Not Like the Others Counselling

Privacy Policy

Last updated: 17 June 2026


Who we are
Not Like the Others Counselling is a private therapy practice run by Anna Hayward. I am a qualified counsellor
registered with NCPS and with the Information Commissioner’s Office (ICO registration number: ZA744218).
If you have any questions about how I handle your personal data, please contact me at anna.hayward@notliketheothers.co.uk

What personal data we collect
I collect and process the following types of personal data:

  • Contact details — your name, address, telephone number, and email address
  • Emergency contact information — the name and contact details of someone I can reach in an emergency
  • Health and therapy-related information — your presenting concerns, mental and emotional wellbeing,
  • relevant medical history, current medications, and details of other healthcare professionals involved in your care
  • Session notes — my written records of our therapy sessions, including themes discussed and progress made
  • Financial records — invoices and payment information

Important: Your health and therapy-related information is classified as “special category data” under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I must meet additional conditions before I can process it. I explain these conditions in the section below on lawful basis.

How I collect your data
I collect your personal data directly from you:

  • When you first contact me to enquire about therapy (by email, telephone, or through my website)
  • During our initial consultation and intake process
  • Throughout our therapy sessions together
  • Through any email or telephone communication between sessions
  • I do not collect personal data about you from any other source unless you have given explicit consent for another professional to share information with me.

Why we process your data — lawful basis
Under the UK GDPR, I must have a valid legal reason (known as a “lawful basis”) to process your personal data.
Because therapy involves both ordinary personal data and special category health data, I rely on two separate legal
bases:
Article 6 basis (for ordinary personal data):
Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.
When you engage me as your therapist, we enter into a contract. I need to process your contact details and other
personal information to fulfil that contract by providing you with therapy.
Article 9 basis (for special category health data):
Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health
professional. As a qualified counsellor, I am permitted to process your health-related information in order to provide you with therapeutic care.


The additional condition required under UK law is DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care
purposes). This condition is satisfied because I am a qualified counsellor subject to a professional obligation of
confidentiality under the NCPS Code of Ethics.

Professional obligations and CPD
I am required by NCPS to attend regular clinical supervision. This is an essential part of maintaining safe and ethical
practice. During supervision, I may discuss my therapeutic work to ensure I am providing you with the best possible
care. When I discuss our work in supervision:

  • Your name and any identifying details are not shared with my supervisors
  • I use anonymised or pseudonymised case material only
  • My supervisors are qualified professional bound by the same confidentiality obligations as I am
  • My supervisors are bound by their own professional body’s ethical framework
  • Supervision supports my professional development and helps me reflect on my practice. It is not a breach of your confidentiality.

Clinical will — what happens to your records if I am unable to practise
I have put arrangements in place for a clinical will. A clinical will ensures that if I become unexpectedly
unable to practise (due to serious illness, incapacity, or death), your records will be handled appropriately and
confidentially by a designated colleague.

Who I share your data with
I take your confidentiality seriously and keep the sharing of your data to a minimum. However, I do use the following
third-party services which may process some of your personal data:

  • WordPress — this website runs on WordPress, hosted by Ionos, and any installed plugins may process personal data
  • Google Maps — I embed Google Maps on my website to help you find my practice location. Google LLC (USA) may set cookies and collect location data when you interact with the map
  • Microsoft Teams — I use this platform for online therapy sessions
  • Zoom — I may use this platform for online therapy sessions
  • WhatsApp – I occasionally use this platform, from clients who request it. Meta Platforms Inc. (USA)

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

Other parties who may access limited data:

  • My clinical supervisors — receive anonymised case material only (no names or identifying details)
  • My external accountant— receives invoice data only (your name and amounts paid) for accounting purposes. They do not have access to any clinical information

I never sell your personal data to anyone.

International data transfers
The following third-party services I use may transfer personal data outside the United Kingdom:

  • WordPress (Automattic Inc, USA)
  • Google Maps (Google LLC, USA)
  • Microsoft Teams (Microsoft Corporation, USA)
  • Zoom (Zoom Video Communications Inc, USA)
  • WhatsApp (Meta Platforms Inc., USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer
Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated
requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision. You can request a copy of the relevant transfer safeguards by contacting me.

How long we keep your data
I keep your personal data only for as long as necessary. My retention periods are:

  • Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
  • Therapy records (clients under 18 at the time of therapy): until the client reaches the age of 25
  • Financial records: 6 years (this is an HMRC legal requirement)
  • Website enquiries from people who do not become clients: 12 months

After the applicable retention period, I securely destroy all records. Paper records are disposed of by secure
shredding.

Your rights under UK GDPR
You have the following rights regarding your personal data:

  1. The right to be informed — to know how I collect and use your personal data (this privacy policy fulfils that
    right)
  2. The right of access — to request a copy of the personal data I hold about you (known as a subject access
    request)
  3. The right to rectification — to ask me to correct any inaccurate or incomplete personal data
  4. The right to erasure — to ask me to delete your personal data in certain circumstances. Please note this right
    may not apply where I am required to keep records in line with professional guidelines or insurance
    requirements
  5. The right to restrict processing — to ask me to limit how I use your data in certain circumstances
  6. The right to data portability — to receive your personal data in a structured, commonly used format and to
    have it transferred to another organisation where technically feasible
  7. The right to object — to object to certain types of processing, such as direct marketing
  8. Rights related to automated decision-making — not to be subject to decisions based solely on automated
    processing that significantly affect you. I do not use automated decision-making in my practice.

To exercise any of these rights, please contact me at anna.hayward@notliketheothers.co.uk
If you make a subject access request, I will conduct a reasonable and proportionate search of my records, as required by the Data (Use and Access) Act 2025. I will respond within one month.

Data protection complaints — your right under the Data (Use and Access) Act 2025
You have the right to make a data protection complaint directly to me. I take all complaints seriously and will
respond promptly.

To make a complaint, you can:

  • Submit a complaint at https://notliketheotherscounselling.policydiary.co.uk (select the “Make a complaint” tab)
  • Contact me at anna.hayward@notliketheothers.co.uk

If you are not satisfied with my response, you have the right to escalate your complaint to the Information
Commissioner’s Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions
Everything you share with me in therapy is confidential. However, there are limited circumstances where I may need
to break confidentiality:

  • Risk of serious harm — if I believe there is a serious and imminent risk of harm to you or to another person
  • Safeguarding concerns — if I have concerns about the safety of a child or a vulnerable adult
  • Court order — if I am legally compelled to disclose information by a court of law
  • ‘Prevent’ scheme- I am legally required to refer on, if I believe a person is involved in extremism i.e. terrorism.

I will always try to discuss this with you first, unless doing so would itself put someone at risk.

Changes to this policy
I review this privacy policy annually and whenever my practices change. If I make any significant changes that affect how I handle your personal data, I will inform you directly.