This page explains how I collect, use and protect your personal information, and your rights in relation to the information I hold about you.

1. Introduction

Any personal data you provide to Duncan Roebuck Counselling & Psychotherapy, whether verbally, in writing or electronically, will be held and processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Duncan Roebuck is the data controller for Duncan Roebuck Counselling & Psychotherapy and for the personal information described in this policy.

This privacy policy explains what information I collect, why and on what legal basis I use it, how I store and protect it, how long I keep it, the circumstances in which I may share it, and your rights in relation to the information I hold about you.

This privacy policy may be updated from time to time.

2. Legal basis for processing your information

I collect and use personal information where this is necessary to provide and administer psychotherapy services that you have requested from me. This includes information provided when you make an enquiry or arrange a scheduled phone call or introductory/initial appointment, as well as information I keep while we are working together. My lawful basis for this is Article 6(1)(b) of the UK GDPR, which covers processing necessary to provide a service under a contract, including steps taken at your request before entering into that contract.

Psychotherapy also involves information about your health and other sensitive aspects of your life. This is classed as special category data under the UK GDPR. Where I process this information for the purposes of providing psychotherapy, I rely on Article 9(2)(h) of the UK GDPR, which covers the provision of health or social care or treatment, together with the relevant provisions of the Data Protection Act 2018.

These legal bases mean that I do not rely on your consent as the basis for keeping and using the information that is necessary to provide psychotherapy.

3. What information do I collect?

3.1 Initial enquiries

Inquiring with me to request access to my psychotherapy service can be done online, on paper, over the phone, or in person. This process can involve providing me with your name, address, telephone numbers and email address. Information on your availability, therapeutic issues, and other details may also be part of this request. If we do not proceed to a scheduled phone call (see 3.2) or an introductory/initial appointment (see 3.3), then all data I have received from you will be destroyed. If I have received your original enquiry via Bark, it may be that this service retains your details even after I have removed them from my own email account and records.

3.2 Scheduled phone call

We might schedule a 20-minute phone call before potentially proceeding to a full initial session. During the call we may briefly discuss what brings you to therapy and I might share more about my therapeutic approach and further information about my practice.

I will keep a record of this call, including: the date and time of the call, and a short note on what was discussed. I will also keep a note of your name and contact email/number, but these will be kept separate from any notes on what was discussed during the call.

All data is stored securely as described in sections 6 and 7 below and retained as described in section 8.

3.3 Introductory/initial appointment

At an introductory/initial appointment, which is a full 50-minute session, I may ask about your current personal, social, financial and medical circumstances. I may also ask about your background and family history, as well as the issues which are affecting you now. I require this information so that we can decide about my offer of psychotherapy to you and so that I can manage the service I provide for you.

I will keep a record of our introductory/initial appointment, including: the date and time we met, some details on the issues brought, as well as, if relevant, details on any therapeutic work done in the session. I will also keep a note of your name and contact email/number, but these will be kept separate from any notes on what was discussed during the appointment.

All data is stored securely as described in sections 6 and 7 below and retained as described in section 8.

3.4 Ongoing sessions

If we proceed to regular therapy appointments following the introductory/initial appointment, I will ask you to sign my general terms document or confirm your agreement by email. The document is available on my Starting Therapy page.

I will also request further contact information and details, including: your first and last names; date of birth; email and phone number; GP contact details, and your home address. I would only contact your GP under the circumstances described in section 5 below.

During our work together, I will ask about the issues which are affecting you now, as well as past life events and experiences in order to inform our psychotherapeutic work. I may make notes to track the progress of our work together, or to receive reflection and guidance from my supervisor.

All data is stored securely as described in sections 6 and 7 below and retained as described in section 8.

4. What do I use your information for?

I use information held about you in the following ways:

  • To provide clients with the professional psychotherapeutic services requested from me.
  • To offer appointments (introductory and ongoing).
  • To notify you about changes to your appointments and other changes to my services.
  • To administer my service, including the arrangement of appointments, financial control and the handling of payments.
  • To improve my service to ensure that it is provided in the most effective manner for you and for me.
  • To fulfil my administrative, legal and contractual obligations in line with my professional bodies.

5. What information do I share?

I will not share any information about you with other organisations or people, except in the following situations:

  • Consent – I may share your information with professional carers or others whom you have requested or agreed I should contact.
  • Serious harm – I may share your information with the relevant authorities if I have reason to believe that this may prevent serious harm being caused to you or to another person. This might involve my contacting your GP or another relevant practitioner or authority without consulting with you first.
  • Compliance with law – I may share your information where I am required to by law or by the regulations and other rules to which I am subject.
  • Professional Executor – Should anything happen to me that prevents me from attending a session and from communicating with you directly – such as illness or death – then I have appointed a Therapeutic Executor who would be able to access your contact details to inform you should this situation arise.

6. How do I keep your information safe?

All information you provide to me is stored as securely as possible. All paper forms and correspondence are kept in a locked filing cabinet in my home. All electronic records are stored in password-encrypted files on a personal computer, also requiring password-protected authentication, and/or in my password-protected Microsoft 365 business cloud storage.

While I take appropriate steps to protect your information, electronic communications such as email and text messages cannot be guaranteed to be completely secure. Once I have received your information, I use appropriate security measures to protect it against unauthorised access.

Your identifiable personal information (such as your name and contact details) is kept separately from any session notes I keep. I use a unique code to link your records to your session notes, with the means of identifying you from that code kept separately and accessible only to me.

7. Data processors

I use Microsoft 365 for business email and cloud storage. In providing these services, Microsoft acts as a data processor, as defined in Article 4(8) of the UK GDPR, processing personal data on my behalf. As required by Article 28 of the UK GDPR, my agreement with Microsoft includes contractual terms governing how this data is handled and protected.

Some of this data may be processed by Microsoft outside the UK. Where this occurs, the processing is subject to the safeguards required under UK data protection law.

8. Retention of records

I normally retain client notes and records for seven years after our work together ends. Where contact does not proceed beyond an initial scheduled phone call (see 3.2) or introductory/initial appointment (see 3.3), I normally retain the records relating to that contact for seven years from the date of the call or appointment. Records may be retained for longer where there is a specific reason to do so.

9. Your rights

You have rights in relation to the personal information I hold about you. These include the right to ask for a copy of your personal information and to ask me to correct information that is inaccurate or incomplete.

In certain circumstances, you may also ask me to delete your personal information or restrict how I use it. These rights are not absolute and may not apply where there is a lawful reason for me to continue to retain or process the information.

If you would like to exercise any of these rights, please contact me using the email address below.

If you have concerns or wish to make a complaint about how I have handled your personal information, please contact me using the email address below. I will acknowledge your complaint within 30 days, investigate it appropriately, keep you informed of progress and communicate the outcome without undue delay.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

10. Changes to this policy

I may edit this policy from time to time.

11. Contact me

Please contact me if you have any questions about this privacy statement or information I hold about you.

duncanroebuck@gmail.com

 

Last updated 19 October 2026