Privacy Notice
Last updated: September 2026
Your privacy
At Safe Space Therapy, I respect your privacy and am committed to protecting your personal information.
This Privacy Notice explains how I collect, use, store and protect personal information when you contact me, use this website or engage me for counselling or psychotherapy.
I process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (DUAA).
Who is responsible for your information?
Safe Space Therapy is operated by Caroline Kendal, counsellor and psychotherapist.
I am the data controller for the personal information I process in connection with my counselling and psychotherapy practice.
If you have any questions about how your information is handled, please contact me using the contact details provided on this website.
What information do I collect?
Depending on how you contact or work with me, I may collect:
- your name and contact details;
- information you provide when making an enquiry;
- information relating to appointments and attendance;
- correspondence between us;
- payment and administrative information;
- information you choose to share as part of counselling or psychotherapy; and
- counselling records and notes.
Counselling and psychotherapy may involve information concerning your physical or mental health, relationships, sexuality, experiences, personal circumstances or other sensitive matters.
Some of this information may constitute special category personal data under UK data-protection law.
I only collect and use information that is relevant and necessary for providing my professional services and managing my practice.
How I use your information
I may use your personal information to:
- respond to enquiries;
- arrange and provide counselling or psychotherapy;
- communicate with you about appointments;
- maintain appropriate professional records;
- manage payments and administration;
- obtain professional supervision where appropriate;
- meet my legal, professional and insurance obligations;
- deal with complaints or legal matters; and
- protect you or another person where disclosure is necessary and lawful.
The lawful basis for using your information
I process personal information using the lawful basis that applies to the particular circumstances.
This may include processing that is necessary to:
- take steps at your request before entering into an agreement;
- provide and administer my counselling services;
- comply with legal obligations; and
- pursue legitimate interests in the proper and safe administration of my professional practice, where those interests are not overridden by your rights and freedoms.
Where I process special category personal data, such as information concerning your health, I rely on an applicable condition under UK data-protection law appropriate to the nature and purpose of the processing.
Confidentiality
Counselling and psychotherapy are confidential.
There are, however, limits to confidentiality. Information may need to be disclosed without your consent where there is a serious concern about the safety or welfare of you or another person, where safeguarding concerns arise, where I am legally required to disclose information, or where disclosure is otherwise permitted or required by law.
Where it is appropriate and safe to do so, I will discuss any proposed disclosure with you.
As part of my professional practice, I may discuss my work with a suitably qualified supervisor. I take care to protect your identity and confidentiality when doing so.
Who may receive your information?
I will only disclose your personal information where there is an appropriate and lawful reason to do so.
Depending on the circumstances, this may include:
- my professional supervisor;
- professional advisers;
- organisations providing services such as website hosting, email, booking or payment processing;
- healthcare or other professionals where appropriate and lawful;
- safeguarding or emergency services where necessary; or
- courts, regulators or other authorities where I am legally required or authorised to provide information.
Where another organisation processes personal information on my behalf, I take reasonable steps to ensure that appropriate data-protection and confidentiality arrangements are in place.
How long do I keep your information?
I retain counselling and psychotherapy records for seven years from the date counselling ends.
I consider this period to be necessary and proportionate for the purposes of appropriate professional record keeping, dealing with potential complaints or legal claims, and meeting my professional, legal and insurance obligations.
At the end of the seven-year period, records will be securely destroyed unless there is a specific and lawful reason to retain them for longer, such as an ongoing complaint, legal claim, safeguarding matter or other legal or professional requirement.
Keeping your information secure
I take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.
This includes taking appropriate care with electronic records, communications, devices and any physical records.
Your data-protection rights
Depending on the circumstances, you may have rights under data-protection law including:
- the right to ask for access to personal information I hold about you;
- the right to ask for inaccurate information to be corrected;
- the right to request erasure in certain circumstances;
- the right to request restriction of processing in certain circumstances;
- the right to object to certain processing; and
- where applicable, the right to data portability.
These rights are subject to legal exemptions and do not apply in every circumstance.
If you wish to exercise one of these rights, please contact me using the contact details provided on this website.
Data-protection complaints
If you have a concern about how I have handled your personal information, please contact me in the first instance using the contact details provided on this website.
I will acknowledge a data-protection complaint within 30 days and will respond without undue delay.
I will investigate the concern appropriately and communicate the outcome to you.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
Website and cookies
This website uses cookies and similar technologies.
Information about the cookies used on this website, and how they are used, is provided in the Website Cookies section of this website.
Where applicable, non-essential cookies or similar technologies will only be used in accordance with the relevant legal requirements.
Changes to this Privacy Notice
I may update this Privacy Notice from time to time to reflect changes to my practice, this website or applicable data-protection requirements.
The latest version will always be available on this website.
