Appropriate Policy Document

Last updated: June 2026

This Appropriate Policy Document (APD) is required under Schedule 1, Part 4 of the Data Protection Act 2018 when special category or criminal offence data is processed in reliance on certain Schedule 1 conditions. It explains the procedures I follow to secure compliance with the data protection principles in Article 5 of the UK GDPR, and my policies on the retention and erasure of such data. It supplements my Privacy Policy and should be read alongside my Data Retention Policy.

1. Controller

Counselling with Lana is operated by Svjetlana Nowatschek, a BACP-registered integrative counsellor and the data controller. I am registered with the ICO; my registration reference is 00014598885. Contact: gdpr@counsellingwithlana.co.uk.

2. Description of the Data and the Schedule 1 Condition

In providing counselling, I process special category data concerning health (including mental and emotional wellbeing), as defined by Article 9(1) of the UK GDPR.

My lawful basis for processing this special category data is Article 9(2)(h) of the UK GDPR — processing necessary for the provision of health or social care or treatment by, or under the responsibility of, a health professional bound by an obligation of confidentiality. The corresponding condition in the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care).

Where I process information in order to protect an individual from harm (for example, safeguarding), I may also rely on related conditions such as Schedule 1 conditions for safeguarding or the protection of an individual's vital interests under Article 9(2)(c). This document covers all such processing.

3. Compliance with the Article 5 Principles

(a) Lawfulness, fairness and transparency

I process special category data lawfully under Article 9(2)(h) and the corresponding Schedule 1 condition above. I am transparent about my processing through my Privacy Policy and GDPR Statement, which are provided to clients and available on this website.

(b) Purpose limitation

I collect this data only for the purpose of providing safe, effective counselling and meeting my associated professional, legal, and insurance obligations. I do not use it for any incompatible purpose.

(c) Data minimisation

I collect and record only the information that is relevant and necessary for our therapeutic work. Session notes are kept brief and proportionate.

(d) Accuracy

I take reasonable steps to keep records accurate and up to date, and I correct inaccuracies promptly when they come to light. You can ask me to correct any information you believe is inaccurate.

(e) Storage limitation

Special category data is retained only for as long as necessary, in line with the periods set out in my Data Retention Policy (client therapy records are kept for 7 years after our last session). After the applicable period, records are securely destroyed.

(f) Integrity and confidentiality (security)

Electronic records are encrypted and password-protected on secure UK/EU-based systems, with access restricted to me alone (and my Clinical Executor in the event of my incapacity or death). Any paper records are kept in a locked cabinet. I work within the BACP Ethical Framework and a professional duty of confidence.

Accountability

I keep this document and my wider data protection records under review so that I can demonstrate compliance with the principles above. Where I rely on a Schedule 1 condition, my record of processing notes the condition relied upon, how the processing satisfies Article 6, and whether the data is retained and erased in line with the policies referenced here.

4. Retention and Erasure

My retention and erasure procedures for special category data are set out in full in my Data Retention Policy. In summary, clinical records are retained for 7 years after the last session and then securely and permanently destroyed, unless a longer period is required by law, insurance, or safeguarding obligations.

5. Review and Retention of This Document

I will keep this Appropriate Policy Document under review and will update it whenever my processing or the law changes. In any event, I will review it at least annually. I will retain this document throughout the period of relevant processing and for a minimum of six months after that processing ends, and I will make it available to the Information Commissioner's Office on request, free of charge.

Next review due: June 2027.