top of page

Privacy Policy
 

Last updated: 19 August 2026

Who I am
 

I am Veronica Surfaro, a psychotherapist providing private talking therapy services to individuals seeking support with their mental health and wellbeing.

You can contact me at:

  • Email: veronicasurfarocounselling@gmail.com

  • Phone: 07864 119996
     

I am the “data controller” for the personal information I collect about you and am registered with the Information Commissioner's Office (ICO). I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

What information I collect
 

I may collect and store:
 

  • Contact details – your name, email address, phone number and preferred contact method.

  • Background information – brief notes you share when you first get in touch (for example, what you’d like help with).

  • Session notes – brief, factual notes I write after or during sessions.

  • Administrative information – invoices, payment records, appointment dates and times.

  • Website data – basic information about how you use my website (see “Cookies” below).
     

I only collect information that I need in order to provide counselling safely and professionally, and to run my business.

Why I collect your information (legal bases)
 

Under GDPR, I must have a legal reason to use your data. I rely on:
 

  • Contract – to provide counselling sessions you have asked for.

  • Legitimate interests – to run and protect my business (for example, keeping basic records, managing appointments, improving my website).

  • Legal obligation – to keep certain records for tax or insurance purposes.

  • Consent – for specific things you can say yes or no to (for example, sending you information not directly related to your sessions). You can withdraw consent at any time.

How I collect your data

I collect personal data directly from you in the following ways:
 

  • When you first contact me to enquire about therapy (by email or telephone)

  • During your initial assessment session

  • Throughout our ongoing therapeutic work together

  • Through any correspondence between us (emails, telephone calls, or letters)

I do not collect personal data about you from any third parties unless you have given me explicit permission to do so (for example, if you ask me to liaise with your GP).

How I use your information
 

I use your information to:
 

  • Arrange and provide counselling sessions.

  • Keep brief notes to support our work together.

  • Contact you about appointments, changes or cancellations.

  • Keep financial records for tax and accounting.

  • Keep my website secure and easy to use.
     

I never sell your data to anyone or use it for unrelated marketing.

How I store your information and for how long
 

Counselling notes are legally classified as health data. As such, I store your information securely, using password‑protected devices and secure online systems.

If you decide to not engage in therapy after the initial consultation, I will ensure all your personal data is deleted within a week. If you would like me to delete this information sooner, please let me know.

If we do engage in therapeutic work, I keep your counselling records for up to 7 years after our work ends in line with the GDPR requirements, unless I am required by law or my professional body/insurer to keep them longer. After this time, I delete or securely destroy them.

Sharing your information
 

I treat your information as confidential. I will not share it with others except:
 

  • With your consent – for example, if you ask me to share information with your GP or another professional.

  • For professional support – I may discuss my work in supervision, but I do not use your full name or identifying details.

  • If required by law – for example, if a court orders me to share information.

  • To prevent serious harm – if I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services. I will try to discuss this with you first where possible.

    If I use third‑party services (for example, for email, video sessions, payments or online booking), I choose providers who take data protection seriously and have their own privacy policies.

Your rights under GDPR
 

You have the right to:
 

  • Access – ask for a copy of the personal information I hold about you.

  • Rectification – ask me to correct information that is wrong or incomplete.

  • Erasure – ask me to delete your information in some circumstances (this may not apply where I must keep records for legal or professional reasons).

  • Restriction – ask me to limit how I use your information.

  • Objection – object to certain types of processing.

  • Data portability – ask for your information in a format you can move to another provider (where applicable).


To make a request for any personal information I may hold about you, please put the request in writing, addressing it to veronicasurfarocounselling@gmail.com.

 

Complaints
 

If you have any concerns about how I handle your personal information, please contact me so I can try to resolve the issue.


Contact details
Name: Veronica Surfaro
Email: veronicasurfarocounselling@gmail.com
Phone: 07864 119996


I will take your concerns seriously, look into your complaint and respond as soon as I can. This applies whether you are a current, past or prospective adult client.
 

If you are not satisfied with my response, or you believe I am not complying with data protection law, you can complain to the UK data protection regulator:

Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Cookies and website use
 

My website may use cookies – small text files stored on your device – to help the site work properly and to understand how visitors use it.
 

Types of cookies that may be used:
 

  • Essential cookies – needed for the site to function (for example, security, basic features).

  • Analytics cookies – to collect anonymous statistics about how visitors use the site (for example, which pages are visited).

  • Functional or preference cookies – to remember your settings or choices.
     

When you first visit the site, you may see a cookie banner that lets you accept or manage your cookie preferences. You can also control cookies through your browser settings by blocking or deleting them. If you disable some cookies, parts of the site may not work properly.
 

If I use third‑party tools (for example, embedded videos, maps, booking or payment services), they may set their own cookies. Please check their privacy or cookie policies for more details.

Online contact forms and emails
 

If you contact me through a form on this website or by email:
 

  • I will use the information you provide only to respond to your enquiry and to arrange sessions if you choose to work with me.

  • Emails and forms are not always fully secure, so please avoid sharing very sensitive details in your first message.

Professional obligations, CPD, supervision, insurance and DBS

I am a registered member of the UKCP and I work in line with their Ethical Framework. This includes a commitment to ongoing continuing professional development (CPD), such as training, workshops and regular reading, to keep my knowledge and skills up to date. I also attend regular clinical supervision, where I discuss my work in a confidential and anonymised way to support good practice and your safety.

I hold current Professional Indemnity and Liability insurance for my counselling work that covers me to work in person and online. Furthermore, I hold an up‑to‑date Disclosure and Barring Service (DBS) check.

Clinical will
 

In the unlikely event that I am suddenly unable to work (for example due to serious illness, accident or death), I have a professional “clinical will” in place with a trusted therapist colleague.

If this happens, my clinical will holder may:
 

  • Access my client list and basic contact details.

  • Contact you to explain the situation and that I can no longer offer therapy.

  • Provide information about how you might find alternative support, if you wish.
     

They will only see the minimum information needed, will keep it confidential, and will delete or securely return any client information once their role is complete.

Changes to this policy
 

I may update this Privacy Policy from time to time. The latest version will always be available on this page, with the date last updated at the top.

bottom of page