Privacy & Cookie Policy

Privacy Policy

This policy explains how personal information collected through Sarah Kirrane Counselling is handled, stored, and protected in strict adherence to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.

Category	Details & Procedures
Data Controller	Sarah Kirrane is the Data Controller. • Email: skirrane85@gmail.com • Phone: 07792 005366 • Practice Room Address: 1a Ickenham Road, Ruislip, HA4 7BT • Correspondence Address: 6 Montesole Court, Pinner, HA5 3RX
Lawful Basis for Processing	Information is processed under the following lawful bases: Contractual Obligation: To deliver individual counselling services agreed with you. Legitimate Interests: For day-to-day practice management and booking administration. Special Category Data (Health Data): Processing health and psychological notes is carried out under Article 9(2)(h) of the UK GDPR for the provision of healthcare and clinical therapy. Legal Obligation: To fulfill statutory financial, accounting, and tax compliance requirements.
Information Collected & Purpose	Contact Details: Full name, telephone number, email address, and home address to manage appointments. Emergency / Medical Details: GP practice information and emergency contact name/number, used strictly in medical emergencies or critical safeguarding risks. Clinical Information: Relevant medical history, medication, and anonymised session notes to maintain continuity and ethical care.
Data Storage & Security	Physical Records: Signed agreements and registration documents are locked inside a secure filing cabinet. Digital Data: Stored on password-protected, encrypted devices with two-factor authentication. Electronic communications utilize 256-bit TLS encrypted channels. Anonymisation: Session notes are pseudonymised using unique identification codes and stored separately from identifying personal details.
Limits of Confidentiality	Client confidentiality is protected at all times. Disclosure to external parties occurs only in exceptional circumstances: Where there is substantial risk of serious harm to yourself or another person. When legally required by a court order or UK statutory requirements (e.g., acts of terrorism, drug trafficking, or money laundering). During routine professional clinical supervision (case material is strictly anonymised to protect identity).
Data Retention & Disposal	Core clinical records are retained securely for 7 years following the end of therapy, in compliance with professional indemnity insurance terms. Following this period, all physical and electronic files are securely shredded and permanently erased. Incidental communications (text messages and emails) are deleted within 1 month of ending sessions.

---

Cookie Policy

This website uses essential cookies for operation and Google Analytics to collect aggregated visitor information. These cookies track anonymous browsing metrics so that website performance, page accessibility, and content can be improved.

Cookie Name	Provider	Purpose	Expiry
_ga	Google Analytics	Distinguishes unique visitors by assigning an anonymously generated number to calculate visitor and session data.	2 years
_ga_<container-id>	Google Analytics (GA4)	Used to persist session state across page views and retain user journey events without tracking personal identities.	2 years
_gid	Google Analytics	Stores and updates a unique value for each page visited to group visitor behaviors in statistical reports.	24 hours
_gat	Google Analytics	Used to throttle the request rate, limiting the collection of data on high-traffic connections.	1 minute

You can adjust or disable cookie storage through your browser settings at any time. To opt out of Google Analytics tracking across all websites, install the Google Analytics Opt-out Browser Add-on.

---

Your Rights Under UK GDPR

Under UK data protection legislation, you have specific rights regarding your personal records:

• Right to Access: You may submit a Subject Access Request (SAR) to receive a copy of your personal data without charge within one calendar month.
• Right to Rectification: You may request the correction of any inaccurate or incomplete personal records.
• Right to Erasure: You can request that your personal data be deleted. (Clinical and financial records required under insurance and legal mandates are exempt from immediate deletion until retention periods expire).
• Right to Restrict Processing: You have the right to request limits on how your personal data is processed under specific circumstances.
• Right to Data Portability: You may request your personal data be provided in a structured, commonly used machine-readable format.

---

Complaints Procedure

If you have any questions or concerns regarding how your personal information or clinical confidentiality is managed, please use the following resolution procedure:

Stage	Procedure & Authority Contacts
1. Direct Resolution	Please raise any concerns directly with Sarah Kirrane via email at skirrane85@gmail.com. All issues are acknowledged promptly and reviewed in good faith within 30 days.
2. Professional Body (BACP)	As a Registered Member of the British Association for Counselling and Psychotherapy (BACP), Sarah adheres to the BACP Ethical Framework. If an ethical or clinical concern cannot be resolved directly, complaints can be lodged via www.bacp.co.uk.
3. Data Protection Regulator (ICO)	If your concern relates specifically to your data privacy rights or handling under UK GDPR, you have the statutory right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or via helpline on 0303 123 1113.