Privacy Notice

Who I am

This privacy notice explains how Aga Detlaf Counselling collects, uses, and protects your personal data. I'm Aga Detlaf, a counsellor and psychotherapist and registered member of the British Association for Counselling and Psychotherapy (BACP), registration number 418237, MBACP.

I'm registered with the Information Commissioner's Office (ICO) as a data controller, which means I'm responsible for deciding how your personal data is processed and for keeping it safe.

What personal data I collect

Contact and administrative information: your name and contact details (email, phone), and — where relevant to your care — emergency contact and GP details.

Health and therapy-related information: your reason for seeking therapy, information about your mental and emotional health, relevant history you choose to share, and session notes documenting our work together.

Enquiry information: whatever you share when you get in touch by email or phone, or via the Contact page's form or booking calendar — name, and email and/or phone number, plus whichever of preferred contact method, preferred language, and a short scheduling note you choose to add. The contact form deliberately has no open-ended box for describing your situation — please don't share health or therapy-related details through it (see the notice on the form itself).

Health and therapy-related information is "special category data" under Article 9(1) of the UK GDPR — it gets enhanced legal protection because of its sensitive nature, with extra safeguards to keep it secure and confidential.

How I collect your data

Directly from you: at first contact (email or phone), during an initial assessment, during our sessions, and through any ongoing contact we agree between sessions. I don't collect personal data about you from third parties without your knowledge and consent.

Why I process your data — lawful basis

For your general contact and administrative information, I rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.

For your health-related information, I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional — with the additional condition under Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care purposes), met because I'm a qualified counsellor bound by a professional obligation of confidentiality under the BACP Ethical Framework.

Clinical supervision

As a BACP member I attend regular clinical supervision, as required of all BACP-registered counsellors. Your name and identifying details are never shared with my supervisor — only anonymised, pseudonymised case material. My supervisor is bound by their own professional body's confidentiality obligations.

Who I share your data with

I keep your information private. This website itself is static hosting on Netlify — it doesn't run a database or process your personal data directly. The Contact page's form and booking calendar send your details to a separate booking application I use (hosted on Railway, with its data stored in a Railway-hosted database), which sends the resulting notification and booking-confirmation emails through my own connected Google/Gmail account. Google and Railway act as data processors for this purpose only. Once you're a client, the only other routine sharing is with my clinical supervisor, and only in anonymised form.

Analytics: this site uses Plausible Analytics on the live production site only. It's cookie-less and doesn't collect personal data — only aggregated, anonymous visit statistics. No enquiry, booking, or session content ever reaches it.

I never sell your personal data, to anyone, for any reason.

International data transfers

This site's hosting provider, Netlify, may process basic technical data (like server logs) outside the UK as ordinary web-hosting infrastructure. No personal or health data about you is transferred this way — the site itself doesn't collect or store that data at all. The booking application (Railway) and Google (Gmail) may similarly process your contact/booking details as part of their ordinary infrastructure, which isn't guaranteed to be UK-only; where it isn't, they operate under their own standard data-protection safeguards.

How long I keep your data

Electronic records are kept encrypted and password-protected; paper records in a locked, secure location; access is restricted to me. At the end of the retention period, paper records are shredded and electronic records securely and permanently deleted.

Your rights under UK GDPR

You have the right to: be informed how your data is used (this notice); access a copy of the personal data I hold about you; have inaccurate or incomplete data corrected; in some circumstances have your data erased (this doesn't apply where I'm required to keep records for professional or insurance reasons); restrict or object to certain processing; request your data in a portable format where feasible; and not be subject to solely automated decision-making (I don't use any).

To exercise any of these rights, contact me at Aga.detlaf1@yahoo.com. I'll respond within one month; there's no fee for most requests.

Cookies

This website doesn't use cookies. Plausible Analytics (production only) is cookie-less and processes no personal data. The booking application (embedded on the Contact and Sessions & Fees pages) doesn't set cookies for visitors booking a session or using the contact form either — it only uses a cookie for Aga's own private admin login, which visitors never reach.

Confidentiality exceptions

What you share with me in therapy is confidential, with a small number of legally required exceptions (serious risk of harm, safeguarding concerns, a court order). See the full confidentiality policy on Terms / Counselling Agreement rather than duplicating it here.

Data protection complaints

If you believe your personal data has been mishandled, contact me first at Aga.detlaf1@yahoo.com — I take this seriously and will respond promptly. If you're not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

Changes to this notice

I review this notice regularly and whenever my practices, the law, or regulatory guidance change.

Contact