Carla Simmons

Privacy Policy

Carla Simmons Counselling and Psychotherapy – Last updated: October 2026

Your privacy matters to me. I understand that reaching out for counselling can feel like a big step, and you may be sharing personal or sensitive information.

This Privacy Policy explains what information I collect, why I collect it, how I keep it secure and what rights you have.

It applies to anyone visiting my website, contacting me about counselling or working with me as a client.

If there’s anything you’re unsure about, you’re welcome to ask.

1. Who I am

I’m Carla Simmons MSc, MBACP, a qualified integrative counsellor offering online and face-to-face counselling for adults.

I am registered with the British Association for Counselling and Psychotherapy (BACP).

I’m also registered with the Information Commissioner’s Office (ICO).

As a self-employed counsellor, I am the data controller for the personal information I collect and hold. This means I’m responsible for deciding how your information is used and ensuring it’s handled appropriately under UK data protection law.

Contact details

  • Name: Carla Simmons MSc, MBACP
  • Website: carlasimmons.com
  • Email: hello@carlasimmons.com
  • BACP membership number: 421308
  • ICO registration number: C2068999

2. What information do I collect?

The information I collect depends on whether you’re visiting my website, making an enquiry or attending counselling.

If you visit my website

My website is hosted through WordPress.com, which may process information such as your IP address, browser type, device information and pages visited.

Cookies and similar technologies may also be used to help the website function and, where enabled, understand how visitors use it.

You can find more information about this in Section 10.

If you contact me

If you complete my website contact form or contact me by email, phone or text, I may collect:

  • Your name
  • Your email address
  • Your telephone number, if provided
  • Information you choose to share in your enquiry

I use this information to respond to you, answer questions and arrange an introductory call if appropriate.

You don’t need to share detailed personal or medical information in your initial enquiry. A brief message about what you’re looking for is enough.

If you become a client

If we decide to work together, I will collect and securely hold information relevant to providing counselling, which may include:

  • Your full name and date of birth
  • Contact details
  • GP details
  • Emergency contact information
  • Relevant medical and personal history
  • Information you share during counselling
  • Brief handwritten counselling notes
  • Appointment and attendance records
  • Payment information
  • Correspondence between us

Some of this information is considered special category personal data under UK GDPR, particularly information relating to your physical or mental health.

This information receives additional legal protection.

3. Why I use your information

I only collect and use personal information where there is a clear reason to do so.

This includes:

  • Responding to enquiries and arranging introductory calls
  • Assessing whether I can provide appropriate counselling
  • Arranging and delivering counselling sessions
  • Maintaining appropriate clinical records
  • Supporting safe and ethical practice through clinical supervision
  • Managing appointments and payments
  • Meeting professional, insurance, legal and accounting obligations
  • Protecting someone’s safety where there is a serious risk of harm

My legal basis for using your information

Under UK GDPR, different reasons for using personal information have different legal bases.

These include:

Contract — Article 6(1)(b)

To arrange and provide counselling services under our counselling agreement.

Legitimate interests — Article 6(1)(f)

To respond to enquiries, manage my practice, maintain appropriate records and protect my professional interests, where those interests do not override your rights.

Legal obligation — Article 6(1)(c)

To comply with relevant legal requirements, including tax and accounting obligations.

Vital interests — Article 6(1)(d)

Where necessary to protect someone’s life in an emergency.

Sensitive personal information

Counselling may involve information about your mental health, emotional wellbeing and personal circumstances.

Some of this information is classed as special category data under UK data protection law and requires additional protection.

Where necessary to provide counselling, I rely on Article 9(2)(h) of UK GDPR, which covers the provision of health care or treatment, alongside Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

As a counsellor, I work within professional and legal confidentiality obligations. I only collect and use sensitive information where it is necessary for providing counselling, maintaining appropriate clinical records and supporting safe, ethical practice.

Your information is treated confidentially, subject to the limits of confidentiality explained elsewhere in this policy.

4. Confidentiality and its limits

Confidentiality is an important part of counselling.

What you share with me is treated confidentially, and I won’t share your personal information unnecessarily.

There are, however, certain circumstances where I may need to share relevant information.

These may include:

  • Where there is a serious risk of harm to you or another person
  • Where I have a safeguarding concern
  • Where disclosure is required by law or a valid court order
  • Where information is necessary in connection with legal proceedings or a professional complaint

Where possible and appropriate, I will discuss any need to share information with you first.

Clinical supervision

As a BACP registered member, I undertake regular clinical supervision to support safe, ethical and effective counselling practice.

This involves discussing aspects of my therapeutic work with a qualified supervisor, who is also bound by confidentiality.

I avoid using identifying information wherever possible.

We will discuss confidentiality and its limits as part of our counselling agreement before beginning therapy.

5. Who I share your information with

I do not sell your personal information or use your counselling information for marketing.

I use certain third-party services to help manage my practice.

These include:

WordPress.com

For website hosting and contact form enquiries.

Google Workspace

For securely storing and managing digital client information and counselling records.

Titan Email

For professional email communication, including responding to enquiries and arranging counselling appointments.

Zoom

For online counselling sessions.

These providers may process information on my behalf in connection with the services they provide. Their own privacy policies explain how they handle information within their systems.

Other circumstances

I may also share relevant information, where appropriate and legally justified, with:

  • My clinical supervisor
  • Emergency services or healthcare professionals where necessary to protect safety
  • My professional indemnity insurer
  • Legal or professional advisers
  • The BACP where relevant to a professional complaint
  • Other individuals or organisations where you have authorised a disclosure

I will only share information that is necessary for the particular circumstances.

6. How and where your information is stored

I take the confidentiality and security of your personal information seriously.

Digital records

Digital client information will be stored using Google Workspace, with password protection and two-factor authentication.

My laptop is password protected, and access to client information is restricted to me.

Handwritten counselling notes

I also keep brief handwritten counselling notes.

These are stored separately in a locked safe, which only I can access.

Where I use first names in handwritten notes, I maintain separate information that allows the notes to be linked to the correct client when necessary.

Online counselling

Online sessions will take place using Zoom, with available security measures such as meeting passcodes and waiting rooms.

Sessions will not be recorded as part of my normal practice.

Information stored outside the UK

I use technology providers, including WordPress.com, Google Workspace and Zoom, to support my counselling practice.

Some personal information may be stored or processed outside the United Kingdom.

Where this happens, I use providers with arrangements designed to protect personal information in accordance with applicable data protection requirements. These may include recognised international data transfer agreements or protections approved under UK data protection law.

If you’d like further information about how your personal information is protected, you can contact me at hello@carlasimmons.com.

7. How long I keep your information

I don’t keep personal information indefinitely.

Counselling records

I keep adult client counselling records for five years after our final session, in line with Holistic Insurance’s published record-keeping requirements.

Records may need to be retained for longer where there is another applicable legal or professional requirement, or an ongoing claim or dispute.

Enquiries that don’t lead to counselling

If you contact me but decide not to proceed with counselling, I will keep your enquiry information for up to six months from our last contact.

After this period, your information will be securely deleted, unless there is a legal reason for keeping it longer.

Financial records

Payment and accounting records are kept for the period required under applicable tax and accounting law.

Secure disposal

When information is no longer required, electronic records are securely deleted and paper records are securely destroyed.

8. Keeping your information secure

I take reasonable steps to protect personal information against unauthorised access, loss, misuse or disclosure.

These include:

  • Password-protected devices and accounts
  • Two-factor authentication for relevant digital services
  • Restricted access to client information
  • Secure storage of handwritten notes in a locked safe
  • Keeping handwritten counselling notes separate from other identifying information where practical
  • Using appropriate security settings for online sessions

Although I take steps to protect your information, no method of electronic communication is completely risk-free.

For this reason, I encourage clients to keep sensitive information shared by email or text to a minimum wherever possible.

If a personal data breach occurs, I will assess the risks and notify the ICO and affected individuals where required by law.

I may contact you by email, telephone or text message to respond to enquiries and arrange or manage counselling appointments.

I aim to keep these communications brief and practical, avoiding sensitive personal information wherever possible.

We can discuss your preferred method of contact before beginning counselling.

9. Your rights

Under UK data protection law, you have rights in relation to your personal information.

Depending on the circumstances, these may include the right to:

  • Know what information is collected and how it is used
  • Request access to personal information held about you
  • Ask for inaccurate information to be corrected
  • Request deletion of information where applicable
  • Request restrictions on how your information is used
  • Object to certain uses of your information
  • Withdraw consent where consent is the relevant legal basis
  • Request transfer of certain information to another provider where applicable

Some rights have exceptions, particularly where records must be retained to meet legal or other legitimate obligations.

If you’d like to make a request about your personal information, please contact me using the email address provided above.

I will respond within the timescales required by data protection law, normally within one month.

10. Cookies and website information

My website is hosted through WordPress.com, which uses cookies and similar technologies to support website functionality and security.

I also use Jetpack Stats to understand how visitors use my website, including which pages are viewed and how people find the site.

Jetpack uses a tracking pixel and processes certain technical information, such as IP addresses and browser information, to provide these statistics.

I use Complianz to manage cookie preferences. When you visit my website, you can choose to accept or reject optional tracking, or manage your preferences.

You can change your cookie preferences at any time using the cookie settings on my website.

For more information about how cookies are used, please see my Cookie Policy.

11. Changes to this privacy policy

I may update this policy if there are changes to my counselling practice, the services I use or relevant data protection requirements.

The date at the top of this page shows when the policy was last updated.

Where significant changes affect existing clients, I will explain these where appropriate.

12. Questions or complaints

If you have any questions about how your information is collected, used or stored, please contact me.

I would welcome the opportunity to answer your questions or address any concerns.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

If your concern relates to my professional conduct rather than how your personal information has been handled, you can also contact the British Association for Counselling and Psychotherapy.

Website: https://www.bacp.co.uk