Privacy notice
This notice explains what personal information I collect, why, how I look after it, and what rights you have over it.
Last reviewed: August 2026.
Who is responsible for your information
Sarah Duggan, Registered Member MBACP, is the data controller. You can contact me at hello@sarahduggan.com.
To be confirmed before publication. This section is intended to read "I am registered with the Information Commissioner's Office, the UK data protection regulator", followed by the registration number. It cannot say so yet, because the data protection fee is still outstanding on the launch checklist. Sarah processes special category health data electronically and is not exempt from the fee. A visitor can look her up on the public ICO register, so claiming a registration that does not exist would be a false statement of regulatory status in a statutory notice, which is worse than leaving it out. Add the sentence and the registration number once the fee is paid, and not before. Do not publish this page until that is done.
What I collect
If you send an enquiry through this website, I receive your name, the contact details you give me, your general availability, and anything you choose to write in the optional message box.
If we work together, I keep brief session notes, your contact details, your GP details where you have given them, and a record of appointments and payments.
The website itself sets no cookies. I use privacy-friendly analytics that count visits without identifying anyone and without storing anything on your device.
Why I collect it, and the legal basis
For enquiries, my lawful basis is legitimate interests: I cannot reply to you without your contact details.
For client records, my lawful basis is contract, since I need records to provide counselling safely, along with legal obligation where record keeping is a professional requirement.
Counselling records include information about your health, which is special category data and needs an additional condition. I rely on the provision of health or social care treatment condition under Article 9(2)(h) of the UK GDPR.
To be confirmed before publication. The exact lawful basis and special category condition wording should be checked with a data protection adviser and discussed in supervision. Do not publish this page until that is done.
One question in particular is unanswered above. The Article 9(2)(h) condition stated here is scoped to counselling records. The optional message box on the enquiry form is the most likely place special category data reaches this practice, and the person writing it is usually not a client yet, so a health or social care provision condition is a poor fit for it. The applicable Article 9 condition for an enquiry from someone who is not yet a client must be confirmed by the adviser, and this notice updated to name it, rather than assumed from the client-records condition.
What I do not do
I do not sell your information, and I do not share it for marketing.
Your enquiry is sent straight to my email inbox. It is not stored in a database on this website, and no copy is kept by the site itself.
Who I share it with
My clinical supervisor, as a requirement of ethical practice. Supervision uses no identifying details, and my supervisor is bound by the same confidentiality.
Your GP or emergency services, only where there is a serious risk to your life or someone else's, or a risk to a child or vulnerable adult. Wherever possible I would discuss this with you first.
Where the law requires it, for example a court order.
Service providers who help run my practice, including my website host, my email provider and the service that delivers enquiry messages. Each is bound by a written agreement and processes data only on my instructions.
How long I keep it
Enquiries that do not lead to counselling are deleted within six months.
Client records are kept for seven years after our last contact, in line with professional guidance and insurance requirements. For clients under 18, records are kept until their 25th birthday. After that they are securely destroyed.
To be confirmed before publication. Retention periods should be checked against Sarah's professional indemnity insurer's requirements, which sometimes exceed seven years.
How it is kept safe
Records are stored securely with access limited to me. Electronic records are held on encrypted, password-protected devices with two-factor authentication. This website uses encryption for everything sent through it.
Your rights
You can ask for a copy of the information I hold about you, ask me to correct anything inaccurate, ask me to delete it where I am not required to keep it, object to or restrict how I use it, and withdraw consent where consent is the basis I have relied on.
To exercise any of these, contact me at the address above. I will respond within one month.
If you are unhappy with how I have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If this notice changes, the revised version will appear here with an updated review date.