.
The doorbell may record short video and audio clips when somebody approaches the property or activates the doorbell.
My lawful basis for using the doorbell is my legitimate interest in maintaining the safety and security of clients, visitors, myself and the property.
Routine recordings are kept only for as long as reasonably necessary for security purposes and are deleted regularly in accordance with the system settings.
A particular recording may be retained for longer if it relates to a safety or security incident, complaint, insurance matter or legal requirement.
Footage would only be accessed or shared where reasonably necessary, for example with the police, an insurer or legal adviser following an incident.
The doorbell is not used to monitor counselling sessions and there is no video surveillance inside the counselling room.
The ICO recommends that business use of smart doorbells is reflected in privacy information, that recordings are appropriately secured and retained, and that appropriate signage is used.
How is my information kept secure?
I take reasonable steps to protect personal information against loss, unauthorised access, disclosure or misuse.
Measures I use include, where appropriate:
Password-protected accounts and devices
Device encryption
Two-factor or multi-factor authentication
Secure storage of records
Access controls
Keeping software and devices updated
Using established business technology providers
Limiting access to information to what is necessary
No method of electronic storage or communication can be guaranteed to be completely risk-free, but I take reasonable and proportionate measures to protect the information entrusted to me.
How long do I keep your information?
I do not keep personal information indefinitely.
Counselling and client consultation records
Records are normally retained for five years after our work together ends. This reflects the requirements of my professional insurance and provides a clear reason for the retention period.
If you were under 18 when our work took place, records are retained until at least five years after your 18th birthday, or for five years after our work ends if that is later.
Records may occasionally need to be retained for longer where there is a specific legal, safeguarding, insurance or professional reason for doing so.
Supervision records
Supervision records are retained for an appropriate period taking account of professional, training, insurance and legal requirements. Where no longer required, they are securely deleted or destroyed.
Enquiries that do not lead to us working together
Information from initial enquiries is retained only while it is reasonably needed to respond to the enquiry and establish whether we will work together. It is deleted when it is clear that it is no longer required, unless there is a particular reason it needs to be retained.
Financial records
Financial and accounting information is retained for the period required by HMRC and other applicable legal requirements.
Website data
Website analytics and cookie information is retained in accordance with the settings and retention periods of the relevant services and your cookie choices.
At the end of the relevant retention period, identifiable records are securely deleted or destroyed unless there is a justified reason for keeping them for longer.
The ICO does not prescribe one universal retention period; organisations are expected to be able to justify their chosen periods and routinely delete or anonymise information once it is no longer needed.
Information processed outside the UK
Some of the technology companies I use operate internationally.
This means information may sometimes be stored or processed outside the UK.
Where this happens, I use providers that put appropriate arrangements in place for international transfers, such as transfers to countries covered by UK adequacy regulations or recognised contractual safeguards.
You can contact me if you would like further information about the safeguards applying to a particular service.
Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
Ask for a copy of the personal information I hold about you
Ask for inaccurate or incomplete information to be corrected
Ask for information to be deleted
Ask for the use of your information to be restricted
Object to particular uses of your information
Ask for certain information to be transferred to you or another organisation
Withdraw consent where consent is the lawful basis being relied upon
These rights are not absolute. There may be circumstances in which I am entitled or required to retain or continue using particular information.
If you would like to make a request regarding your information, please contact me at:
I will respond in accordance with the timescales required by data protection law.
Automated decision-making
I do not use automated decision-making to decide whether somebody can access counselling, supervision or another service.
I do not use profiling based on information disclosed within counselling sessions.
If you have a concern
If you have concerns about how I have handled your information, please contact me first and I will try to resolve the matter.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information about making a complaint is available on the ICO website.
ICO registration number: ZA123456
Changes to this privacy notice
I may update this privacy notice from time to time, for example if my services, technology providers or legal obligations change.
The current version will always be available on my website.
Last updated: September 2026