Privacy & Data Protection Policy

1. Introduction

Hope Therapy & Counselling Services (“Hope”, “we”, “us”, “our”) is committed to protecting the privacy of everyone who contacts us or uses our service. This policy explains what personal information we collect, why we collect it, how we use, store and protect it, how long we keep it, and your rights.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003, and guidance from the Information Commissioner’s Office (ICO).

It applies to clients, prospective clients, website visitors and anyone who contacts us. Please read it alongside our Terms of Service and our Data Protection and Privacy Policy (client policy 04). We may update this policy when the law, ICO guidance or our practices change. The current version is always on our website, and we will tell existing clients by email about any significant change.

2. Who we are and how our service works

Hope is a referral, administration, payment and marketing service. We introduce people looking for counselling and related support to qualified, independent, self-employed counsellors and therapists (our “affiliate counsellors”). We handle your enquiry, the free 15-minute consultation, matching you with a counsellor, and payment for your sessions through our website.

Hope does not provide therapy. Your counsellor provides your sessions, arranges your session dates directly with you, and is responsible for your care.

This means there are two separate data controllers:

• Hope is the controller of the enquiry, referral, matching, payment and administrative information we hold about you.
• Your counsellor is an independent controller of your clinical record: the notes and other information they keep about your sessions. Your counsellor will give you their own privacy information, including how long they keep your record. Hope does not have access to the content of your sessions or to your counsellor’s clinical notes. The exceptions are if you are seen by a trainee counsellor on Hope’s placement programme, or by Ian Stockbridge, Hope’s Director (see Section 6.1).

Ian Stockbridge, Director, is responsible for data protection at Hope and can be contacted at .

3. The information we collect

3.1 Personal information

• Your name and contact details (email address, telephone number and, where needed, your address or town)
• Your date of birth or confirmation of your age
• Your preferences for counselling (for example online, telephone or face to face, and any preference about your counsellor)
• The name of the counsellor you are matched with, and the date of your first session
• Payment records, such as what you paid for and when, refunds and payment references. Card payments are processed by our payment provider; we do not see or store your full card details
• If your sessions are paid for by an employer, insurer or other organisation, the name of that organisation and the number of sessions authorised
• Our correspondence with you (emails, messages and notes of calls)

3.2 Health and other sensitive information

Because we arrange counselling, we hold some special category (health) information. This is the information you choose to give us when you enquire, during your free consultation and when we match you with a counsellor: for example, what you would like help with and any information about risk that you tell us. We use it to check that we can help, to match you with a suitable counsellor and to pass the relevant details to them.

We do not hold the content of your counselling sessions; that is held by your counsellor. The exceptions are described in Section 6.1.

3.3 Website information

When you visit our website we may collect your IP address and browser type, the pages you visit and for how long, the website that referred you, and cookie and analytics information (see Section 9).

3.4 If you do not give us information

If you do not give us information we need, we may not be able to arrange counselling for you.

4. Our lawful basis for using your information

We must have a lawful basis for using your personal information and, for health information, an additional condition under Article 9 of the UK GDPR.

Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

5. How we use your information

• To respond to your enquiry and hold your free consultation
• To check whether we can help, and to match you with a suitable counsellor
• To pass your referral details to your counsellor so they can contact you and arrange your sessions
• To take payment for your sessions through our website, send payment confirmations and handle refunds and changes to payments
• To arrange sessions paid for by an employer, insurer or other organisation, and to invoice them
• To keep accurate administrative records
• To deal with feedback and complaints, including data protection complaints
• To protect you or others where there is a safeguarding concern
• To send you marketing, only if you have opted in
• To improve our service and website
• To meet our legal and regulatory obligations

Your counsellor arranges, changes and cancels your session dates with you directly. Hope does not manage your appointments and does not send session reminders; your counsellor may do so. If a payment has not been received, your counsellor may send you a reminder with your payment link.

We only use your information for the purpose we collected it for, or a compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis.

6. Who we share your information with

6.1 Your counsellor

When we match you with a counsellor, we send them your name and contact details, your date of birth or age, what you would like help with, any information about risk you gave us, and (where it applies) the organisation paying for your sessions, the number of sessions authorised, whether a reduced fee applies, and whether a session has been paid for. We do not share your financial circumstances.

If your counsellor decides not to take the referral, they have agreed with us to delete the information securely within 7 days. Once your sessions start, your counsellor holds your clinical record as an independent controller. Your counsellor has agreed with us to keep it secure, not to record sessions or use artificial intelligence (AI) tools on session content without your prior written consent, and to keep records for at least the periods in Section 8. Your counsellor discusses their work in clinical supervision without identifying you.

Trainee counsellors on our placement programme. If you are seen by a trainee counsellor on Hope’s placement programme, the arrangement is different: your trainee writes their session notes in Hope’s secure case management system (WriteUpp), works under the supervision of a supervisor arranged by Hope, and Hope is the controller of those notes. We keep them for the periods in Section 8, and you can ask us for access to them.

Sessions with Ian Stockbridge. If you see Ian Stockbridge, Hope’s Director, for counselling, his session notes are also kept in WriteUpp and Hope is the controller of them, on the same basis.

6.2 Service providers we use

We use trusted service providers to run our service. They act as our processors: they use your information only on our instructions, under written contracts that meet UK GDPR requirements.

We do not sell, rent or trade your personal information.

6.3 Other sharing

• Organisations paying for your sessions: only what is needed to arrange and invoice your sessions. Your counsellor never contacts them or tells them about your sessions.
• Statutory agencies (for example children’s or adult social care, the police or emergency services) where there is a safeguarding concern or the law requires it (Section 6.4).
• Our professional advisers and insurers, in confidence, where needed to deal with a complaint or claim.
• Regulators, including the ICO, where the law requires.
• A successor organisation if Hope’s business is transferred. We would tell you in advance.

Otherwise, we will not share your information without your consent.

6.4 Safeguarding: sharing without consent

Safeguarding is one of the limited situations in which we may share your information without your consent. Where we have reasonable cause to believe that you, a child or another person is at risk of serious harm, we may share relevant information with statutory agencies. Your counsellor makes their own safeguarding decisions and reports; our Designated Safeguarding Lead may also make referrals on Hope’s behalf.

Wherever it is safe and appropriate, we will talk to you first and explain what we plan to share and why. Where telling you first would increase the risk to anyone, or would prejudice a police investigation, we may share without telling you beforehand. We share only the minimum information needed. Our Safeguarding Policy (client policy 07) explains this further.

7. International transfers

We aim to store and process your information in the United Kingdom. Some of our service providers (for example Zoom, Mailchimp, Stripe and Airtable) may process information outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. Please contact us if you would like more information.

8. How long we keep your information

We keep personal information only for as long as we need it, in line with our Data Retention Schedule. Where a record falls into more than one category, the longest period applies.

8.1 Records held by Hope

8.2 Records held by your counsellor

Your counsellor holds your clinical record and will tell you how long they keep it. They have agreed with Hope to keep records for at least:

We may keep information for longer where the law, a court order or a legal claim requires it. When information is no longer needed, it is securely deleted or permanently anonymised. Safeguarding records are never destroyed without advice from our Designated Safeguarding Lead.

9. Cookies and website tracking

Our website uses cookies and similar technologies. Essential cookies are needed for the website to work. Analytics, functionality and marketing cookies are only used in line with the choices you make in our cookie banner. You can change your choices at any time using the cookie settings on our website. Our Cookie Policy, on our website, gives full details of the cookies we use.

The Data (Use and Access) Act 2025 allows some low-risk analytics and functionality cookies to be used without consent. We will update our cookie banner and Cookie Policy in line with ICO guidance.

10. How we protect your information

• Secure, access-controlled systems, protected by strong passwords and two-factor authentication
• Access limited to people who need it for their role
• Safeguarding records held separately, with access restricted to our Designated Safeguarding Lead and people they authorise
• Written contracts with our service providers, and regular review of their security
• Data protection training for our team

Our affiliate counsellors have agreed with us to keep the information we send them on devices and accounts under their sole control, protected by encryption, strong passwords and multi-factor authentication where available.

No transmission over the internet can be guaranteed to be completely secure, but once we receive your information we use strict procedures to protect it.

10.1 Data breaches

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay. We will report notifiable breaches to the ICO within 72 hours of becoming aware of them.

11. Young people aged 16 and 17

Hope arranges counselling for adults aged 18 and over. We arrange counselling for young people aged 16 and 17 only with counsellors who hold Hope’s own approval to work with this age group (Hope CYP Approval). We do not accept referrals for anyone under 16.

11.1 Consent

A young person aged 16 or 17 is presumed in law to be able to consent to their own counselling (Family Law Reform Act 1969, section 8). They also hold their own data protection rights. We do not ask for a parent’s or guardian’s consent, and we do not contact a parent, school or anyone else about a young person without their explicit consent, except through a formal safeguarding referral.

At the first session, the young person’s counsellor confirms and records that they understand what counselling involves and its confidentiality limits, and that they are attending freely.

11.2 Parents and guardians

• A parent or guardian does not have an automatic right to see a 16 or 17 year old’s records. We will normally decline a parent’s request unless the young person has given explicit permission, or there is a safeguarding reason that overrides confidentiality.
• Where a parent or guardian pays for the sessions, we hold their payment information separately from the young person’s referral information.
• Counsellors have agreed to consult Hope before responding to any request from a parent or guardian about a young person’s data.

11.3 Online design and complaints

Because our website is used by young people aged 16 and 17, we follow the ICO’s Age Appropriate Design Code (Children’s Code): high privacy settings by default, minimal data collection, and clear, age-appropriate language. If a young person raises a data protection complaint, we deal with them directly, in clear language, and involve a parent or guardian only with the young person’s agreement, unless their safety requires otherwise.

12. Marketing and messages

We send newsletters and marketing emails or texts only if you have opted in. You can unsubscribe at any time using the link in any email, by replying STOP to any marketing text, or by contacting us.

We may also contact you by email, text or phone about your enquiry, your free consultation, your payments or important changes to our service. These are not marketing messages, so you will still receive them if you opt out of marketing. Messages about your session dates come from your counsellor.

13. Your rights

You have the following rights. We will respond to valid requests within one calendar month (this can be extended in some circumstances, and we will tell you if so). There is normally no charge.

To exercise any of these rights, contact Ian Stockbridge at or on 0333 043 1850. We may need to confirm your identity first. If your request covers information held by your counsellor, we will tell them within 3 Business Days, and they will respond about the information they hold.

13.1 Automated decisions

We do not make decisions about you based solely on automated processing. Our team uses our records to help decide which available counsellor to offer you, but a person makes that decision.

13.2 Our data protection complaints procedure

Under the Data (Use and Access) Act 2025 you have the right to complain to us directly about how we have handled your personal information. You do not have to go to the ICO first, and we encourage you to contact us so we can try to put things right.

You can complain by:

• Email: , with “Data Protection Complaint” in the subject line
• Post: Ian Stockbridge, Hope Therapy & Counselling Services, Terriers House, Amersham Road, High Wycombe, Buckinghamshire, HP13 5AJ
• Telephone: 0333 043 1850 (9am–9pm, Monday to Sunday)
• Our website contact form, or social media. We accept complaints however they reach us

We will acknowledge your complaint as soon as possible and in any event within 30 days (the legal maximum; we aim to be much quicker), investigate it, keep you informed, and tell you the outcome without undue delay. We keep a secure record of every complaint and its outcome. Other complaints about our service are handled under our Client Complaints Procedure (client policy 08), and are acknowledged within two working days.

If you are not satisfied with our response, you can complain to the ICO at any time (Section 14).

14. Complaining to the ICO

Under the Data (Use and Access) Act 2025 the ICO is expected to become the Information Commission. Its contact details are not expected to change.

15. Changes to this policy

We review this policy at least once a year and whenever the law or ICO guidance changes. The date of the latest version is shown at the top of this policy.

16. Contact us

We aim to respond to all privacy enquiries within 5 working days.