Privacy Policy  

Last updated: 14th September 2026 

1. About this policy 

This Privacy Policy explains how Liz Smout Therapy collects, uses, stores and protects personal information when you contact or receive counselling or therapy. 

I am committed to respecting your privacy and maintaining appropriate confidentiality in accordance with the ethical standards of the British Association for Counselling and Psychotherapy (BACP), applicable data protection law and the UK GDPR. 

For the purposes of data protection law, Liz Smout Therapy / Liz Smout is the data controller for the personal information I hold about you. 

Data controller: Liz Smout 
Business: Liz Smout Therapy 
Contact: info@lizsmouttherapy.co.uk 
 

2. What information I collect 

Depending on the nature of our work together, I may collect and hold information such as: 

  • Your name and contact details. 

  • Information needed to arrange and manage appointments. 

  • Information you choose to share during therapy sessions. 

  • Information about your mental or physical health, wellbeing, circumstances and personal history where relevant to the therapeutic work. 

  • Emergency contact or relevant healthcare information where this is necessary and has been agreed with you. 

  • Information relating to appointments, attendance, cancellations and payments. 

  • Correspondence between us, such as emails, messages or other communications. 

  • Brief professional records relating to our work together. 

  • Information required to comply with legal, regulatory, professional or insurance requirements. 

Some information you provide during therapy may constitute special category data, particularly information concerning your physical or mental health. I only collect and process information that is reasonably necessary for providing and managing your therapy and meeting my professional and legal responsibilities. 

3. How I use your information 

I use your personal information to: 

  • Provide counselling and psychotherapy services. 

  • Arrange and manage appointments. 

  • Communicate with you about your therapy. 

  • Maintain appropriate professional records. 

  • Support safe and ethical therapeutic practice. 

  • Manage payments and accounting. 

  • Obtain professional supervision where required for safe and effective practice. 

  • Meet my professional, legal and regulatory responsibilities. 

  • Respond appropriately to safeguarding or serious-risk situations. 

  • Establish, exercise or defend legal claims where necessary. 

  • Deal with complaints or concerns about my services. 

  • Protect the security and integrity of my systems and records. 

I aim to collect only information that is relevant and necessary for these purposes. 

4. Lawful basis for processing your information 

Under UK data protection law, I must have a lawful basis for processing personal information. 

Depending on the circumstances, I may rely on: 

  • Contract: where processing is necessary to provide the therapy services you have requested or to take steps at your request before entering into an agreement. 

  • Legal obligation: where I am required to keep or disclose information to comply with the law. 

  • Legitimate interests: where processing is necessary for legitimate interests such as managing my practice, maintaining appropriate professional records, dealing with complaints or protecting my business, provided those interests are not overridden by your rights. 

  • Vital interests: where it is necessary to protect someone's life and it is not possible to obtain consent. 

  • Consent: where consent is the appropriate legal basis for a particular use of information. 

Because therapy may involve information about your physical or mental health, additional conditions under UK data protection law apply to the processing of special category data. 

I will only process such information where I have an appropriate lawful basis and special category condition to do so. 

5. Confidentiality 

Confidentiality is fundamental to therapeutic work. 

Information you share with me will normally remain confidential and will not routinely be disclosed to your GP, family members, employer, partner or other third parties without your knowledge and, where appropriate, your consent. 

However, confidentiality has limits. There may be circumstances in which I need to disclose information without your consent. These may include: 

  • Where I believe there is a serious and significant risk of harm to you or another person. 

  • Where there are safeguarding concerns involving a child or an adult at risk. 

  • Where disclosure is required by law or authorised by law. 

  • Where disclosure is necessary to protect someone's vital interests. 

  • Where disclosure is necessary to comply with a legal obligation. 

  • Where information is required for the purposes of legal proceedings or to establish, exercise or defend legal claims. 

  • Where another healthcare professional needs information in order to provide appropriate care and disclosure is justified. 

  • Where disclosure is necessary to obtain appropriate professional advice or supervision. 

Where possible and appropriate, I will discuss any proposed disclosure with you beforehand. However, this may not always be possible where doing so could increase the risk of harm or where the law prevents it. 

These limits to confidentiality will be discussed with you as part of our therapeutic agreement. 

6. Professional supervision 

As part of responsible therapeutic practice, I may discuss aspects of my work with a qualified professional supervisor. 

Supervision helps me reflect on my practice, maintain appropriate professional standards and work safely and effectively. 

Where possible, information discussed in supervision will be anonymised so that you cannot reasonably be identified. Where identifiable information needs to be shared, this will be handled confidentially and only where there is an appropriate professional or legal basis. 

7. Who I may share your information with 

I do not sell or routinely share your personal information with third parties. 

Depending on the circumstances, information may be shared with: 

  • My professional supervisor, subject to appropriate confidentiality arrangements. 

  • Healthcare professionals or other professionals involved in your care, where this is necessary and appropriately authorised. 

  • Insurers or legal advisers where necessary in connection with a claim, complaint or legal matter. 

  • Relevant authorities where I am legally required or authorised to disclose information. 

  • Service providers who process information on my behalf, where necessary to operate my practice. 

I will only share information that is reasonably necessary for the particular purpose. 

Where information is shared, I will take reasonable steps to ensure that the recipient handles it securely and confidentially. 

8. Emails, texts and electronic communications 

I recognise that electronic communication can carry privacy and security risks. 

I may use email, telephone, text message or other agreed communication methods to arrange appointments and communicate with you about practical matters relating to therapy. 

Please avoid sending detailed or highly sensitive therapeutic information by ordinary email or text unless we have agreed that this is appropriate. 

You should also be aware that messages may appear on devices, email accounts or notification screens that other people can access. 

9. Online therapy 

Where therapy is provided online, I will take reasonable steps to protect the confidentiality and security of sessions and communications. 

Online therapy may involve third-party technology providers. You should familiarise yourself with the privacy and security arrangements of the platform being used. 

I will use appropriate privacy settings and reasonable security measures when providing online therapy. 

10. Record keeping 

I keep appropriate professional records because accurate records are an important part of safe and ethical therapeutic practice. 

Records will be kept securely and will contain only information that is reasonably necessary for the purposes of the therapeutic relationship, professional practice, legal requirements and relevant insurance arrangements. 

I will not retain personal information indefinitely. Records will be securely deleted or destroyed when they are no longer required, subject to any applicable legal, professional or insurance requirements. 

My current retention period is: 7 years 

11. How I keep your information secure 

I take reasonable technical, organisational and physical measures to protect personal information against: 

  • Unauthorised access. 

  • Loss or theft. 

  • Accidental destruction. 

  • Unauthorised disclosure. 

Where records are held electronically, I use appropriate passwords, device security and access controls. 

Where paper records are held, they are stored securely and access is restricted. 

No method of electronic storage or transmission can be guaranteed to be completely secure, but I will take reasonable and proportionate steps to protect the information I hold. 

12. How long I keep your information 

I retain information only for as long as it is reasonably necessary for the purposes for which it was collected, including meeting professional, legal, regulatory and insurance requirements. 

Record retention period: 7 years 

When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate. 

13. Your rights 

Under UK data protection law, you have rights in relation to your personal information. Depending on the circumstances, these may include the right to: 

  • Ask what personal information I hold about you. 

  • Request a copy of your personal information. 

  • Ask me to correct inaccurate or incomplete information. 

  • Ask me to erase information in certain circumstances. 

  • Ask me to restrict how I process your information in certain circumstances. 

  • Object to certain types of processing. 

  • Request data portability in circumstances where this right applies. 

  • Withdraw consent where I am relying on consent as the lawful basis for processing. 

These rights are subject to certain legal exemptions and limitations. For example, I may not always be able to delete information that I am legally or professionally required to retain. 

If you wish to exercise any of these rights, please contact me using the details below. 

Privacy contact: 
Liz Smout 
Email: info@lizsmouttherapy.co.uk 

I will normally respond to a valid data protection request within the timeframe required by applicable data protection law. 

14. Complaints about your personal information 

If you have any concerns about the way I have handled your personal information, please contact me in the first instance so that I can try to resolve the issue. 

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has not been handled in accordance with data protection law. 

Information about making a complaint is available from the ICO at: 

Information Commissioner's Office 

15. Changes to this policy 

I may update this Privacy Policy from time to time to reflect changes in my practice, technology, professional requirements or data protection law. 

The most recent version will be made available to clients and will show the date it was last updated.