Privacy Policy – How Your Data is Protected
A business logo featuring white and grey clouds, blue birds, and the words 'Calmer Skies Counselling' in blue, set against a blue background.

Privacy Policy

Effective Date: 12th June 2026

 

1. Introduction

 

Welcome to Calmer Skies Counselling (www.calmerskiescounselling.co.uk). I take your privacy very seriously. This policy explains how I collect, use, and protect your personal data when you visit my website or use my therapy services. For the purposes of the UK GDPR, the Data Protection Act 2018, and the Data Use and Access Act 2025 (DUAA), Natalie Wenham is the Data Controller for Calmer Skies Counselling.

 

I am committed to ensuring that your information is secure and used lawfully, fairly, and transparently.

 

2. Information I Collect and How I Collect It

 

Depending on how you interact with my services, I may collect your data through the following routes:

 

  • Initial Contact: When you contact me via the Contact page on my website (hosted by IONOS), by telephone, or by emailing me directly. This may include your name, email address, phone number, and brief details about your enquiry.

 

  • Therapy Intake and Records: Once you begin therapy, I collect deeper personal data including your address, emergency contact details, GP details, diagnoses, medication, and session notes. 

 

  • Billing Information: Invoices, payment reminders, payment confirmations, and financial transactions. Clients pay by BACS transfer into my Mettle (NatWest) business account. I manually record payment status in Kiku, which then automatically issues a branded receipt to you.

 

3. Lawful Basis for Processing

 

Under UK GDPR and DUAA, I must have a valid lawful basis to process your data:

 

  • Consent: When you book your first session, you will receive a request from Kiku to provide a digital signature and tick a checkbox confirming your consent to the storage and processing of your personal data for the purposes of providing therapeutic services. You may withdraw this consent at any time by emailing me at natalie@calmerskiescounselling.co.uk.

 

  • Contractual Necessity: To perform the therapy contract between you and me (e.g., booking and managing your appointments). 

 

  • Legal Obligation: To comply with legal requirements such as maintaining tax and financial records for HMRC.

 

  • Special Category Data: Therapy involves health information, which is processed under Article 9(2)(h) of the UK GDPR for the provision of health or social care.

 

4. How I Use Your Information

 

I use your personal information strictly to:

 

  • Respond to your initial enquiries and arrange consultations.

 

  • Provide professional therapy and related healthcare services.

 

  • Administer your appointments, cancellations, and booking reminders.

 

  • Issue payment reminders (sent automatically by Kiku 5 days before your next appointment).

 

  • Record payment status and issue receipts (Kiku automatically sends a receipt once I manually mark an invoice as paid).

 

  • Manage professional invoicing, payments, and financial auditing

 

5. Data Security & Storage Platforms

 

I am dedicated to keeping your data confidential and safe. I do not share my devices or passwords with anyone else. I use trusted, GDPR‑compliant third‑party systems to manage my practice securely:

 

  • Website Hosting (IONOS): My website is hosted by IONOS, which secures web traffic and any contact form submissions you send through the site. You can view Ionos Privacy Policy here.

 

  • Practice Management (Kiku): I use Kiku to securely collect and store client information, billing records, and clinical session notes. Clinical notes stored in Kiku are accessible only to me and are never shared with anyone else. Kiku’s support team cannot access clinical notes, and their development team can only access sensitive data in exceptional circumstances such as system failures or data restoration, under strict security controls. Kiku uses Amazon Web Services (AWS) servers located in Ireland (EU), with RSA 256‑bit SSL encryption, password protections, and multi‑factor authentication. Kiku also sends automated payment reminders and automatically issues receipts once I manually mark an invoice as paid. You can view Kiku’s Privacy Policy here.

 

  • Video Sessions (Primary: Doxy.me): Doxy.me does not store client information, does not record sessions, and only temporarily holds transferred files before deletion. It uses your public IP address to determine approximate location. You can view Doxy.me Inc.’s Privacy Policy here.

 

  • Video Sessions (Alternative: Google Meet): Google collects technical information such as IP address, device type, and browser settings. I do not allow recording of sessions, so Google does not store video, audio, or chat content. You can view Google LLC’s Privacy Policy here.

 

  • Financial Transactions (Mettle/NatWest & FreeAgent): Clients pay by BACS transfer into my Mettle (NatWest) business account. I use FreeAgent to manage invoices and accounting. These systems store only the information necessary for financial administration and do not contain clinical notes. You can view Mettle’s Privacy Policy here, NatWest’s Privacy Policy here, and FreeAgent’s Privacy Policy here.

 

6. International Data Transfers 

 

Some of the systems I use may process data outside the UK or the European Economic Area (EEA). In particular, Google Meet operates a global server infrastructure, meaning technical metadata (such as IP address, device information, and connection logs) may be processed internationally. These transfers are protected by Standard Contractual Clauses (SCCs) and other safeguards recognised under UK GDPR and the Data Use and Access Act 2025. No session content is stored or transferred internationally, as I do not permit the recording of sessions.

 

7. Website Cookies

 

My website uses a cookie banner to obtain your consent before placing non‑essential cookies on your device. Cookies are used to ensure website functionality, optimize performance, and analyse traffic. For full details, please see my Cookie Policy.

 

8. Data Sharing & Professional Continuity

 

I will never sell, distribute, or lease your personal information to third parties for marketing purposes. I only share data under strict, professional circumstances:

 

  • Clinical Supervision: In line with professional therapeutic ethics, I discuss cases with a clinical supervisor. Client identities are kept completely anonymised during these sessions.

 

  • Professional Will: In keeping with the requirements of BACP’s Ethical Framework I have appointed a trusted colleague to take over the administration of my practice in the event of my death or incapacity, and to deal with my appointments and destroy my electronic notes in a confidential manner. This colleague is also a member of BACP and is bound by the same professional confidentiality rules as set out in their Ethical Framework.

 

  • Financial Payments: I am paid directly by BACS transfer by clients, meaning standard financial transaction data is processed via secure banking networks.

 

  • Legal/Safeguarding Exceptions: Data may be shared without consent if I am legally compelled to do so, or if there is an immediate, serious risk of harm to yourself or others.

 

9. Data Retention

 

I do not hold your personal data for longer than is necessary:

 

  • Initial Enquiries: After your initial enquiry, I will hold your contact data for one month and then permanently delete it if you choose not to proceed with therapy.

 

  • Clinical Records: If you proceed with therapy, your clinical records and session notes will be retained securely on Kiku for 7 years following your final therapy session. When a client record is archived in Kiku, all non‑essential personal data (such as contact details, GP details, and emergency contact information) is deleted immediately, and only clinical notes are retained for 7 years. After 7 years, all records are permanently erased.

 

  • Emails: Emails relating to ongoing communication are retained for up to two years, unless a longer period is required for legal or regulatory reasons. Emails are stored as PDF files within your Kiku clinical notes.

 

  • Financial Records: Retained for 6 years to comply with HMRC requirements.

 

10. Your Rights

 

Under UK GDPR and DUAA 2025, you have the right to:

 

  • Access to a copy of the personal data I hold about you.

 

  • Rectification of any incorrect or incomplete information.

 

  • Erasure of your data, subject to legal or insurance retention obligations.

 

  • Restriction of how your data is processed.

 

  • Portability to move your data securely to another service provider. 

 

  • Withdraw consent.

 

To make any requests, or to withdraw your consent, please email me directly at natalie@calmerskiescounselling.co.uk.

 

11. Data Protection Complaints

 

If you have any complaints or feedback about how I handle your personal data, please get in touch with me directly using the contact details provided above. I welcome any suggestions for improving my data protection procedures.

 

I take all privacy concerns seriously and will acknowledge your complaint within 30 days of receipt. I will investigate the matter thoroughly and work with you to resolve it without undue delay.

 

If, after completing my internal complaints process, you remain dissatisfied with the outcome, you may escalate your concern to the Information Commissioner’s Office (ICO) and submit a formal complaint through their Make a Complaint service. 

 

Natalie Wenham is registered with the ICO under registration number: ZB798499.

 

12. Data Breaches

 

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, I will notify you and the Information Commissioner’s Office (ICO) without undue delay, and within 72 hours of becoming aware of it, in accordance with UK data protection laws. 

 

13. Changes to This Policy

 

This policy is reviewed regularly to align with new legal standards. Updates will be published on my website.

 

Information icon

We need your consent to load the translations

We use a third-party service to translate the website content that may collect data about your activity. Please review the details in the privacy policy and accept the service to view the translations.