Privacy and cookie policy.

Who I am.

I am Amy Hutson, a BACP accredited counsellor, supervisor and trainer. For data protection purposes I am the data controller, which means I decide what information is collected and what happens to it.

• Email: amy@amyhutsoncounselling.co.uk
• Telephone: 07767 745319
• Consulting rooms: Hollingbury Park Avenue, Fiveways, Brighton BN1 7JQ, and Netwerks Lewes, G06, 4 Fisher Street, Lewes BN7 2DG

I am registered with the Information Commissioner’s Office as a data controller. My registration reference is ZA803593.

What this covers.

This policy covers four groups of people: anyone who contacts me to ask about counselling, counselling clients, supervision clients and organisations I supervise for, and anyone who visits this website. Where something applies to only one of those groups, I have said so.

What I collect.

If you get in touch.

Your name, the contact details you give me, and whatever you choose to tell me about why you are getting in touch. You decide how much of that last part to say at this stage, and a first email does not have to contain any of it.

If we start working together.

Contact details, your GP's details, an emergency contact if you give me one, and brief session notes. I ask for your GP's details as a condition of starting work, because if I ever believed your life was at risk they are the person I would contact. Those notes are the part that matters most, because they are health information about you and the law treats them differently. There is a section on that below.

If I supervise you.

Your contact details, your professional registration, notes of what we discussed, and invoicing records. Your own clients are discussed without their identifying details, so I do not hold information about them.

If you visit this website.

Anything you type into a contact form, and standard information your browser sends, which includes your IP address, the pages you looked at and roughly where in the world you are. That is covered in the cookies section.

Why, and on what basis.

Data protection law says I have to have a lawful basis for everything I do with your information, and tell you what it is. Here it is in full.

What I do	Why	Lawful basis
Answer your enquiry	So I can reply and we can arrange a call	Legitimate interests, and steps taken at your request before entering a contract
Provide counselling or supervision	It is the service you have asked for	Performance of our contract
Keep session notes	To work safely and hold the thread of the work	Performance of our contract, and Article 9(2)(h) for the health information in them
Take my work to supervision	Required by the BACP Ethical Framework	Legitimate interests, and Article 9(2)(h)
Invoicing and accounts	Running a practice, and tax	Legal obligation
Disclose where there is serious risk	To protect someone's life or safety	Vital interests, or legal obligation where one applies
Run this website	To keep it working and see what is useful	Legitimate interests, and consent for anything set out in the cookies section

Health information, and the extra rules that apply.

What you tell me in a session is health information. The law calls it special category data and it needs a second condition on top of the ordinary one.

The condition I rely on is Article 9(2)(h) of the UK GDPR, which covers the provision of health or social care by a professional under a duty of professional secrecy, together with paragraph 2 of Schedule 1 to the Data Protection Act 2018. That professional duty is the BACP Ethical Framework, and it is why the answer here is not simply “because you consented”. Consent is a poor basis inside a therapeutic relationship, because it is hard to be sure it is freely given by someone who wants the therapy to continue. The law gives counsellors a better one, and I use it.

Where I would go beyond providing your care, for instance writing to your GP or an employer, that is your decision and I ask for it in writing.

Who else sees it.

Nobody, in the ordinary run of things. The exceptions are these.

• My clinical supervisor, who is bound by the same confidentiality and who hears about the work rather than about you by name.
• My accountant, who sees invoices and payments, not notes.
• The companies whose software I use to run the practice, listed below. They act on my instructions and cannot use your information for their own purposes.
• Anyone I have to tell in the four situations described in the terms and conditions.

I do not sell your information, I do not share it for marketing, and there is no advertising on this site.

The software I use.

• Google. My email, Google Meet for online sessions, and Google Calendar, which is where appointments are booked. Google is a United States company, so some information is processed outside the UK. That is covered by the transfer safeguards in Google's data processing terms.
• 20i. Hosts this website. A UK company, with UK data centres.
• Cloudflare. Sits in front of this website to keep it fast and secure, and sees visitors' IP addresses. A United States company with servers worldwide.

Session notes are in none of these. They are handwritten and kept on paper, as set out under "Where it is kept" below.

How long I keep it.

Enquiries that do not become work are deleted within six months. Invoices and accounting records are kept until five years after the 31 January self-assessment deadline for the tax year they relate to, which is what HMRC requires of a sole trader. Session notes are kept for a set period after the work ends and then securely destroyed.

Session notes and records are kept for seven years after our final session, then securely destroyed. Supervision records are kept for seven years after the supervision ends. Seven years is the period set in my client agreement and my supervision agreement, chosen to match professional indemnity insurance guidance and the time limits for civil claims.

Where it is kept.

Session notes are handwritten, kept without full names on them, and locked away, so a note on its own does not identify anyone. I do not take client records out of the places they belong.

No system is perfect. If something did go wrong, I would report it to the ICO within seventy-two hours of finding out, where the law requires that, and I would tell you directly where the breach was likely to put your rights and freedoms at high risk.

Your rights.

You can ask me to do any of the following, free of charge, and I will respond within one month.

• Tell you what I hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete what I hold, where I am not required to keep it.
• Stop or limit what I am doing with it while a question is sorted out.
• Give you your information in a portable form, or send it to someone else.
• Object to processing I have justified by legitimate interests.
• Withdraw consent, where consent is what I relied on. Withdrawing it does not undo anything done before you withdrew it.

Just ask me by email. I may need to check who you are first. There are narrow situations where part of a clinical record can be withheld, for instance where releasing it would identify somebody else. Where the concern is that release could cause serious harm, the law requires an opinion from an appropriate health professional, so that is not a judgement I would make on my own. If either ever applied I would tell you and explain why.

I do not make any decision about you by automated means, and I do not profile you.

Complaining.

Come to me first. Since 19 June 2026 you have had a statutory right to complain to me directly about how I have handled your information, and I have a duty to make that straightforward. I will acknowledge your complaint within thirty days of receiving it, and tell you the outcome without undue delay.

If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you use Relay UK, dial 18001 and then that number. Complaining to me first does not take away your right to go to them.

Cookies and similar technologies.

A cookie is a small file a website puts on your device. Some are needed to make the site work at all. Others are there to tell me which pages people actually read, so I write more of what helps.

When you first arrive you will see a banner. You can accept everything, reject everything that is not strictly necessary, or open the preferences and choose category by category. Rejecting is exactly as easy as accepting, which is the point. You can change your mind at any time from the same panel, and nothing on this site is withheld from you for saying no.

Since 5 February 2026, UK rules have not required consent for a small set of low-risk uses, including analytics used solely to improve the service, security, and remembering a preference such as a display setting. I still tell you about them here and you can still object. Anything used for advertising, profiling or tracking you across other websites needs your opt-in, and there is none of that on this site.

There is one thing I should be plain about. Google Analytics loads as soon as you arrive, but it starts in a restricted mode. It sets no cookies and it cannot recognise you on a later visit. It does tell Google that a page was viewed, along with the address of that page and your IP address, so I can count visits. If you accept analytics cookies, it begins setting the cookies listed below and can then tell a returning reader from a new one. If you reject, it stays restricted for as long as you are here.

The cookies this site sets.

Changes to this policy.

If I change how I handle your information I will update this page and change the date below. If a change affects current clients materially, I will tell them rather than leave it to be noticed.

Last updated 7 September 2026.