Privacy Policy

Cahya Counselling & Mindful Services ("Cahya", "I", "me" or "my") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information I collect, why I collect it, how I use and protect it, who it may be shared with, how long I retain it, and your rights in relation to your information.

I am responsible for deciding how and why your personal information is processed and am the data controller for the personal information I process in connection with Cahya Counselling & Mindful Services.

This Privacy Policy applies to information collected through counselling, hypnotherapy, enquiries, communications, payments and use of the Cahya website.

1. Information I may collect

Depending on how you interact with Cahya, I may collect:

Enquiries and contact information

  • name;

  • email address;

  • telephone number, where provided;

  • information contained in your enquiry or correspondence;

  • appointment availability and scheduling information.

Counselling and hypnotherapy information

When you become a client, I may collect information necessary to provide safe and appropriate counselling or hypnotherapy. This may include:

  • information about your circumstances, experiences and reasons for seeking support;

  • information relating to your mental or physical health where relevant;

  • medication or treatment information where relevant;

  • information about risk, safeguarding or other matters relevant to safe practice;

  • information discussed during sessions and contained in clinical notes.

Health information is special category personal data under UK data protection law. I only process this information where there is a lawful basis and where the additional requirements for processing special category data are met.

Administrative and financial information

I may collect:

  • invoices and payment information;

  • records of payments received;

  • information necessary for accounting and taxation;

  • correspondence relating to appointments, cancellations and fees.

I do not retain clients' full payment-card details.

Website information

When you visit the Cahya website, certain technical information may be collected depending on your cookie choices. This may include information about your device, browser, website usage and how you arrived at the website.

Further information is provided in the Cookies and Website Analytics section below.

2. How I use your information

I use personal information only where necessary for purposes such as:

  • responding to enquiries;

  • arranging and managing appointments;

  • providing counselling and hypnotherapy;

  • maintaining appropriate clinical records;

  • assessing and managing risk and safeguarding;

  • communicating with you about your appointments and therapy;

  • processing payments and maintaining financial records;

  • meeting professional, legal and regulatory obligations;

  • arranging professional supervision;

  • managing complaints or concerns;

  • establishing, exercising or defending legal claims where necessary;

  • maintaining business continuity and appropriate arrangements for client records;

  • improving and maintaining the Cahya website;

  • understanding website usage where you have consented to analytics.

I do not use counselling or hypnotherapy information for advertising purposes.

3. Lawful basis for processing

I process personal information using the lawful basis appropriate to the circumstances. Depending on the processing, this may include:

  • taking steps at your request before entering into an agreement;

  • performing my agreement with you;

  • complying with legal obligations;

  • pursuing legitimate interests, where appropriate and where those interests are not overridden by your rights;

  • protecting someone's vital interests where necessary;

  • your consent, where consent is the appropriate lawful basis, including for non-essential website analytics.

Where I process special category information, such as health information, I also rely on an applicable condition for processing special category data under UK data protection law.

Consent given for website analytics can be withdrawn through the website's cookie preferences.

4. Confidentiality

Confidentiality is an important part of the therapeutic relationship.

Information discussed during counselling or hypnotherapy is normally kept confidential. There are, however, circumstances in which information may need to be disclosed, including where necessary to:

  • protect you or another person from serious harm;

  • safeguard a child or vulnerable person;

  • comply with a legal or regulatory requirement;

  • establish, exercise or defend a legal claim; or

  • I feel the cookies s

Where reasonably possible and appropriate, I will discuss a proposed disclosure with you beforehand.

Confidentiality may also be limited where relevant information needs to be discussed within professional supervision. I take reasonable steps to ensure that identifying information is removed or minimised wherever reasonably possible.

5. Professional supervision

As part of my professional practice, I undertake professional supervision.

Relevant aspects of therapeutic work may be discussed with my supervisor for purposes including professional support, ethical practice, safeguarding and clinical development.

I take reasonable steps to anonymise or minimise identifying information when discussing client work in supervision.

6. Clinical records

I maintain appropriate clinical records to support safe and professional practice.

Counselling and hypnotherapy sessions are not recorded by me unless a separate arrangement has been specifically discussed and agreed.

Clients must not audio or video record sessions without prior agreement.

Clinical records are stored securely and access is restricted to what is reasonably necessary for my professional, legal and administrative responsibilities.

7. How long I retain information

I retain information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, professional, regulatory, insurance and safeguarding requirements.

Clinical records

Clinical records are normally retained for 7 years from the end of the therapeutic relationship.

At the end of the retention period, records will be securely deleted or otherwise securely disposed of, unless there is a lawful reason to retain them for longer.

A longer retention period may be appropriate where, for example, there is an ongoing complaint, legal claim, regulatory matter, safeguarding concern, insurance matter or other legitimate legal or professional reason.

Financial and tax records

Financial and tax records are retained for the period required by HMRC and applicable tax legislation.

These records may therefore be retained for a different period from clinical records.

Website consent records

Records relating to website cookie choices may be retained for the period necessary to demonstrate and manage consent and in accordance with the settings of the website's consent-management system.

Retention periods are reviewed periodically and should be proportionate to the purpose for which the information is retained.

8. Clinical will and continuity arrangements

As part of my professional contingency planning, I have a clinical will and have appointed an executor to help ensure that appropriate arrangements are in place for my client records should I die or become permanently unable to practise.

The purpose of these arrangements is to protect clients and ensure that confidential clinical records are handled securely and appropriately if I am no longer able to manage them myself.

My executor will not have unrestricted access to the content of clients' therapy records simply by virtue of being my executor.

Any access, transfer, storage or disposal of records will be managed in accordance with applicable data protection law, professional obligations and the instructions contained within my clinical will.

Appropriate digital and practical contingency arrangements are maintained separately from this Privacy Policy.

9. Who May Have Access to Your Information

I may use trusted third-party service providers to support the administration and delivery of Cahya Counselling & Mindful Services. I only share information where it is necessary for the service they provide, and I take reasonable steps to ensure that your information is handled securely and in accordance with data protection requirements. As some information is provided to me through the third party I advise you to refer to their privacy policy.

These providers may include:

  • Email and secure data storage

  • Website hosting and website services

  • Online counselling: Google Meet, when you choose to have sessions online

  • Payments and banking

  • Directory services: Counselling Directory or Psychology Today where you have contacted me or used the service to make an enquiry

  • Professional supervision: my clinical supervisor, where information is discussed as part of professional supervision. I discuss client information appropriately and avoid identifying details.

I may also share information where this is necessary with professional, legal, regulatory or insurance advisers, or where I am legally required or permitted to do so.

I do not sell your personal information or share your information with third parties for marketing purposes.

10. Payments

Payments for Cahya services are currently made by bank transfer unless otherwise agreed.

I keep appropriate records of payments received for accounting, taxation and business administration.

I do not ask clients to send payment-card details by email or retain full payment-card details as part of ordinary client records.

11. Online counselling

Online counselling may be provided using an agreed video platform such as Google Meet.

You are responsible for choosing a private and suitable location for online sessions and for taking reasonable steps to prevent others from overhearing the session.

I take reasonable steps to protect confidentiality when providing online sessions.

Online counselling is not an emergency or crisis service.

12. Website Cookies and Analytics

Cahya's website uses cookies and similar technologies.

Some cookies are strictly necessary for the website and its cookie preferences to function. Other cookies are used for analytics to help me understand how visitors use the website and improve its content and functionality.

Cahya currently uses:

  • Hostinger/Amplitude Platform Analytics; and

  • Google Analytics 4.

Analytics cookies are non-essential and are only used where you have given consent through the website's cookie banner.

Cahya does not currently use marketing or advertising cookies.

The website allows you to accept, reject or manage your cookie preferences. You can change or withdraw your consent to analytics cookies through the website's cookie controls.

For further information about Google's use of data, please refer to Google's privacy information.

13. Website links

The Cahya website may contain links to other websites or online services.

I am not responsible for the privacy practices, content or security of external websites. You should review the privacy information of any external website before providing personal information.

14. Data security

I take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include appropriate access controls, secure passwords, multi-factor authentication where available, secure storage and careful management of digital information.

No method of electronic storage or transmission can be guaranteed to be completely secure, but I take reasonable steps to reduce the risks associated with processing personal information.

15. Your data protection rights

Depending on the circumstances, you may have rights under UK data protection law including:

  • the right to be informed about how your information is used;

  • the right to access your personal information;

  • the right to request correction of inaccurate information;

  • the right to request erasure in certain circumstances;

  • the right to request restriction of processing in certain circumstances;

  • the right to object to certain processing;

  • the right to data portability where applicable; and

  • the right to withdraw consent where processing is based on consent.

These rights are subject to legal limitations and may not apply in every circumstance.

If you would like to exercise a data protection right, please contact me using the details below.

16. Complaints

If you have concerns about how I have handled your personal information, please contact me first so that I can try to resolve the matter.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully or your data protection rights have not been respected.

Information about the ICO and how to make a complaint is available through the ICO website https://ico.org.uk/make-a-complaint/.

17. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to my services, technology, legal or professional requirements, or the way personal information is processed.

The current version will be made available on the Cahya website.

Where changes are significant, I will take reasonable steps to draw them to clients' attention where appropriate.

18. Contact

If you have questions about this Privacy Policy, your personal information or your data protection rights, please contact:

Bethan Thomas
Cahya Counselling & Mindful Services
Email: info@cahya.co.uk

I aim to respond to privacy-related enquiries within a reasonable timeframe and in accordance with applicable data protection requirements.

Terms of service

Norton, Stockton-On-Tees