Data Retention Policy

Last updated: June 2026

This policy explains how long I keep your personal information, why I retain it, and how I dispose of it securely when it is no longer needed. I am committed to keeping your data only for as long as necessary and protecting it throughout its lifecycle.

Counselling with Lana is operated by Svjetlana Nowatschek, the data controller. I comply with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. I am registered with the ICO; my registration reference is 00014598885.

1. Why I Retain Your Data

• Legal obligations: certain records must be kept to comply with UK law, including tax and data protection requirements.
• Professional standards: as a counsellor in private practice, I keep records in line with the BACP Ethical Framework and the common-law duty of confidence.
• Insurance requirements: my professional indemnity insurance requires me to retain records in case a claim is made after therapy has ended.
• Continuity of care: records support your ongoing care and let me respond to future queries about your therapy.
• Safeguarding: in rare circumstances, records may be needed to support safeguarding processes or legal proceedings.

2. Retention Periods

Type of record	How long I keep it	Reason
Client therapy records (session notes, assessments, correspondence)	7 years after our last session	In line with the Limitation Act 1980 and standard professional indemnity insurance requirements
Enquiry and contact data (people who contact me but do not become clients)	12 months from last contact	To respond to follow-up enquiries (legitimate interests)
Financial records and invoices	6 years from the end of the relevant financial year	HMRC legal requirement
Insurance records	7 years	To support any potential insurance claims

After the applicable retention period, records are securely destroyed (see section 8).

3. What Information I Retain

• Contact details: your name, email address, phone number, and (where provided) an emergency contact.
• Session notes: brief records of our therapeutic work together.
• Assessments and agreements: initial assessment information, therapy agreements, and consent records.
• Correspondence: emails and other communications between us.
• Payment records: invoices and records of payments made.
• Booking information: appointment dates and times.

4. How Your Data Is Stored

Your information is protected by the following measures:

• Encryption: electronic records are encrypted to prevent unauthorised access.
• Password protection: records are stored on secure, password-protected systems and devices, hosted on UK/EU-based servers (IONOS).
• Restricted access: access to your records is restricted to me (Svjetlana Nowatschek) and, in the event of my death or incapacity, my appointed Clinical Executor.
• Paper records: any paper records are kept in a locked cabinet.

5. Who May Access Limited Information

While your therapy records remain confidential to me, limited information may be shared with my clinical supervisor — and only as anonymised case material, with no name or identifying details. My accounting is done in-house, so no external bookkeeper has access to your information.

6. Clinical Will

I have arrangements for a Clinical Executor — a fellow therapist bound by professional confidentiality — who will handle client records in the event of my death or incapacity. Should this arise, my Clinical Executor will contact you, offer to refer you elsewhere or securely destroy your records, handle everything with the same confidentiality you would expect from me, and securely destroy any unclaimed records after an appropriate period.

7. Your Right to Erasure

Under UK GDPR you have the right to ask me to delete your personal data. However, this right is not absolute. I may need to retain your records where:

• Retention is required under the Limitation Act 1980 (which allows legal claims to be brought for up to six years, or longer in some cases)
• My professional indemnity insurance requires me to keep records
• The information is needed for safeguarding purposes or legal proceedings
• I have another lawful basis for continued retention

If you request erasure and I am unable to comply fully, I will always explain my reasons clearly and in plain English, and delete any data that is not subject to these requirements.

8. Secure Disposal

When the retention period has expired and there is no other lawful reason to keep your data, I dispose of it securely:

• Electronic records: permanently deleted using secure deletion methods that make the data unrecoverable.
• Paper records: cross-cut shredded.

I keep a record of when data has been securely disposed of, to demonstrate compliance with data protection law.

9. Changes to This Policy

I may update this policy from time to time to reflect changes in law, professional guidance, or my procedures. The "last updated" date at the top shows when it was most recently revised.

10. Questions & Complaints

If you have questions about how long I keep your data, email me at gdpr@counsellingwithlana.co.uk. To make a data protection complaint, email complaints@counsellingwithlana.co.uk or see my Complaints page. If you are not satisfied with my response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

This policy forms part of my data protection documentation and should be read alongside my Privacy Policy and GDPR Statement.