Privacy Policy

How I collect, use, and protect your personal information.

Last updated: June 2026

Counselling with Lana ("I", "me", "my") is committed to protecting your privacy and ensuring your personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR).

This policy explains what personal data I collect, why I collect it, how I use and store it, and your rights regarding your data.

1. Who I Am

Counselling with Lana is a private counselling practice operated by Svjetlana Nowatschek, a BACP-registered integrative counsellor based in Southeast London. For the purposes of data protection law, I am the data controller, which means I am responsible for deciding how your personal data is used and for keeping it safe.

ICO registration: As a data controller who processes health information electronically, I am registered with the Information Commissioner's Office (ICO). My registration reference is 00014598885.

Contact (data protection): gdpr@counsellingwithlana.co.uk

2. What Data I Collect

a) Website Enquiry Form

When you contact me via the website enquiry form, I collect:

  • Your name
  • Email address
  • Phone number (if provided)
  • Preferred session type
  • The content of your message
  • Your consent confirmation
  • Your IP address and submission timestamp (for security purposes)

b) Counselling Clients

If you become a client, I may also collect:

  • Contact details and, where you provide them, an emergency contact
  • The reasons you are seeking therapy (your presenting issues)
  • Relevant health and medical information you choose to share
  • Session notes recording our therapeutic work together
  • Risk assessments, where appropriate
  • Assessment and outcome information
  • Payment records

Special category data: Health- and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection because of its sensitive nature, and I take additional care to keep it secure.

c) Website Cookies

This website uses only essential cookies required for the site to function (e.g., session security and remembering your cookie preference). No tracking, analytics, or marketing cookies are used, and the website fonts are self-hosted, so no third-party font services are contacted when you browse. See the Cookie Policy for full details.

3. How I Collect Your Data

I collect personal data directly from you, in the following ways:

  • When you first contact me to enquire about therapy (by email or through the website enquiry form)
  • When you complete any intake or assessment information
  • During our sessions, through our conversations
  • Through emails, messages, or calls between us

I do not collect personal data about you from other sources unless you specifically ask me to liaise with another professional (such as your GP) and give me your written consent to do so.

4. Why I Process Your Data (Lawful Basis)

Under UK GDPR I must have a valid lawful basis for processing your personal data. Because therapy involves health-related information, I rely on a basis under Article 6 (for general personal data) and a separate condition under Article 9 (for special category health data):

  • Consent (Article 6(1)(a)): When you submit an enquiry form, you give consent for me to process your data to respond to your enquiry.
  • Contract (Article 6(1)(b)): When you become a client, I process your data as necessary to provide the counselling service you have engaged me for, manage appointments, and handle payments.
  • Legitimate interests (Article 6(1)(f)): To maintain the security of the website and prevent fraud.
  • Legal obligation (Article 6(1)(c)): Where I am required to retain records to comply with legal, regulatory, or tax requirements.
  • Health or social care (Article 9(2)(h)): For your special category health data, processing is necessary for the provision of health or social care or treatment by a health professional bound by a duty of confidentiality. The additional condition under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care).

5. Professional Supervision

I am required by the BACP to attend regular clinical supervision. This is an essential part of safe, good-quality practice. When I discuss my work in supervision:

  • Your name and identifying details are not shared
  • I use anonymised case material only
  • My supervisor is a qualified professional bound by their own confidentiality obligations

6. Clinical Will

I have arrangements for a Clinical Executor — a trusted fellow therapist who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly. If this happens, my Clinical Executor will contact you, offer to refer you to another therapist if you wish to continue therapy, handle your records with complete confidentiality, and securely destroy them at the appropriate time in line with this policy. My Clinical Executor is bound by their own professional confidentiality obligations.

7. How I Use Your Data

  • To respond to your enquiry
  • To arrange and provide counselling sessions
  • To maintain clinical records as required by the BACP Ethical Framework
  • To process payments
  • To comply with legal and professional obligations

I will never sell or rent your personal data, and I will never share it with third parties for marketing purposes.

8. Data Storage & Security

Your data is stored securely using the following measures:

  • Electronic records are encrypted and stored on password-protected devices and systems
  • Any paper records are kept in a locked cabinet
  • Access to your records is restricted to me alone (and, in the event of my incapacity or death, my appointed Clinical Executor)
  • Website enquiries are transmitted over a secure (HTTPS) connection and handled on UK/EU-based servers provided by my hosting provider, IONOS

9. Who I Share Your Data With

I take your confidentiality seriously and only share your personal data where necessary. My accounting is done in-house, so no external bookkeeper has access to your information. Limited data may be processed by the following:

  • Clinical supervisor: anonymised case material only — no name or identifying details.
  • Hosting & email (IONOS): my website and email are hosted by IONOS, which processes website enquiries and email on UK/EU-based servers.
  • Online session tools (Microsoft Teams and WhatsApp): if we meet online, the video call is carried over Microsoft Teams or WhatsApp, depending on your preference.

I may also be required to disclose information for safeguarding, in response to a legal requirement or court order, or — in the event of a complaint to the BACP — to my professional body. See section 13. I never sell your personal data.

10. International Transfers

Your records are stored within the UK/EU. However, the online session tools I use may process some data outside the United Kingdom:

  • Microsoft Teams (Microsoft Corporation, USA)
  • WhatsApp (Meta Platforms, Inc., USA)

Where data is transferred outside the UK, I rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism, in accordance with UK GDPR Chapter V and the Data (Use and Access) Act 2025. You can ask me for more information about these safeguards at any time.

11. Data Retention

I keep your personal data only for as long as necessary. In summary: client records are kept for 7 years after our last session, financial records for 6 years (HMRC requirement), and website enquiries for up to 12 months. Full details are set out in my Data Retention Policy.

12. Your Rights

Under UK data protection law, you have the following rights regarding your personal data:

  • Right to be informed: to know how I collect and use your data — this policy fulfils that right.
  • Right of access: to request a copy of the personal data I hold about you (a "subject access request"). Under the Data (Use and Access) Act 2025, I will carry out a reasonable and proportionate search to respond.
  • Right to rectification: to have inaccurate or incomplete data corrected.
  • Right to erasure: to request deletion of your data, subject to legal and professional retention requirements.
  • Right to restrict processing: to ask me to limit how I use your data in certain circumstances.
  • Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
  • Right to object: to object to certain processing, including direct marketing (which I do not carry out).
  • Rights relating to automated decision-making: I do not use automated decision-making or profiling in my practice.

To exercise any of these rights, please email me at gdpr@counsellingwithlana.co.uk. I will respond within one month. There is no fee for most requests, although I may charge a reasonable fee or decline a request that is clearly unfounded or excessive.

13. Confidentiality — When I May Need to Share Without Your Consent

Confidentiality is fundamental to therapy. There are, however, rare circumstances where I may need to share information without your consent:

  • Risk of serious harm: if I believe you or someone else is at serious risk of harm.
  • Safeguarding: if I become aware of concerns about a child or vulnerable adult being abused or neglected.
  • Legal requirement: if a court orders me to disclose information.
  • Terrorism: where I am legally required to report certain information under the Terrorism Act 2000.

In all cases, I will try to discuss the situation with you first, unless doing so would itself put someone at risk, and I will share only the minimum information necessary.

14. Complaints

If you have concerns about how I handle your personal data, please raise them with me first so I can try to put things right — you can email me at complaints@counsellingwithlana.co.uk. See my Complaints page for the full process.

You also have the right to complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to This Policy

I review this policy regularly and may update it from time to time. Any changes will be posted on this page with a revised "last updated" date. If I make significant changes that affect how your data is used, I will let you know.

16. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact me:

Email: gdpr@counsellingwithlana.co.uk
Website: counsellingwithlana.co.uk