Privacy Notice
Marta Barnett Counselling & Psychotherapy
Marta Kurowska-Barnett, MBACP 408208
ICO registration number: ZB749736
Website: martabarnett.com
Email: contact@martabarnett.com
Last updated: June 2026
1. About this Privacy Notice
I respect your privacy and take the protection of your personal information seriously.
This Privacy Notice explains what personal information I collect, why I collect and use it, how I keep it secure, when I may share it, how long I keep it and your rights in relation to your personal information.
I process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.
I am the data controller for the personal information I process in connection with my counselling and psychotherapy practice.
2. Information I collect
Depending on the circumstances, I may collect and process:
- your name and contact details, including telephone number, email address and address where relevant;
- information you provide when making an enquiry through my website, by email, telephone or text;
- information needed to arrange and manage appointments;
- information provided during an initial assessment or during counselling or psychotherapy sessions;
- information about your mental and physical health and wellbeing;
- relevant information about your personal circumstances, relationships, history and previous support or treatment;
- GP details where these are relevant to your safety or care;
- emergency contact or next-of-kin details where appropriate;
- correspondence between us;
- brief clinical notes or aide-memoire notes relating to our work together;
- information relating to appointments and payments where applicable;
- information necessary to deal with complaints, legal matters or my professional and regulatory responsibilities.
I aim to collect only information that is relevant and necessary for the purposes described in this Privacy Notice.
Some of the information you may provide, particularly information concerning your mental or physical health, is special category personal data and receives additional protection under data protection law.
3. How I use your information
I use your personal information for purposes including:
- responding to enquiries;
- assessing whether counselling or psychotherapy is appropriate;
- arranging and managing appointments;
- providing counselling and psychotherapy;
- maintaining appropriate clinical records;
- communicating with you about your sessions and appointments;
- maintaining your safety and responding appropriately to safeguarding or serious-risk concerns;
- receiving professional supervision;
- meeting my professional, legal and regulatory responsibilities;
- dealing with complaints or concerns;
- protecting my legal rights where necessary;
- managing and administering my practice.
Where appropriate, I may use genuinely anonymised information from my professional work for education, training, research or publication.
I will not use information that identifies you for these purposes without an appropriate lawful basis and, where required, your explicit consent.
4. My lawful basis for processing your information
Data protection law requires me to have a lawful basis for processing personal information.
Depending on the purpose, I may rely on:
- performance of a contract where processing is necessary to provide and manage the counselling or psychotherapy service;
- legitimate interests where processing is necessary for appropriate practice administration, professional record keeping, managing my practice and protecting my legal interests, provided these interests are not overridden by your rights;
- legal obligation where I am required to process information to comply with a legal or regulatory requirement;
- vital interests where processing is necessary to protect someone's life in an emergency;
- consent where consent is the appropriate lawful basis for a particular activity.
Because counselling and psychotherapy involve information concerning mental and/or physical health, this may constitute special category data.
I will only process special category data where an applicable condition under Article 9 of the UK GDPR is met, together with any additional requirements under UK law.
For the provision of counselling and psychotherapy, the relevant health or social care condition may apply where its requirements are met.
I do not rely on consent as the general lawful basis for providing counselling or psychotherapy. Where I specifically ask for your consent for a particular use of your information, I will explain what the consent relates to and how you can withdraw it.
The ICO confirms that processing special category data requires both an Article 6 lawful basis and a separate Article 9 condition.
5. Confidentiality and clinical notes
Counselling and psychotherapy are confidential services.
I may make brief clinical notes or aide-memoire notes to help me remember and appropriately reflect on our work together and to support safe and professional practice.
I do not make audio or video recordings of counselling or psychotherapy sessions.
I do not use AI transcription or AI note-taking tools for counselling or psychotherapy sessions.
Confidentiality is subject to the limits explained in my counselling agreement, including circumstances where information may need to be shared because of serious concerns about safety or safeguarding, or where I am legally required or authorised to disclose information.
6. Professional supervision
As part of my professional practice, I receive clinical supervision.
I may discuss aspects of my therapeutic work with my supervisor for the purposes of professional reflection, safe practice and maintaining professional standards.
Where client material is discussed, I take reasonable steps to ensure that information is anonymised or pseudonymised so that you are not unnecessarily identifiable.
I may also participate in peer or professional supervision. I do not normally share identifiable client information in peer supervision.
7. When I may share information
I will normally keep your information confidential and will not share it without your knowledge unless there is a lawful reason to do so.
There may be circumstances where information needs to be shared, including:
- where you have given appropriate permission;
- where I believe there is a serious risk of significant harm to you or another person;
- where there are safeguarding concerns;
- where I am legally required or authorised to disclose information;
- where disclosure is necessary to protect someone's vital interests;
- where disclosure is necessary for the establishment, exercise or defence of legal claims;
- where disclosure is otherwise permitted or required by law or my professional obligations.
Where possible and appropriate, I will discuss significant disclosures with you beforehand.
However, this may not always be possible where doing so could increase the risk of harm or conflict with a legal or professional obligation.
8. Emergency contacts and GP information
Where appropriate, I may ask you to provide an emergency contact or next-of-kin.
If you provide another person's contact details, I ask that you make them aware that you have provided their details to me.
I may also ask for your GP details where these are relevant to your safety, wellbeing or therapeutic work.
I will use this information only for appropriate purposes and in accordance with applicable confidentiality and data protection requirements.
9. Initial enquiries that do not lead to counselling
If you contact me to enquire about counselling or psychotherapy but do not go on to become a client, I will retain your information only for as long as reasonably necessary to deal with your enquiry and determine whether you wish to proceed.
As a general practice, I aim to delete information relating to an enquiry that does not lead to counselling within one month of my last contact with you, unless there is a specific reason to retain it for longer.
10. Email, telephone and text communication
I may communicate with you using email, telephone and text message.
Please be aware that electronic communications can carry some security risks. I will take reasonable steps to protect your information, but no electronic communication system can be guaranteed to be completely secure.
I ask you to consider what information you include in emails or text messages and, wherever possible avoid sending highly sensitive therapeutic information by ordinary email or text.
11. Online counselling
Where counselling or psychotherapy takes place online, I use Microsoft Teams.
Online sessions involve the processing of personal information by the technology provider. I use appropriate privacy and security settings and do not record online counselling sessions.
You should also take reasonable steps to protect your privacy when attending online sessions, including choosing a private location and using a secure device and internet connection where possible.
12. Service providers and technology
I use the following services as part of operating my practice:
Email: IONOS
Online counselling: Microsoft Teams
Website: martabarnett.com
Clinical records and electronic storage: Microsoft OneDrive (Personal)
Electronic clinical records are stored within my OneDrive account. Access to my account is restricted to me and protected by appropriate account and device security measures.
Where an external organisation processes personal information on my behalf, I take reasonable steps to ensure that appropriate data protection and confidentiality arrangements are in place.
Some service providers may process information outside the UK or use infrastructure located internationally. Where this occurs, appropriate safeguards for international transfers will be used where required by UK data protection law.
13. Keeping your information secure
I take reasonable and proportionate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration or disclosure.
My electronic clinical records are stored within Microsoft OneDrive and accessed through my computer.
I use passwords and account security measures to restrict access to client information.
I keep client information accessible only to the extent necessary for my professional and administrative responsibilities.
Where paper records are used, they will be stored securely and access will be restricted.
14. How long I keep your information
I do not keep personal information indefinitely.
I retain information only for as long as I reasonably need it for the purpose for which it was collected, taking account of my professional, legal, insurance and regulatory responsibilities.
I currently intend to retain clinical records for seven years from the end of therapeutic work, after which they will be securely deleted, unless there is a specific and lawful reason to retain them for longer.
I will review my retention arrangements periodically.
Information such as emergency contact details or GP details that is no longer required for the purposes for which it was collected will be deleted when appropriate.
15. Your data protection rights
Depending on the circumstances, you have rights under data protection law including the right to:
- ask for access to the personal information I hold about you;
- ask me to correct inaccurate or incomplete information;
- ask me to erase your personal information in certain circumstances;
- ask me to restrict how I use your information in certain circumstances;
- object to certain processing;
- ask for your information to be provided to you or transferred to another organisation in certain circumstances;
- withdraw consent where I am relying on consent as the lawful basis for a particular use of your information.
These rights are subject to certain legal exceptions. For example, I may need to retain information to comply with a legal or professional obligation or to establish, exercise or defend legal claims.
If you would like to exercise one of these rights, please contact me at:
I may need to verify your identity before providing personal information or acting on a request.
16. Data protection complaints
If you have a concern about the way I have collected, used, stored or otherwise handled your personal information, please contact me at:
You do not need to use legal terminology or refer to specific sections of data-protection legislation when making a complaint.
I will acknowledge a data protection complaint within 30 days, investigate it appropriately and without undue delay, keep you informed about progress where appropriate, and provide you with the outcome of my investigation without unjustifiable or excessive delay.
The ICO's current guidance explains that people can complain directly to the organisation handling their information and that organisations should have an appropriate process for dealing with data-protection complaints.
If you remain dissatisfied, you can complain to the Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
17. Changes to this Privacy Notice
I may update this Privacy Notice from time to time to reflect changes to my practice, technology, professional requirements or data-protection law.
The most recent version will be available on my website:
martabarnett.com
Last reviewed: June 2026