GDPR / Privacy Policy

Updated: February 2026

Email: enquiries@outofthebluecounselling.org

This privacy policy applies to Lori Thackham (Data Controller) of Out of the Blue Counselling & Supervision, as well as (EFT) Emotional Freedom Technique (Tapping Therapy), and is relevant to her psychotherapeutic counselling, supervision and EFT services. This policy applies to her practice, website and services: online, telephone or in person.

Lawful Basis for Processing

Under Article 6 UK GDPR, personal data is processed for:

·       The performance of a contract (provision of counselling and supervision services); and

·       Legitimate interests in maintaining safe, effective and professionally accountable practice.

Under Article 9 UK GDPR, special category data (including health information) is processed for:

·       The provision of health or social care; and

·       The establishment, exercise, or defence of legal claims where necessary.

Information I Collect and How I Use It

In order to offer my psychotherapeutic counselling and supervision service in accordance with legal and ethical obligations, I gather and store the following:

·       Name, address, date of birth, contact number and email address

·       Reason for seeking counselling or supervision

·       Counselling history or supervision history

·       Medical information relevant to counselling or EFT

·       Medications relevant to counselling/mental health or EFT

·       GP details

·       Personal details: occupation, relationships, dependents, emergency contact number, relevant religious or cultural information

·       If relevant or necessary, assessment information recorded on PHQ-9, GAD-7 or CORE forms

·       Session notes

I use the Heidi Health App to transcribe what is discussed in sessions into notes. I will seek separate explicit written consent from you prior to using this application. You may withdraw this consent at any time.

How I Store Your Information

The above information, session notes, privacy statement/agreement, assessment and intake forms and client codes are stored on the WriteUpp cloud-based application, which is GDPR compliant and ISO27001 certified. Information is encrypted and stored securely. I use two-factor authentication to add another layer of security. For more information: https://www.writeupp.com/security

Telephone numbers are stored on my smartphone, which is locked and accessed by either a passcode or thumbprint. I store your number along with your first name and a code.

Email addresses are stored in my Outlook account.

Website: no personal information is stored on the website. Information used to collect and send enquiries to my Outlook account is not retained on the website.

Clients may find information about my service on third party websites – I do not control these sites and I am not responsible for how they collect, store, or use information.

Your contact details will be stored on the Clinical Wills Platform, so that in the event of my death or serious illness my Executor will be able to contact you. For more information: https://clinicalwill.app/security

Your information is kept for the time necessary to provide my service. Following the end of treatment, I retain clinical records for a period of 5 years in accordance with professional insurance requirements.

In the case of a child under 18, records will be kept for 5 years after they reach the age of 18.

Financial records are retained for 6 years in accordance with HMRC requirements.

After the relevant retention period, all data will be securely deleted or destroyed.

How I May Share Your Personal Information

I may have to share your personal data with:

·       Service providers who provide IT and system administration support

·       Professional advisors including lawyers, bankers, auditors and insurers

·       HMRC and other regulatory authorities

I require all third parties to respect the security of your personal data and to treat it in accordance with the law.

I attend monthly clinical supervision to maintain and ensure my practice is ethical and safe. Client material discussed in supervision is anonymised and presented without identifying details wherever possible.

I have a Therapeutic Will. In the event of my death or serious illness, my Therapeutic Executor (a qualified counsellor and supervisor who will observe confidentiality) may contact you if you are still in therapy. They may recommend alternative sources of support. Your contact details are securely held on the Clinical Wills Platform and access will only be granted if necessary.

If your health is at risk, I may share your details with a healthcare professional such as your GP or Mental Health Crisis Team.

It is not permissible for you to record our sessions without my explicit consent. Likewise, if I needed to record a session, it would only be done with your explicit consent.

From time to time, anonymised and non-identifiable information may be used with secure digital tools (such as document-editing, transcription, or AI-assisted drafting platforms) to support administrative tasks, document structuring, and professional reflective practice. No names, contact details, or identifying personal information are entered into such systems. This use is limited to enhancing efficiency and clarity within the practice and does not replace professional supervision, clinical judgment, or confidentiality safeguards. All identifiable client records remain stored securely within the practice’s designated record-keeping system in accordance with UK GDPR and NCPS ethical requirements.

Your Rights

You have rights relating to the information I hold:

·       To verify the accuracy of your data and request correction

·       To request access to the information I hold about you

·       To request that your data be supplemented or updated

·       To request restriction of processing in certain circumstances

·       To request data portability where applicable

·       To request erasure of your data where legally permissible

Information will be provided within one calendar month of a valid request.

Please note that some records cannot be erased where there is a legal or professional obligation to retain them.

If you have concerns about how your data is handled, you may contact me in the first instance using the email above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Website: www.ico.org.uk

Contact

I will contact you about appointments or to advise of any changes to my service by email, telephone, or text. If exceptional circumstances arise or we need to make contact for another reason, I suggest arranging a time to speak by phone in order to protect confidentiality.

When I am working my phone is on silent and if I miss a call from you, I aim to respond within one working day.