Privacy notice
Last updated: 1 August 2026
This notice explains what personal information I collect about you, why I collect it, what I do with it, and what rights you have. Please read it alongside our Counselling Agreement.
Who I am
I am Sally Viollier, a self-employed counsellor trading as Sally Viollier Therapy. I am the data controller for the information I hold about you, which means I decide how and why it is used.
You can contact me at sally@sallyviollier.co.uk.
What information I collect
| Type | Examples |
|---|---|
| Contact details | Your name, address, phone number, email address |
| Emergency information | Your GP's name and surgery, and an emergency contact |
| Assessment information | What brings you to counselling, relevant history, current medication, previous therapy |
| Session notes | Brief factual notes of what we discussed and any decisions made |
| Financial records | Dates of sessions, fees charged and payments received |
| Correspondence | Emails, text messages and website enquiries between us |
Most of this is special category data — information about your health — which the law treats as particularly sensitive and which I protect accordingly.
Why I collect it, and my lawful basis
Under the UK GDPR I must have a lawful basis for using your information. I rely on:
- Article 6(1)(b) — performance of a contract. I need this information to provide the counselling you have asked for under our agreement.
- Article 9(2)(h) — provision of health care or treatment. This is my additional condition for handling health information.
- Article 6(1)(c) and 9(2)(b)/(c) — legal obligation and vital interests. These apply in the limited circumstances where I must share information to protect someone from serious harm, or where the law requires disclosure.
- Article 6(1)(f) — legitimate interests. I keep records for a period after our work ends so that I can respond to any complaint, claim or regulatory enquiry.
Where I ask for your consent — for example, to contact your GP in a non-urgent situation — you are free to refuse, and free to change your mind later.
Who I share it with
I do not sell your information or use it for marketing. I share it only in these circumstances:
- My clinical supervisor, as part of the supervision required by my professional body. I do not use your full name.
- My therapeutic executor — a trusted colleague who would contact you if I became suddenly unable to work. They would have access to your contact details, not to your session notes.
- Emergency services, your GP, or safeguarding authorities, where I believe there is a serious risk of harm to you or someone else.
- Courts or regulators, where I am legally required to disclose.
Technology I use
The following organisations process information on my behalf as data processors, under contracts that require them to keep it secure:
| Purpose | Provider |
|---|---|
| Google (Gmail), with forwarding from my own domain by Cloudflare | |
| Secure file storage and backup | Dropbox |
| Documents and session notes | Google Docs |
| Video sessions | Microsoft Teams or Zoom, whichever suits you |
| Invoicing and accounts | FreeAgent / Mettle — name and billing details only |
| Website hosting | Cloudflare |
| Enquiry form | Formward (data held in Sweden) |
How long I keep it
- Session notes and client records: six years after our work ends, then securely destroyed.
- Financial records: at least six years, as required by HMRC.
- Enquiries that do not lead to counselling: deleted within three months.
How I keep it safe
- Electronic records are held on an encrypted device with a strong password, and in encrypted cloud storage protected by two-factor authentication.
- Any paper records are kept in a locked cabinet.
- Your identifying details are stored separately from your session notes.
- Nobody else has access to my devices, my email account or my storage.
- My email account is protected by two-factor authentication and a password used nowhere else.
Your rights
You have the right to:
- Ask for a copy of the information I hold about you (a "subject access request"). I will respond within one month and there is normally no charge.
- Ask me to correct anything that is inaccurate.
- Ask me to delete information, though I may need to keep some of it where I have a legal or professional obligation to.
- Ask me to restrict how I use it, or object to my using it.
- Withdraw consent, where I have relied on your consent.
- Complain to the Information Commissioner's Office.
To exercise any of these, please contact me at sally@sallyviollier.co.uk.
Cookies
This website does not use cookies, analytics or tracking of any kind.
Complaining
I would rather you came to me first so I can put things right. But you can complain directly to the ICO at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk/make-a-complaint · 0303 123 1113
Changes to this notice
If I change how I handle your information, I will update this notice and tell you.