Your information, handled with care.

Who we are

The Ash Counselling Ltd is the data controller for the personal information we collect and process in connection with our counselling service.

What information we collect

Depending on how you use our service, we may collect and process:

• contact information such as your name, email address, telephone number and address;
• GP information and medical or health information relevant to counselling;
• emergency or next-of-kin contact details;
• assessment information, session notes and therapeutic records;
• payment and billing information; and
• communications with The Ash Counselling.

How we use your information

• providing counselling and therapeutic services;
• booking and managing appointments;
• processing payments;
• maintaining therapeutic and service records;
• meeting our duty of care and safeguarding responsibilities;
• supporting professional supervision and clinical governance; and
• responding to complaints, concerns or service enquiries.

Legal basis for processing

Depending on the information and purpose involved, our lawful bases may include:

• Contract — where processing is necessary to provide the counselling service you have requested.
• Legal obligation — where we need to meet legal or regulatory responsibilities.
• Vital interests — where information is needed to protect life or safety in an emergency.
• Consent — including where consent is the appropriate basis for optional communications or marketing.

Some information used in counselling is health information and therefore special-category personal data. We handle this information with additional care and only where an appropriate condition under UK data protection law applies.

Data sharing and disclosure

We do not share personal information routinely. Information may be disclosed where:

• required by law or a court order;
• necessary for safeguarding or protection of vital interests;
• required for professional supervision or clinical governance, using limited or anonymised information where appropriate; or
• you have given explicit consent for a specific disclosure.

How long we keep information

• Therapeutic records: normally 7 years after last contact, in line with our professional and organisational requirements.
• Financial records: normally 6 years for tax and accounting purposes.
• Communication records: normally 3 years unless they form part of the therapeutic record or another retention requirement applies.

Your data protection rights

Depending on the circumstances, your rights may include access, rectification, erasure, restriction, data portability, objection and withdrawal of consent where consent is the lawful basis.

You can also make a subject access request for a copy of personal information we hold about you. In most circumstances, there is no fee for making a subject access request.

How we protect information

We use appropriate technical and organisational measures designed to protect personal information, including access controls, authentication, secure systems, staff training and secure disposal of information when it is no longer required.

Questions, requests or concerns

Last updated: September 2026.