Privacy Notice: Grounded Stream Counselling
1. Introduction & Who We Are
At Grounded Stream Counselling, we take your privacy and the protection of your personal data extremely seriously. This policy outlines how we collect, store, and process personal data belonging to clients, website visitors, and parents/guardians booking services for children or teenagers.
Data Controller: Nyarai Sally Mhizha Grounded Stream Counselling
Contact Email: welcome@groundedstreamcounselling.com
ICO Registration Number: ZB550813
2. The Lawful Basis for Processing Your Data
Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases to process your information:
Contract: To provide therapeutic services when you or your child are actively in counselling.
Legitimate Interests: To safely manage administration and keep necessary historical logs after therapy has ended.
Special Category Data Basis: Because health data is highly sensitive, we process therapeutic records under Article 9(2)(h) of the UK GDPR (the provision of health or social care treatment).
3. What Information We Collect & Why
We limit data collection to what is strictly necessary to perform our clinical work safely:
Contact Information: Name, email address, phone number, and mailing address.
Child/Teen Data: Dates of birth, parent/guardian details, and school context (if relevant).
Clinical & Special Category Data: Initial intake details, brief anonymised session notes, and relevant medical or psychological histories.
Website Log Data: Anonymised tracking data (via cookies) to analyze overall traffic on our platform.
4. How We Securely Store Your Data
We protect sensitive records by using strict technological and organisational measures:
Any contact information or pre-therapy forms sent online are stored on password-protected devices.
All clinical session notes are heavily anonymised using a unique client reference code and kept physically separate from identifiable contact details.
Email communications are managed via a secure, encrypted provider.
5. When Data May Be Shared (Confidentiality Exceptions)
Your personal data and therapy details are strictly confidential. Information will only be shared outside the practice under these specific, narrow conditions:
Safeguarding & Harm Prevention: If there is a clear, imminent risk of serious harm to you, your child, or another individual.
Legal Obligation: If ordered to release files by a court of law.
Clinical Supervision: Non-identifiable case details are discussed with a qualified supervisor to maintain BACP/Professional Board ethical standards.
6. Data Retention: How Long We Keep Records
In line with UK professional indemnity insurance expectations and limitation periods, we securely archive client records for [typically 5 to 7 years, or until a child turns 25, depending on your insurance provider's exact requirement] after therapy ends. After this timeline, all hard copies are securely shredded, and digital files are permanently erased.
7. Your Legal Data Rights
Under data protection laws, you hold the following primary rights:
Right of Access: You can request a copy of the personal data we hold about you via a Subject Access Request.
Right to Rectification: You can request that we update or correct inaccurate data.
Right to Erasure: You can request the deletion of your personal records (subject to clinical and legal preservation overrides).
To exercise these rights, please email us directly. If you believe your data has been handled incorrectly, you have a right to lodge a formal complaint with the ICO.