The Explore Approach / Christina Hughes], Trainee* UKCP Integrative Psychotherapeutic Counsellor

Offering therapy online and in person • Last reviewed: September 2026

This document explains how I collect, use, store and share your personal information (your "data") when you enquire about or engage in counselling/therapy with me, whether sessions take place face to face, online (video, or phone), or a combination of both. It is written in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ethical and data protection guidance of the UK Council for Psychotherapy (UKCP).

I am the "data controller" for the personal information described below. My contact details and registration information are given at the end of this policy.

1. Information I Collect

1.1 When you make contact or enquire

Name, email address, phone number

Details you share via my website contact form, email, or telephone

Information given when booking a free introductory consultation

Website usage data collected via cookies and analytics tools (e.g. Google Analytics) when you visit www.theexploreapproach.co.uk

1.2 When you begin therapy with me (face to face and/or online)

Whether we meet in a therapy room or via a secure online platform, I collect the same categories of information, which form your confidential clinical health record. Only relevant information will be collected.

Full name, date of birth, address, phone number and email address

GP details and relevant medical history, including current medication that you choose to share

Family relationships, occupation, and relevant personal/social history

Previous experience of psychological therapy or treatment

Emergency contact details and (where sessions are online) your location at the time of each session, in case of a safeguarding emergency

Notes on the content and themes of sessions, your presenting concerns and any risk assessments

Any correspondence, referral letters, reports, or outcome measures/psychometric questionnaires completed during our work together

1.3 Additional information collected for online sessions

The video/audio platform used (Zoom or WhatsApp) and associated account or contact identifiers such as a video-call username

Records of session attendance, connection issues, or technical incidents where relevant to the therapeutic work

Payment details processed for online bookings (see Section 5)

2. How and Why I Use Your Information

I use your information to:

Assess suitability for therapy and agree a way of working together

Provide, plan and review counselling/therapy sessions, whether face to face or online

Maintain accurate clinical records, as required by my professional and insurance obligations

Communicate with you about appointments, cancellations and administrative matters

Meet legal, regulatory and ethical obligations, including responding to safeguarding concerns

Process payment for sessions

The legal bases I rely on under UK GDPR are: your explicit consent (for special category health data), performance of a contract (to provide the therapy service you have requested) and legitimate interests or legal obligation (for record-keeping, safeguarding, and regulatory compliance).

3. How Your Information Is Stored

3.1 Face-to-face records

Handwritten or printed intake forms, consent forms, referral letters and questionnaires are stored in paper form in a locked cabinet at my practice address.

Once our work together ends, hard-copy notes are retained in a locked cabinet for up to 7 years in line with professional guidance, after which they are securely destroyed

3.2 Online/digital records

Brief session notes are typed and stored in an encrypted, password-protected hard drive, which is kept in a locked cabinet, in a locked room.

Notes are anonymised or pseudonymised where possible and identified only by initials or client reference number

Where notes are retained electronically rather than printed, they are stored on an encrypted device/cloud service that is GDPR-compliant and, where relevant, hosted within the UK/EEA

Email correspondence is held within a secure email account. I recommend not sending highly sensitive information by email where possible

Online sessions are conducted via Zoom or WhatsApp, which is end-to-end encrypted. Sessions are not recorded by me. I ask that you do not record sessions without prior agreement from both parties

Payments made online are processed via a bank transfer— I do not store full card details myself

4. Confidentiality

Everything discussed in session is confidential. I adhere to the ethical framework and confidentiality guidance of the UKCP. There are limited circumstances in which confidentiality may be broken:

Clinical supervision: I am professionally required to discuss my clinical work in regular supervision with another qualified therapist, bound by their own confidentiality obligations. I refer to you by first name only (or pseudonym) and my supervisor does not know you personally or professionally.

Risk of serious harm: if I believe you are at serious risk of harm to yourself or others, or where there is a child or vulnerable adult protection concern, I am ethically and legally obliged to act, which may involve contacting your GP, a crisis team, the police, or safeguarding services. Wherever possible, I will discuss this with you first.

Court order: if information about you is formally requested under a court order or other legal obligation, I am required to disclose it. Where possible I will inform you in advance.

With your consent: information will only otherwise be shared with a third party (e.g. your GP, another professional) where you have given written consent.

Emergency contact: if I were unexpectedly unable to attend a session and could not reach you directly, I may ask a trusted contact to notify you of the change. No clinical information would be shared with them — only that the appointment cannot go ahead.

5. Sharing Your Information

Aside from the circumstances above, your information is not shared with anyone else without your explicit, written consent. Where third-party services are used to support the running of the practice (e.g. online booking, payment processing, secure video-calling, or practice management software), these providers act as "data processors" and are contractually required to handle your data securely and in line with UK GDPR.

6. Cookies and Website Data

My website, www.theexploreapproach.co.uk , uses cookies and Google Analytics to understand how visitors use the site. You can control or disable cookies through your browser settings. No clinical or session information is ever collected through the website itself.

7. Retention of Records

Clinical records (paper and electronic) are retained for up to 7 years after the end of our work together, in line with UKCP guidance and insurance requirements

Records relating to work with a young person are retained until their [25th/26th] birthday, or 7 years after our work ends if later

Financial records are retained for the period required by HMRC (currently 6 years)

After the relevant retention period, records are securely destroyed (paper records shredded; electronic records permanently deleted)

8. Your Rights Under UK GDPR

You have the right to:

Be informed about what information is collected and how it is used and stored

Request access to the information I hold about you

Request correction of inaccurate or incomplete information

Withdraw consent to the processing of your information at any time

Request erasure of your personal information, although I may need to decline where retention is required for me to practise lawfully, ethically, or to meet insurance/regulatory obligations

Object to or request restriction of certain processing

Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled

To exercise any of these rights, please contact me using the details below.

9. How to Complain

If you have any concerns about how your data is handled, please raise this with me directly in the first instance, either in session or by emailing christina@theexploreapproach.co.uk I aim to respond within 30 days.

Complaints relating to data protection can be escalated to the Information Commissioner's Office (ico.org.uk)

Complaints relating to clinical/ethical practice that cannot be resolved directly with me can be made to the UKCP

I hold Professional Indemnity Insurance and am registered with the ICO (registration number: ZC214695).

10. Contact Details

Christina Hughes

UKCP Trainee* Integrative Psychotherapeutic Counsellor, Ellesmere Centre, Hull

christina@theexploreapproach.co.uk

www.theexploreapproach.co.uk

07761 739635

By proceeding to work with me, you are confirming that you have read, understood, and consent to the terms

of this Privacy Policy.