Effective from: 21 August 2026

This policy explains how I collect, use, store and share personal information when you visit my website, contact my practice, receive counselling, or complete a questionnaire that I send to you through Microsoft Forms.

 

1. Who I am

I am Lisa Bantleman, trading as Bantleman Counselling & Psychotherapy Services. I am the data controller for the personal information used in connection with my counselling practice. This means I decide why and how that information is processed.

Data controller Lisa Bantleman, trading as Bantleman Counselling & Psychotherapy Services Email: admin@bcps.uk Telephone: 07956 824 212 ICO registration number: ZC208357

2. Who this policy applies to

This policy applies to:

• visitors to bcps.uk;
• people who contact me or make an enquiry;
• prospective, current and former counselling clients;
• people who complete PHQ-9, GAD-7 or another questionnaire that I provide through Microsoft Forms; and
• parents, guardians, referrers, emergency contacts or other people whose information is provided to me in connection with a client, where applicable.

External websites and services have their own privacy information. This policy only explains how my practice uses personal information.

3. Personal information I collect

Website visitors and enquiries

Depending on how you use the website or contact me, I may collect:

• your name, email address, telephone number and preferred method of contact;
• the information you include in an enquiry or contact form;
• appointment or availability information;
• correspondence by email, telephone or text; and
• technical information such as IP address, browser and device information, pages visited, cookie preferences and analytics information, where enabled.

Counselling clients

Where relevant to providing counselling safely and professionally, I may collect:

• name, contact details, date of birth and address where provided;
• emergency contact and GP details;
• referral, assessment, appointment and attendance information;
• brief and proportionate counselling notes;
• information about health, wellbeing, risk and safeguarding;
• contracts, consent records, complaints and correspondence; and
• invoice, payment and accounting information.

Counselling information is likely to include special category information. This may include information about physical or mental health and, where relevant and voluntarily shared, information about racial or ethnic origin, religious or philosophical beliefs, sexual orientation, sex life or other particularly sensitive matters. I only record information that is relevant and proportionate to the counselling service, safety, professional accountability or legal requirements.

PHQ-9 and GAD-7 questionnaires

If I send you a PHQ-9, GAD-7 or similar questionnaire through Microsoft Forms, I may collect your answers, the information needed to match the response to you, the submission date and any comments you provide. These questionnaires help inform our work but do not replace a clinical diagnosis or emergency assessment. The questionnaires are not stored on the bcps.uk website. Responses are submitted through Microsoft Forms, held within my Microsoft 365 environment and treated as part of your counselling record. Access is restricted to me and any authorised person described in this policy.

4. How and why I use personal information

Enquiries, appointments and the counselling agreement. I use contact and enquiry information to respond to you, assess whether my service may be suitable, arrange appointments or manage our counselling agreement. The lawful basis is taking steps at your request before entering into a contract and performing our contract (UK GDPR Article 6(1)(b)). Providing counselling and using questionnaires. I use assessment information, counselling notes, PHQ-9 and GAD-7 responses and relevant health information to provide a safe and professional counselling service. The Article 6 lawful basis is contract. For special category information, I rely on processing necessary for health or social care or treatment (Article 9(2)(h) and the relevant condition in Schedule 1 of the Data Protection Act 2018), subject to my duty of confidentiality. Risk, safeguarding and emergencies. I may use or share limited information where this is necessary to protect you or another person, respond to a safeguarding concern, comply with a court order or meet a specific legal duty. Depending on the circumstances, the Article 6 basis may be legal obligation, vital interests in an emergency, or legitimate interests in preventing serious harm. The relevant Article 9 condition may include health or social care, vital interests, legal claims or substantial public interest supported by an applicable Schedule 1 condition. I will consider necessity, proportionality and confidentiality before making a disclosure and will record the reason for it. Clinical supervision. I discuss my work in professional supervision to support safe, ethical and effective practice. I anonymise information wherever reasonably possible and otherwise use only the minimum information needed. My lawful basis is legitimate interests in maintaining professional standards and client safety, together with the relevant Article 9 health or social care condition. My supervisor is bound by confidentiality. Payments and accounts. I use payment and invoice information to administer the counselling agreement and maintain accounting and tax records. The lawful bases are contract and legal obligation. Complaints, insurance and legal claims. I may use relevant records to respond to concerns or complaints, obtain professional or legal advice, notify an insurer, and establish, exercise or defend legal claims. The lawful bases are legitimate interests and legal obligation where applicable. For special category information, I may rely on Article 9(2)(f) for legal claims or another applicable condition. Website operation and security. I use technical information and security logs to operate, protect and troubleshoot the website. The lawful basis is legitimate interests in maintaining a secure and reliable website. Website analytics. Where consent is required, I use analytics only after you have made a positive choice through the website's cookie controls. The lawful basis for related personal information is consent. You can change or withdraw your choice at any time through the cookie settings. Further information is provided in the Cookie Policy. I do not use counselling notes, questionnaire responses or health information for advertising or marketing.

5. Information needed to provide the service

Some contact, appointment, contract, assessment and safety information is necessary for me to assess an enquiry and provide counselling. If you do not provide information that is reasonably required, I may be unable to offer or continue the service safely. Other information is voluntary, and you can discuss any concerns about providing it with me.

6. Where information comes from

Most information comes directly from you. I may also receive relevant information from:

• a person or organisation that referred you;
• a parent, guardian or representative where appropriate;
• a GP, healthcare professional, insurer or employee assistance provider where you have authorised this or another lawful basis applies; and
• an emergency contact or safeguarding professional where necessary and lawful.

If you provide another person's contact details, such as an emergency contact, please ensure they are aware that their details may be held and used for the stated purpose where it is reasonable to do so.

7. Confidentiality and sharing

Counselling is confidential. I do not sell personal information. I only share information where it is necessary, proportionate, lawful and consistent with my professional duties. Depending on the circumstances, information may be shared with:

• my clinical supervisor, using anonymised or minimally identifying information;
• Microsoft, which provides Microsoft 365, email and Microsoft Forms;
• website hosting, backup, security and authorised technical-support providers, where access is necessary and subject to appropriate terms;
• Google, where Google Analytics or related analytics services are enabled through your cookie choice;
• payment, banking or accounting providers;
• a nominated professional executor or trusted professional if illness, incapacity or death prevents me from contacting clients, with access limited to what is necessary;
• my insurer, professional body, solicitor or other professional adviser where necessary;
• your GP, another health or social care professional, an emergency contact or a safeguarding professional where you have asked me to share information or there is another lawful justification; and
• courts, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

Providers acting as processors may only use information to provide their contracted service, subject to their data-processing and confidentiality obligations.

8. Microsoft Forms and Microsoft 365

Microsoft Forms is used to collect PHQ-9, GAD-7 and any other questionnaires that I send to a client. Microsoft 365 is also used for business email and may be used for secure storage. I remain responsible for deciding why the information is collected and how it is used. Microsoft provides the platform under its contractual data-protection terms. You can read Microsoft's privacy information at privacy.microsoft.com/privacystatement.

9. International transfers

Some technology providers, including Microsoft and Google, operate internationally. Personal information may therefore be stored in the UK or other approved locations, or accessed from outside the UK for service delivery, security or support. Where a restricted transfer takes place, I require an appropriate UK transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and assess the provider's protections as appropriate. You may contact me for more information about the safeguards relevant to your information.

10. How I protect information

I use proportionate technical and organisational measures designed to protect confidentiality, integrity and availability. These include, where appropriate:

• password-protected accounts, access controls and multi-factor authentication;
• encryption in transit and at rest where supported by the service;
• secure devices, software updates, backups and malware protection;
• locked storage for paper records;
• limiting access to people who genuinely need it; and
• reviewing the privacy and security arrangements of service providers.

No method of electronic transmission or storage is completely risk-free, but I take reasonable steps appropriate to the sensitivity of counselling information.

11. How long I keep information

I keep personal information only for as long as necessary for the purpose for which it was collected and for applicable professional, insurance, tax, safeguarding and legal requirements. My current retention approach is:

• Enquiries that do not become clients: normally three months after the last contact, unless the information is needed for a complaint, safety concern or legal reason.
• Adult client records: normally six years after the last counselling contact. This includes assessment information, relevant correspondence, counselling notes and PHQ-9 or GAD-7 responses forming part of the client record.
• Emails and text messages forming part of the clinical record: filed with the client record and retained for the same period.
• For clients who were under 18 when therapy ended, I keep records until age 25 or for 6 years if this period is shorter.
• Invoices and accounting records: normally six years, or longer where tax law requires.
• Complaints, insurance matters and legal claims: for as long as necessary to manage the matter and any applicable limitation period.
• Website security logs, analytics information and cookies: for the period set out in the Cookie Policy and relevant provider settings, or only as long as needed for security and troubleshooting.

At the end of the relevant period, information is securely deleted, confidentially shredded or irreversibly anonymised. Copies held in backups are removed through the normal secure backup-rotation process.

12. Your data-protection rights

Depending on the information and lawful basis involved, you may have the right to:

• ask for access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased in certain circumstances;
• ask for processing to be restricted in certain circumstances;
• object to particular uses of your information;
• receive information you provided in a portable format where the legal conditions apply; and
• withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.

Your right to object: where I rely on legitimate interests, you may object to that processing. I will stop unless I can demonstrate compelling legitimate grounds or the information is needed for legal claims.

These rights are not absolute. For example, I may need to retain or withhold particular information because of another person's rights, a legal exemption, safeguarding, professional confidentiality or legal claims. If I cannot fully meet a request, I will explain why and tell you about your right to complain. To exercise a right, contact me using the details in section 1. I may need proportionate information to confirm your identity. I will normally respond within one month, although the law allows additional time for some complex or multiple requests. There is normally no fee.

13. Data-protection complaints

If you are concerned about how I have used your personal information, you can make a data-protection complaint by emailing admin@bcps.uk or telephoning 07956 824 212. You do not need to use legal language. I will acknowledge the complaint within 30 days, make appropriate enquiries without undue delay, keep you informed and explain the outcome. You can also complain to the Information Commissioner's Office (ICO). You do not have to wait for my response before contacting the ICO. Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 ico.org.uk/make-a-complaint

14. Cookies and website analytics

The website uses essential technologies needed for security and operation. It also uses Google Analytics, deployed through Google Tag Manager, to understand how the website is used. Analytics is controlled through the website's cookie settings where consent is required. The Cookie Policy explains the technologies used, their purposes, durations and how to change your choices.

15. Automated decisions

I do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. PHQ-9 and GAD-7 scores are reviewed in the context of the counselling relationship and are not used as an automated diagnosis.

16. Changes to this policy

I review this policy regularly and update it when my practice, service providers or legal obligations change. The current version will be published on bcps.uk. If a change materially affects how existing client information is used, I will take reasonable steps to bring it to the attention of affected clients before the new use begins. Last updated: 21 August 2026