Privacy notice

Last updated: 22 September 2026

This privacy notice explains how I collect, use, store, and protect personal information in my therapy practice.

I’m Kate Parkins, a psychotherapeutic counsellor working in person and online. I’m the data controller for personal information I collect through Good Place Therapy. I’m registered with the Information Commissioner’s Office for the storage of personal information (my registration number is ZA249017).

This means I’m responsible for deciding how personal information is used and for keeping it safe.

If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:

Email: kate@goodplacetherapy.com

Website: goodplacetherapy.com

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

1. Data processing principles

I take protecting online privacy and data security seriously. I’m guided by the following principles when processing data:

I collect and use your personal information only if I have sensible business reasons for doing so, such as providing a service to you.
I don’t collect data beyond what’s necessary to for these purposes.
I apply high technical standards to make sure I process data securely.
I don’t store data in identifiable form longer than is necessary for its purpose, or as legally required.

2. Your rights

Under UK data protection law, you have rights over your personal information. These include the right to:

Be informed about how your data is used.
Access a copy of your personal information.
Ask for inaccurate information to be corrected.
Ask for information to be deleted in some circumstances.
Restrict or object to certain processing.
Complain about how your information has been handled.

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance, or complaint-related reasons, and there may be limits on what I can disclose to you if the information includes third-party data or where a relevant exemption applies.

If you’d like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within 30 days. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

3. Information I collect

I may collect and use the following information.

When you contact me, I may collect:

Your name.
Your email address.
Your phone number.
The information you choose to share in your enquiry.
Any preferences around contact, availability, or therapy format.
Correspondence between us.

If we arrange a consultation or begin therapy, I may also collect:

Your address.
Your date of birth.
Your GP details.
Emergency contact details, where appropriate.
Relevant health, mental health or wellbeing information.
Information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy.
Brief clinical notes.
Attendance, payment and appointment information.
Correspondence between us.

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion, or other sensitive areas where these are relevant to therapy.

I only collect information that is necessary for providing therapy safely, ethically, and professionally.

4. How I use your information

I use your personal information to:

Respond to enquiries.
Arrange initial consultations and appointments.
Provide therapy.
Keep appropriate clinical records.
Manage payments and appointments.
Communicate with you about sessions.
Meet legal, professional, and ethical responsibilities.
Manage risk, safeguarding, or emergency situations where necessary.
Maintain insurance, tax, and accounting records.
Respond to data protection requests or complaints.

I do not sell or lend your personal data to third parties. I would only share your personal data with third party service providers where it is necessary to deliver a service, and only where I’m confident that the third party service provider has appropriate data protection systems and measures in place that are compliant with UK GDPR.

5. Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information.

For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

Contract: where information is needed to arrange and provide therapy.
Legitimate interests: where I need to use information to run my practice safely, respond to enquiries, keep appropriate records and protect both you and me.
Legal obligation: where I need to keep or share information to comply with the law.

Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.

Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

6. Confidentiality

Therapy is confidential, which means I won’t share what you tell me unless there’s a lawful, ethical, or safeguarding reason to do so. In these cases, I’d limit any sharing to the minimum information necessary.

I may need to share information if:

I believe there’s a serious risk of harm to you or someone else.
There’s a safeguarding concern involving a child, vulnerable adult, or person at risk.
I’m required to do so by law, court order, or legal process.
Disclosure is necessary to prevent or detect a serious crime.
There is a medical emergency and information is needed to protect life.
I need to consult my clinical supervisor, while protecting your identity as far as possible.

Where possible and appropriate, I’d aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

7. Supervision

Like other ethical therapists, I have a clinical supervisor to support my practice.

In supervision, I discuss aspects of client work to support safe and effective practice. I minimise identifying detail where possible and appropriate, and my supervisor is also bound by confidentiality and professional standards.

8. Clinical notes and records

I keep brief clinical notes to support safe and ethical therapy. These are factual, proportionate, and relevant to the work.

Clinical records may include:

Session dates.
Brief themes discussed.
Relevant risk, safeguarding, or clinical information.
Agreed actions or important decisions.
Contact and administrative information.

I do not keep a full transcript of sessions.

9. How long I keep information

I keep information only for as long as necessary for its purpose.

Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person. As a general guide:

Enquiry information may be deleted if we do not begin therapy, usually within 12 months.
Client records may be kept for 7 years after therapy ends, based on my retention policy and the reasons for keeping them.
If the work involved a child or young person, a different retention period may apply.
Financial records may be kept for the period required for tax and accounting purposes.
Emails, messages, and administrative records are reviewed periodically and deleted when no longer needed.

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.

10. Where your information is stored

Your information may be stored in the following systems:

Website / contact form: Squarespace
Email: Proton Mail
Practice management or client records: Google Workspace
Online sessions: Microsoft Teams
Cloud storage or backup: Google Workspace
Phone / messages: SMS

I use appropriate technical and organisational measures to keep information secure. This includes password protection, device security, two-factor authentication, restricted access, and secure storage.

Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.

Your information is securely stored as above which is not publicly accessible or stored in any public domain, it’s only accessible to me and and my clinical executor, and is password protected. Our third-party providers have their own privacy policies which you can view on their websites.

I may store or process your data on cloud-based platforms or service providers whose servers are based outside of the UK/EEA which may constitute a transfer of data under GDPR. I only use third party service providers when I’m confident that they have appropriate safeguards in place to make sure that any personal data transferred outside of the UK/EEA is subject to an equivalent level of security and protection as required under UK Data Protection Legislation, such as the UK Extension to the EU-U.S. Data Privacy Framework. To learn more about this, visit the U.S Department of Commerce’s website.

I also have appropriate procedures in place to handle any potential persona data breaches, in line with data protection legislation. I would report any breaches to the relevant supervisory authority and notify the affected data subjects where I’m legally required to do so.

11. Online therapy

If we work online, sessions will take place using Microsoft Teams. I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you won’t easily be overheard or interrupted.

Online platforms may process technical information such as IP address, device information, or connection data. Please also check Microsoft’s privacy notice if you would like more detail.

12. AI tools, transcription and recording

I do not use AI tools in any area of my therapy practice. Nor do I record or transcribe therapy sessions.

I use non-AI digital tools for general practice administration, writing, planning, or education.

I avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.

13. Website visitors and cookies

This website is hosted by Squarespace. Squarespace uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.

These functional and required cookies are always used, which allow Squarespace to securely serve this website to you. These analytics and performance cookies are used on this website to view site traffic, activity, and other data, but only when you accept the cookie banner.

This website uses font files from Google Fonts and Adobe Fonts. To properly display this site to you, servers where the font files are stored may receive information about you, including information about your browser, network, or device, and your IP address.

14. Sharing your information

I won’t share your personal information unless there’s a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate, and lawful:

My clinical supervisor.
Professional advisers, such as an accountant, insurer or legal adviser.
My professional body, if required in relation to a complaint or ethical matter.
Safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern.
A court or legal authority, if required by law.
An appointed clinical executor if I die or become unable to contact clients myself.
Trusted digital service providers who process data on my behalf.

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

15. Clinical will

I aim to have arrangements in place so that clients can be contacted if I die or become seriously incapacitated.

This may involve a trusted professional colleague or clinical executor having access to the minimum information needed to contact current clients and manage records appropriately.

That person would be bound by confidentiality, would only access information if necessary, and would not take on an ongoing therapeutic role unless separately agreed and appropriate.

16. Data protection concerns and complaints

If you have a concern about how I’ve handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it.

Please include:

Your name.
What your concern is about.
What you would like me to look into.
How you would prefer me to respond.

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.

If you’re not satisfied with my response, or if you’d prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

17. Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance, or the systems I use.

The latest version will be available here on my website.