At First Step Therapy Dorset, I am committed to protecting and respecting your privacy. This policy explains how I collect, use, store, and protect your personal data when you use my counselling services or interact with my website.

I act as the Data Controller for your personal information, which means I decide how and why your data is processed.

​

1. The Information I Collect

To provide safe and professional therapeutic support, I need to collect certain information about you. This falls into two categories:

Personal Data (General Information)

· Your name, date of birth, and gender.

· Contact details (email address, phone number, home address).

· Emergency contact/Next of Kin details.

Special Category Data (Sensitive Information)

​

Because counselling involves discussions about mental health, I process more sensitive data, which may include:

· Notes from our therapy sessions.

· Relevant medical history or psychological history.

· Information regarding your lifestyle, relationships, and current circumstances.

​

2. Why I Collect It & Lawful Basis

I only collect information that is strictly necessary to provide you with an effective service. Under the UK GDPR, the lawful bases I rely on are:

· Contract: To fulfil the counselling agreement we have entered into and to manage your appointments and billing.

· Legitimate Interests: To maintain accurate business records and ensure the safe, professional management of my practice.

· Special Category Data: I process your health-related data under the basis of providing health or social care treatment.

​

3. How Your Data is Stored and Secured

Your privacy is incredibly important to me, and I take data security very seriously.

· Digital Records: Any electronic data (such as emails, text messages, or contact forms) is stored on secure, password-protected, and encrypted devices or GDPR-compliant cloud storage.

· Session Notes: Hand-written or typed session notes are brief, kept strictly confidential, and anonymized (using a unique client code rather than your name). If paper-based, they are kept in a locked filing cabinet.

· Disposal: All records are securely and permanently destroyed after the retention period ends.

​

4. How Long I Keep Your Information

I hold your personal data and session notes for 7 years following the conclusion of our therapy together. This is a requirement of my professional indemnity insurance and standard counselling practice frameworks. After this time, your data is securely deleted or shredded.

​

5. Sharing Your Information (Confidentiality)

Everything we discuss in our sessions is strictly confidential. I will not share your personal information with third parties except in the following limited circumstances:

· Professional Supervision: As part of my ethical commitment to safe practice, I regularly discuss my work with a qualified supervisor. Your identity is always kept anonymous during these consultations.

· Risk of Harm: If I have reason to believe that you or someone else is at risk of serious harm, I may need to share information with relevant professionals (such as your GP or emergency services). I will always discuss this with you first.

· Legal Duty: I may be required to share information if compelled to do so by a court of law, or under statutory legal obligations (such as disclosures regarding terrorism or money laundering).

​

6. Your Rights

Under UK data protection law, you have specific rights regarding your personal information. You have the right to:

· Access: Request a copy of the personal data and session notes I hold about you.

· Rectification: Ask me to correct any information you think is inaccurate or incomplete.

· Erasure: Ask me to delete your personal data (though this may be limited by my legal and insurance obligations to retain records).

· Restriction: Ask me to restrict how I process your data in certain circumstances.

To exercise any of these rights, please contact me directly using the details below.

​

7. Contact Details and Complaints

If you have any questions about this Privacy Policy, how your data is handled, or if you wish to make a request regarding your data rights, please contact me:

· Name: Thomas Harrison

· Business Name: First Step Therapy Dorset

· Email:

· Phone: 07454759554

​

If you are unhappy with how I use your data, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK regulator for data protection. · Website: www.ico.org.uk

​

​

Last Updated: 10/06/2026