Privacy & Practice Policies

(Counselling & Clinical Supervision — UK GDPR, DPA 2018, DPDI Act 2026)

1. Who I Am

I am Sue Mort, a UK‑based counsellor, clinical supervisor and clinical hypnotherapist, accredited with the National Counselling and Psychotherapy Society (NCPS), registered with the British Association for Counselling and Psychotherapy (BACP), and a member of the International Hypnotherapy Association (IHA), and I am guided by the ethical frameworks of these organisations.

Data Controller: Sue Mort

Email: hello@suemorttherapies.co.uk  (previously at susanmort@ymail.com)

Website: www.suemorttherapies.co.uk (previously www.counsellingbridgendcf32.co.uk)

Location: Bridgend, South Wales, UK

This policy explains how I collect, use, protect and store your personal data when you engage with my services.

2. The Information I Collect

2.1 Contact Information

• You name
• Your email address
• Your phone number
• Your emergency contact phone number (optional)
• Your GP’s contact details, and other medical professional if appropriate (eg psychiatrist’s details).

2.2 Administrative Information

• Appointment history
• Invoices and payment records
• Correspondence from emails, phone messages or social media
• Supervision records

2.3 Clinical Information (Special Category Data)

• Mental health and emotional wellbeing
• Family or personal history
• Risk or safeguarding concerns
• Protected characteristics (e.g., ethnicity, sexuality, gender identity)

All sensitive data is handled with the highest level of confidentiality.

3. Lawful Bases for Processing

I process personal data under the following lawful bases:

• Contract — to provide counselling or supervision
• Legitimate Interests — responding to enquiries, managing appointments, maintaining records
• Legal Obligation — safeguarding, data protection, court orders, HMRC requirements
• Vital Interests — serious risk of harm
• Special Category Data — Article 9(2)(h) (healthcare) and Article 9(2)(a) (explicit consent where required). ((h) information required in order to provide therapy, (a) anything requiring additional processing outside my regular professional services)

4. How Your Information Is Used

Your information is used to:

• Provide therapy including counselling and hypnotherapy, and supervision or pastoral support
• Provide personal support and follow up, where appropriate
• Maintain clinical and administrative records
• Communicate about appointments
• Manage payments
• Meet ethical, legal, and safeguarding obligations
• Discuss anonymised material in supervision
• To improve my services and client experience

5. Storage of Notes & Data Security

Your data is stored securely using:

• Encrypted devices
• Password‑protected systems
• Secure email
• Encrypted OneDrive cloud storage
• Locked physical storage (if used)

Only I have access to your identifiable information.

6. Retention Periods

• Adult counselling and hypnotherapy notes: for the time advised by my insurer, Howden, and my professional guiding bodies, NCPS and IHA
• Supervision notes: as above
• Financial records: 6 years (HMRC requirement)
• Enquiry emails: 12 months
• Safeguarding records: retained per statutory guidance

7. Sharing Your Information

I will only share information in the event of:

7.1 Required by Law

• Serious risk of harm
• Safeguarding concerns
• Court orders
• I am incapacitated somehow eg by illness or death whereupon an appointed, trusted professional will contact you.

7.2 Professional Supervision

• Material is anonymised.

7.3 With Your Explicit Consent

• GP or other appropriate medical professional
• Multi‑agency work
• Professional referrals

I do not sell or trade your data.

8. Your Rights

You may request to:

• Access your data
• Correct inaccuracies
• Request deletion (where appropriate)
• Restrict or object to processing
• Request data portability
• Withdraw consent (where consent is the basis)

Contact: hello@suemorttherapies.co.uk

9. Website Data & Cookies

Cookies

This website uses cookies to ensure it functions properly and to understand how visitors use the site.

Types of cookies used:

• Essential cookies (security, page loading)
• Analytics cookies (only with consent)
• Embedded content cookies (e.g., maps, videos, booking widgets)

You can manage cookies via the banner or your browser settings.

Website Analytics

Your browser may automatically share:

• IP address
• Browser type
• Basic usage data

No advertising or tracking cookies are used.

10. Data Breach Procedure

If a data breach occurs that risks your rights or freedoms, I will:

• Notify you without undue delay
• Notify the ICO, https://ico.org.uk, within 72 hours (if required)

I will secure systems, assess impact, document the breach, and take steps to prevent recurrence.

11. Online Counselling & Supervision Policy

• Sessions take place via Microsoft Teams using a private, password‑protected account, or WhatsApp video which is end-to-end encrypted and password protected devices. (Please note, no internet-based communication can be guaranteed to be completely risk-free)
• Sessions are not recorded
• Clients must ensure privacy at their location
• If connection drops, I will attempt reconnection for up to10 minutes, then continue by phone or reschedule
• Clients confirm their location and provide an emergency contact at each session
• Online work may not be suitable for everyone; alternatives may be discussed

12. Diversity & Inclusion Statement

I welcome clients and supervisees of all identities, including diversity in:

• race and ethnicity
• gender identity and expression
• sexual orientation
• disability and neurodivergence
• age
• religion or belief
• relationship style or family structure
• socioeconomic background

My practice is guided by the BACP Ethical Framework, ongoing CPD, and a commitment to challenging discrimination and inequality.

13. Processor Agreements

one.com Webmail (Email)

I use Webmail provided by one.com to send and receive emails relating to my counselling, supervision and hypnotherapy services. One.com acts as my data processor, providing encrypted email services compliant with UK GDPR providing the email hosting and associated services on my behalf.

Please note that while email communications are protected using encryption during transmission and storage, standard email is not generally considered completely secure for sending highly sensitive or confidential information. I therefore recommend that clients avoid including detailed clinical or health information in routine emails wherever possible.

Microsoft OneDrive (Cloud Storage)

Microsoft acts as a data processor, providing encrypted cloud storage with secure access controls and multi‑factor authentication.

I remain the data controller.

14. Safeguarding Statement

I follow UK safeguarding legislation and the ethical frameworks of the NCPS and BACP. I may share information if I become aware of:

• risk of harm to you or others
• child or vulnerable adult safeguarding concerns
• serious crime
• legal requirements

Where possible, I will discuss this with you first and share only the minimum necessary information.

15. Complaints Procedure

If you have concerns about how your information is handled, please contact me at hello@suemorttherapies.co.uk. I aim to respond within 30 days.

If unresolved, you may contact:

• Information Commissioner’s Office (ICO) — data protection concerns
• The National Counselling and Psychotherapy Society (NCPS) — ethical or professional concerns

You have the right to make a complaint at any time.

16. How to Raise Concerns

If you have concerns about our work together, you are welcome to raise them in session or by email. I will respond thoughtfully and within a reasonable timeframe. If you feel unable to speak with me directly, or the issue remains unresolved, you may contact the BACP or ICO.

17. Updates to This Policy

This policy reflects the DPDI Act changes effective from 19 June 2026. Future updates will be posted on this website.