Privacy Notice

1. Purpose

Northlight Therapy is committed to protecting your privacy and handling personal information lawfully, fairly and transparently. This Privacy Notice explains how personal information is collected, used, stored, shared and protected when you visit the website, make an enquiry or engage in counselling services. This notice is informed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant professional guidance.

2. Data Controller

Northlight Therapy is the Data Controller for the purposes of UK data protection law. Questions about this Privacy Notice or the handling of personal information can be directed to Northlight Therapy using the contact details provided on the website.

3. Information Collected

Information collected may include your name, contact details, date of birth, emergency contact details, GP details where relevant, information shared during enquiries, counselling records, session notes, correspondence, appointment information and website usage data.

4. How Information is Used

Personal information may be used to respond to enquiries, arrange appointments, provide counselling services, maintain records, manage safeguarding concerns, fulfil legal and professional obligations, administer the practice and improve services.

5. Lawful Basis for Processing

Personal information is processed under the lawful bases of contract, legitimate interests, legal obligation, vital interests and, where applicable, the processing of special category data for the provision of counselling and therapeutic services.

6. Confidentiality and Information Sharing

Information shared during counselling is treated confidentially. Information will only be shared where consent has been given, where there is a safeguarding concern, where disclosure is required by law, where there is a serious risk of harm, or where information is required for professional, insurance or regulatory purposes. Wherever possible, clients will be informed before information is shared.

7. Supervision

As part of ethical practice, client work may be discussed anonymously within professional supervision. Identifying details are removed wherever possible.

8. AI and Digital Tools

Northlight Therapy may use secure digital tools, including artificial intelligence, to support administrative tasks, drafting and service development. AI systems are not used to make decisions about clients. Personally identifiable client information will not be entered into public AI systems unless appropriate safeguards are in place and its use is lawful, ethical and necessary.

9. Data Security

Client records are stored securely and handled in accordance with UK data protection legislation. Records may be held electronically and/or in paper format. Appropriate technical and organisational measures are used to protect information from unauthorised access, loss, destruction or disclosure.

10. Retention of Records

Client records are normally retained for seven years following the end of therapy, unless a longer period is required by law, insurance requirements or professional guidance. Enquiry information from individuals who do not become clients will usually be deleted within twelve months.

11. Website, Cookies and Social Media

The website may use cookies and similar technologies to improve functionality and understand website usage. Northlight Therapy maintains professional social media accounts; however, social media and direct messaging are not suitable for sharing confidential information. Professional boundaries are maintained online in accordance with relevant policies.

12. Your Rights

Under UK GDPR, you have rights relating to your personal information, including the right to access information held about you, request corrections, request erasure in certain circumstances, restrict processing, object to processing and make a complaint to the Information Commissioner's Office (ICO).

13. Linked Policies

This notice should be read alongside the following policies/procedures:

Confidentiality Policy
Safeguarding Policy
Data Protection Policy
Complaints Policy

14. Review

This Privacy Notice will be reviewed every two years or sooner if legislation, professional guidance or organisational requirements change.