Privacy Policy
Erin Frazer Therapies — Psychodynamic Counselling
1. Introduction
This Privacy Policy explains how Erin Frazer Therapies collects, uses, and protects your personal information. I am committed to treating your information with care, transparency, and respect, in line with professional ethical standards and data protection law.
Erin Frazer Therapies is a private counselling practice run by me, Erin Frazer, offering therapeutic services in Hertford and Stevenage, Hertfordshire. ‘Data controller’ describes the person or organisation that collects, stores, and is responsible for personal data. In this instance, the data controller is me. I am registered with the Information Commissioner’s Office, ICO ZC204861.
Your privacy is very important to me, and you can be confident that your personal information will be kept safe and secure and used only for the purpose it was given to me. I adhere to current data protection legislation, including UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This privacy notice tells you what I will do with your personal information from initial contact through to after your therapy has ended, including:
• Why I am able to process your information, and for what purpose
• Whether you have to provide it to me
• How long I store it for
• Whether there are other recipients of your personal information
• Whether I intend to transfer it to another country
• Whether I carry out automated decision-making or profiling
• Your data protection rights
I am happy to talk through any questions about my data protection practices — you can contact me at erin@erinfrazertherapies.com.
2. My Lawful Basis for Holding and Using Your Personal Information
UK GDPR requires me to have a lawful basis for processing your personal data. This differs depending on the stage at which I am processing it:
If your therapy with me has ended, I use legitimate interest as my lawful basis for holding and using your personal information.
If you are currently having therapy, or are in contact with me to consider therapy, I process your personal data where it is necessary for the performance of our contract.
UK GDPR also protects any sensitive information you disclose to me — ‘special category personal information’. My lawful basis for processing this is the provision of health or social care (UK GDPR Article 9(2)(h), together with the corresponding condition in Schedule 1 of the Data Protection Act 2018). This applies because, as a registered member of the BACP, I am bound by a professional duty of confidentiality. Once our work has ended, I retain counselling records in case they are needed to establish, exercise or defend a legal claim (Article 9(2)(f)).
Where I ask for your explicit consent to something specific — for example, contacting your GP — that consent is separate, is always yours to give or refuse, and you can withdraw it at any time without affecting anything already done lawfully. You do not have to consent to my routine record-keeping in order to receive counselling; that is covered by the bases described above.
Providing your information is not a legal requirement, but it is necessary for us to work together: without your contact details and the information gathered at assessment, I would not be able to offer you counselling safely.
I do not carry out any automated decision-making or profiling. No decision about you, or about your therapy, is made by automated means.
3. How I Use Your Information
Initial contact
When you contact me with an enquiry, I will collect information to help me respond, including your name, contact details (phone and/or email), and a brief outline of what has brought you to seek counselling. Alternatively, your GP or another health professional may send me your details as part of a referral, or a parent or trusted individual may make an enquiry on your behalf.
If, after an initial enquiry, consultation call, or assessment, either you or I decide not to proceed with ongoing counselling, I will securely and permanently destroy any personal data I hold about you — including contact details and any assessment information — within three months of that decision. Digital records are permanently deleted from password-protected storage; any physical notes are cross-shredded. If you would like this done sooner, just let me know and I will action it straight away.
While you are accessing counselling
Everything you discuss with me is confidential. That confidentiality will only be broken if I believe you or another person may be at serious risk of harm, I am required to do so by law, or it is necessary to prevent or detect a serious crime, including safeguarding concerns regarding children or vulnerable adults. I will always try to speak with you about this first, unless safeguarding concerns prevent it.
I keep a record of your personal details to help sessions run smoothly, and I keep brief written notes of each session.
Your records are held digitally in Google Workspace, encrypted both while stored and in transit, in an account protected by a strong password and two-step verification, to which I am the only person with access. Google holds this data across multiple secure data centres in Europe, so your records are protected against the failure of any single system. Records are retained and destroyed according to a written retention schedule, and are not shared with any third party except in the circumstances described in this notice.
I do not communicate with clients by text message. Between sessions, I can be reached by email only. Email correspondence is deleted after twelve months if it is not needed for ongoing work; where it is relevant, I will keep it securely within your client file.
My practice email (erin@erinfrazertherapies.com) runs through Gmail and Google Workspace. This means any email correspondence between us is processed by Google as part of delivering that service. Google is a US-based company, so your data may be processed outside the UK. These transfers are covered by the UK Extension to the EU–US Data Privacy Framework, under which Google is certified, together with the Standard Contractual Clauses and UK Addendum contained in Google’s data processing terms.
Online sessions
Where sessions take place online, I use Zoom to deliver them. Zoom is a third-party video platform, and using it means some data — including your name and video and audio during the call — is processed by Zoom as part of running the meeting. Zoom is a US-based company, so this data may be processed outside the UK. These transfers are covered by the UK Extension to the EU–US Data Privacy Framework, under which Zoom is certified, together with the data processing terms Zoom applies to its business customers.
I do not record sessions under any circumstances unless this has been separately and explicitly agreed with you in advance, in writing. No session content is stored by me or by Zoom once a call ends.
Meetings are protected with a waiting room and a passcode, so only you can join. As with any online platform, no system can guarantee absolute security, and I’d encourage you to bear this in mind when deciding whether online sessions are right for you.
After counselling has ended
Once counselling has ended, your records will be kept securely for seven years from the end of our contact, and then securely destroyed. If you would like your information deleted sooner, please let me know.
4. Third-Party Recipients of Personal Data
I sometimes share personal data with third parties — for example, where I have contracted a supplier to carry out a specific task. I take care to select partners carefully, and hold a contract with each one setting out what they are permitted to do with any data I share, ensuring it is not used beyond the task for which it was provided.
The main third parties involved in running my practice are:
• Google (Gmail / Google Workspace) — for practice email correspondence
• Zoom — for delivering online counselling sessions
• Automattic (WordPress.com / Jetpack Stats) — for hosting my website and understanding visitor traffic to it
• SumUp — for taking card payments in the room. SumUp processes the payment itself; I do not hold or see your card details at any point.
• My clinical executor — a registered counsellor whom I have appointed to take over the administration of my practice in the event of my death or incapacity. They would have access to your records in those circumstances only, and are bound by the same duty of confidentiality as me, as described in my Framework for Counselling.
5. Your Rights
I try to be as open as possible about giving people access to their personal information. You have the right to ask me to delete your personal information, limit how I use it, or stop processing it. You also have the right to ask for a copy of any information I hold about you, and to object to its use in some circumstances. You can read more about your rights at ico.org.uk/your-data-matters.
If I hold information about you, I will:
• Give you a description of it and where it came from
• Tell you why I am holding it, how long I will store it, and how I made that decision
• Tell you who it could be disclosed to
• Provide you with a copy in an intelligible form
You can also ask me at any time to correct any mistakes in the personal information I hold about you. To request any personal information I may hold, please put your request in writing to erin@erinfrazertherapies.com.
Where I have asked for your consent to something specific, you also have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it. It also does not remove my need to keep your counselling records for the retention period described above, which I hold in order to establish, exercise or defend legal claims.
If you have any complaint about how I handle your personal data, please get in touch by writing or emailing the contact details above — I welcome any suggestions for improving my data protection practices. If you wish to make a formal complaint, you can contact the ICO, the statutory body overseeing UK data protection law, at ico.org.uk/make-a-complaint.
6. Data Security
I take the security of the data I hold about you very seriously. Digital records are held in Google Workspace and are encrypted both while stored and in transit. Access is protected by a strong, unique password and two-step verification, with account recovery arrangements in place, and I am the only person with access to the account. Your records are not stored on my computer or on any other device; I reach them only through my Google Workspace account. Any physical documents are kept in a locked location.
I have carried out a data protection impact assessment covering how I hold and protect your information, and I review it at least annually. Any personal data breach would be recorded and, where the law requires it, reported to the Information Commissioner’s Office within 72 hours.
7. Visitors to My Website
My website is hosted by WordPress.com, operated by Automattic Inc. WordPress.com also serves as the content management system I use to build and run the site — you can find out about WordPress.com and data protection at automattic.com/privacy.
When someone visits my website, I use Jetpack Stats, a service also provided by Automattic, to collect standard internet log information and details of visitor behaviour patterns. I do this to understand things such as how many visitors different parts of the site receive. This information is processed in a way that does not identify anyone; I do not make, and do not allow Automattic to make, any attempt to identify visitors to my website.
I use legitimate interests as my lawful basis for holding and using your personal information in this way when you visit my website.
I use Jetpack Stats so I can continually improve my service to you. You can read Automattic’s privacy notice for visitors at automattic.com/privacy-notice.
Like most websites, I use cookies to help the site run more efficiently — you can find out about this at automattic.com/cookies. For reference, see also bacp.co.uk/notices/cookies.
No user-specific data is collected by me or any third party. If you fill in a form on my website, that data is temporarily stored by the web host before being sent to me. This website uses SSL (Secure Sockets Layer) encryption, which helps protect data transmitted between your browser and the site.
While no system can be guaranteed to be completely secure, I work to ensure that the measures in place are appropriate to the sensitivity of the information I hold.
8. Contact Details for Data Queries
If you have any questions about this Privacy Policy, your personal data, or if you would like to exercise any of your rights, you can contact me at erin@erinfrazertherapies.com.
9. Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in my practice, legal requirements, or for other operational reasons. Any significant changes will be posted on this page, and the “last updated” date will be amended accordingly.
Last updated: September 2026
Contact
© Erin Frazer Therapies 2026