Privacy Policy

1.) WHO I AM Talk Sphere is a private counselling practice operated by Katy Bray, based in Milton Keynes, England. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Katy Bray is the data controller. I am registered with the Information Commissioner's Office.

Data controller contact: Katy Bray, Talk Sphere — katybray@talksphere.co.uk — talksphere.co.uk

2.) WHAT PERSONAL DATA I COLLECT                                                                                                                                                                I hold contact details that you share when arranging an introductory call. Once you begin the counselling process, I also hold your contact details from the contact information form; any information you have shared with me on the assessment form and assessment scores. I am required to keep brief, secure notes of our work together.  CONTACT & IDENTITY INFORMATION • Your full name, date of birth, address, phone number, and email address • The name and contact details of an emergency contact (with your consent) • Your GP's name and surgery address HEALTH & THERAPEUTIC INFORMATION • Information about your mental and physical health, current medication, and relevant personal history • Session notes and any written material you bring to or create within sessions • Assessment information gathered prior to or at the start of our work • Any goals or outcomes we agree together FINANCIAL INFORMATION • Records of fees paid and any invoices issued • Bank or payment details if you pay by bank transfer (not retained beyond payment) COMMUNICATION RECORDS • Emails, text messages, or voicemails exchanged between us in connection with your therapy  NOTE I do not collect information about you beyond what is necessary for providing therapy and managing the therapeutic relationship.    3.) WHY I COLLECT INFORMATION                                                                                                                                                                       PURPOSE DETAIL Providing therapy - To deliver safe, effective, and continuous therapeutic support tailored to your needs Safety & risk management  -To assess and respond appropriately to any risk of harm to you or others Clinical supervision - To discuss my work confidentially with my supervisor as required by my professional body Scheduling & administration - To book, confirm, or reschedule appointments and manage fees Legal & professional obligations - To comply with my professional body's ethics code, insurance requirements, and applicable law Continuity of care - To enable appropriate handover or referral if I am unable to continue our work 4.) WHO I SHARE YOUR INFORMATION WITH Your information is held in strict confidence. I will only share it in the following limited circumstances: CLINICAL SUPERVISION As required by my professional body, I discuss my client work regularly with a qualified clinical supervisor. This is a cornerstone of ethical practice and helps ensure the quality and safety of your therapy. Supervision conversations are anonymised or pseudonymised wherever possible. My supervisor is also bound by professional confidentiality. SAFEGUARDING & RISK OF HARM If I have serious concerns that you or someone else is at risk of significant harm, I may need to contact relevant services (such as your GP, emergency services, or a local safeguarding team) without your consent. I will always try to discuss this with you first unless doing so would put you or others at greater risk. LEGAL REQUIREMENTS I may be required to disclose information in response to a court order, or under specific legislation (such as the Terrorism Act 2000 or the Proceeds of Crime Act 2002). I cannot withhold information in these circumstances. THIRD-PARTY SERVICE PROVIDERS I use a small number of carefully selected third-party services to run my practice securely, including encrypted email provider Microsoft Outlook,  video platform for online sessions (Zoom or Teams) , Calendly (to book sessions) and Go Daddy the website host. These providers are bound by data processing agreements and do not access your data beyond what is necessary for the service they provide. WHAT I WILL NEVER DO I will never sell, rent, or share your personal information with any third party for marketing or commercial purposes.

5.) LAWFUL BASIS FOR PROCESSING                                                                                                                                                                   I rely on the following lawful bases under UK GDPR to process your personal data:

Contract (Article 6(1)(b)): processing is necessary to provide the counselling services you have requested and to manage your appointments and payments.

Legitimate interests (Article 6(1)(f)): processing is necessary for my legitimate interests in operating a professional counselling practice, including maintaining records, responding to enquiries, arranging supervision,  and ensuring continuity of care, where these interests are not overridden by your rights.

Legal obligation (Article 6(1)(c)): processing is necessary to comply with my legal and safeguarding obligations, including those arising under the Children Act 1989, the Mental Capacity Act 2005, and other applicable legislation.

Vital interests (Article 6(1)(d)): in exceptional circumstances, I may process data to protect your vital interests or those of another person where you are unable to give consent. In rare circumstances where processing is necessary to protect someone's life (Article 6(1)(d))

For special category health data, I rely on Article 9(2)(h) (processing necessary for the provision of health or social care) and Article 9(2)(c) (vital interests) as appropriate. I additionally rely on substantial public interest (Schedule 1, DPA 2018 — health and social care purposes) and provision of health or social care (Article 9(2)(h) UK GDPR).    Information about your mental and physical health, sexuality, ethnicity, religion, or political views is classified as special category data under the UK GDPR and receives extra protection. This type of information is inherent to the therapeutic process. I only ever use it for the purposes outlined in this notice, and I apply additional safeguards including encryption, secure storage, and strict access controls. I will never use your sensitive personal information for marketing, research without your explicit consent, or any purpose outside the therapeutic relationship.

6. CONFIDENTIAILTY AND SAFEGUARDING                                                                                                                                      Everything discussed in sessions is held in strict confidence. I work within the BACP Ethical Framework, which requires that confidentiality be maintained except in specific circumstances. This is fundamental to the theapeutic relationship and I take it seriously.

However, there are specific circumstances in which I may need to break confidentiality, without necessarily seeking your prior agreement. These include: • If I believe there is a serious and imminent risk of harm to you or to another identifiable person • If you disclose information about the abuse of a child or vulnerable adult • If I am legally required to disclose information under specific legislation (including terrorism or money laundering laws) • If a court of law issues an order requiring me to produce records or give evidence

Where it is safe and appropriate to do so, I will discuss any proposed breach of confidentiality with you before taking action. I may also seek confidential supervision from a qualified clinical supervisor.

7. DATA RETENTION                                                                                                                                                                                                         I retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law or professional guidelines.

Clinical records and contact information are retained for a minimum of 7 years following the end of the therapeutic relationship, in line with BACP guidelines. For clients who were under 18 at the time of therapy, records are retained until the client's 25th birthday or for 8 years from the end of therapy, whichever is longer.

After the applicable retention period, all records are securely and permanently destroyed.

8. DATA SECURITY                                                                                                                                                                                                                 I take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. I also keep brief session notes to suppor the quality and continuity of our therapeutic work. Notes are written in a way that is meaningful to me as your therapist but would not unnecessarily identify or characterise you to a third party. Your data and the notes are stored securley on password-protected devices, encrypted storage, and secure email practices. Any paper documents are locked in a locked cabinet. The notes are kept seaparate from your contact details wherever possible. They are never stored on a unsecured device.  You have the right to request access to your records at any time

Where data is transmitted electronically (for example, via my website contact form), I use industry-standard encryption (TLS/HTTPS). No method of electronic transmission is completely secure; however, I take all reasonable steps to protect your data.

9. THIRD - PARTY PROCESSORS                                                                                                                                                                                I use the following third-party services which may process your personal data on my behalf. Each operates under its own privacy policy and, where required, a data processing agreement:

Calendly (calendly.com): used to manage appointment bookings. Calendly processes your name, email address, and any information you provide when booking. Their privacy policy is available at calendly.com/privacy.

GoDaddy / Airo (godaddy.com): my website is hosted on GoDaddy's Airo platform. Basic technical and contact form data may be processed by GoDaddy as part of website hosting and form submission services.

I do not share your personal data with any other third parties without your explicit consent, except where required by law or professional obligation.

Some of my third-party service providers (including Calendly) are based outside the UK and the European Economic Area (EEA). Please refer to Calendy's own privacy policy if you choose to use this.

10. COOKIES                                                                                                                                                                                                                          My website may use essential cookies to ensure it functions correctly. I do not currently use tracking, analytics, or advertising cookies. If this changes, I will update this policy and seek your consent where required.

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the website.

11. YOUR RIGHTS UNDER UK GDPR                                                                                                                                                                Under the UK GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting me. I will respond within one calendar month. PURPOSE DETAIL Right of access -  Request a copy of the personal data I hold about you (a Subject Access Request) Right to rectification  - Ask me to correct inaccurate or incomplete information Right to erasure - Ask me to delete your data, where there is no overriding legal reason to keep it Right to restrict - Ask me to limit how I use your data while a concern is resolved Right to portability - Receive your data in a structured format to transfer to another provider Right to object  - Object to processing based on legitimate interests PLEASE NOTE Some rights are subject to limitations in a clinical context. For example, I may retain records beyond a deletion request where there is a legal or professional obligation to do so. I will always explain my reasoning clearly if I am unable to fulfil a request in full.

12. CONTACT                                                                                                                                                                                                                         I review this privacy policy periodically and may update it to reflect changes in my practices or legal requirements. Any material changes will be posted on this page with an updated date. I encourage you to review this policy from time to time. If you have any questions about this privacy notice, wish to exercise your rights, or have concerns about how I have handled your information, please contact me in the first instance: PURPOSE DETAIL Name Katy Bray Email katybray@talksphere.co.uk Phone 07471 209645 Professional body BACP ICO registration 00015623936 MAKING A COMPLAINT If you are not satisfied with my response, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent authority for data protection: • Website: ico.org.uk/make-a-complaint • Helpline: 0303 123 1113 • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF You may also raise concerns about professional practice with my professional body: BACP. DOCUMENT VERSION This privacy notice was last reviewed on November 2026. I review it at least annually and whenever there is a significant change to my practice or to relevant legislation.