Privacy Notice

This notice explains how I collect, use and protect personal information when you enquire about or use my services. It applies to adult counselling, online sessions, couples work, work with children, young people and families, and clinical supervision provided to supervisees. Some service-specific arrangements are explained in the relevant working agreement.

The section How this website handles your information explains what happens when you use this site, including the enquiry form.

1. Who is responsible for your information

Shema Mandy, trading as Counselling with Shema, is the data controller. This means I am responsible for deciding how and why your information is used. You can contact me at [email protected], through the practice email address provided to you, through the secure client portal, or through this website.

2. Information I may collect

Your name, date of birth, address, email address, telephone number and other contact details.
Your GP, emergency contact and, for online or international work, your physical location, time zone and relevant local emergency details.
Information you provide in an enquiry, referral, assessment, consent form or booking.
Information about your wellbeing, health, personal history, relationships, family circumstances and what we discuss in our work.
Brief session records, attendance, agreed arrangements, correspondence, payments and invoices.
Information connected with a concern, complaint, safeguarding matter, insurance issue or legal request.

Most information comes directly from you. Where appropriate and lawful, information may also come from a parent or carer, a referrer, another professional, or somebody you have asked to contact me.

3. Why I use your information

To respond to enquiries, assess whether I am the right person to work with you and provide the service we have agreed.
To arrange sessions, communicate with you, receive payment and keep accurate financial records.
To support safe, consistent and ethical work, including clinical supervision, safeguarding and emergency planning.
To meet professional, insurance, tax, accounting and legal responsibilities.
To respond to questions, concerns, complaints, legal claims or regulatory enquiries.

4. Lawful bases

I use personal information where it is necessary to take steps at your request or to fulfil our agreement; where I have a legitimate interest in running a safe, ethical and properly administered practice; where I must meet a legal obligation; or where use is necessary to protect somebody’s vital interests in an emergency.

Information about health, wellbeing and other sensitive matters may be special-category information. I use this with your explicit consent for our work together. In limited circumstances, another condition may apply, such as protecting vital interests, safeguarding, establishing or defending legal claims, or another condition required or permitted by law.

You can withdraw consent at any time by contacting me. This may mean that our work cannot continue, but it does not require me to delete information that I am allowed or required to retain for another lawful reason.

I treat your information as confidential and only share it when there is a clear reason. I use the minimum information reasonably necessary.

Where appropriate, I may share information with my clinical supervisor, confidential administrative support, or a professional executor or trusted colleague if I cannot contact clients.

I also use providers for client records and bookings, video, telephone or messaging, email, secure file storage and payments. They receive only the information needed to provide their service. Necessary information may also be shared with my accountant, insurer, legal adviser, professional body, or emergency, safeguarding or legal authorities.

In clinical supervision, I may use your first name because this feels more human. I do not share your surname or contact details, and I avoid other information that could identify you wherever possible. I share only what is needed for safe and ethical supervision.

Administrative support and service providers receive only what they need and must protect it.

6. International processing

Some technology or payment providers may process information outside the UK. Where the UK GDPR applies, I use providers and arrangements intended to protect your information through UK adequacy regulations, recognised contractual safeguards or another lawful transfer mechanism. You can ask me for more information about the safeguards relevant to a particular provider.

If you live outside the UK, your information is received and handled by my UK-based practice. Data-protection rules in the country where you live may also apply.

7. How long information is kept

If an enquiry does not lead to work together, the information is generally kept for no longer than 12 months after our last contact, unless there is a clear reason to retain it for longer.
Adult clinical and related administrative records are generally kept for seven years after our last session.
Children’s and young people’s clinical and related administrative records are generally kept until the young person’s 25th birthday, or 26th birthday if therapy ended when they were 17. This is my private-practice policy informed by NHS records-management guidance, rather than an NHS requirement on my practice. At that point, records are reviewed and securely deleted unless safeguarding, a complaint, insurance, a legal obligation or another documented reason justifies keeping them longer.
Financial and tax records may be kept for six years or for another period required by law.
Safeguarding, complaint, insurance or legal records may be kept longer where there is a clear reason.

8. Keeping information safe

I use proportionate measures such as password protection, access controls, secure systems and separation of identifying information from brief clinical notes where practical. No electronic system can be guaranteed completely secure, but I take reasonable steps to reduce risk and review the services I use.

9. Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to ask for access to your information, correction of inaccurate information, deletion, restriction, portability or an explanation of how it is used. Some rights are not absolute, and I will explain if a request cannot be met in full.

Your right to object

You have the right to object to processing based on legitimate interests. If you object, I will consider your reasons and will stop using the information in that way unless I have a compelling legal reason that outweighs your rights, or the information is needed to establish, exercise or defend a legal claim.

I do not sell client information and do not use automated decision-making or profiling to make decisions about you.

10. Children and young people

Where I work with a child or young person, I explain privacy in a way that is suitable for their age and understanding. Parents or carers may provide information and take part in the work, but this does not give an automatic right to receive everything the child or young person says. Information is shared according to the working agreement, consent or assent, safeguarding responsibilities and the law.

How this website handles your information

The enquiry form

The Contact page asks for your name, an email address or a phone number (or both), and an optional message. When you send it:

it goes to a small server-side function that is part of this website, hosted on Microsoft Azure;
a copy of the enquiry is stored in the website’s Azure storage, and it is emailed to me through Brevo (formerly Sendinblue), an email delivery service.

Please keep a first enquiry brief. You do not need to include details of your health or history, and the form is not an emergency contact route. If you do choose to include health information, it is special-category information and is handled as described in sections 4 and 7: enquiries that do not lead to work together are generally kept for no longer than 12 months after our last contact.

Spam protection

The enquiry form uses Google reCAPTCHA to tell people from automated submissions. To do this, Google receives information about your device and how you interact with the Contact page, and reCAPTCHA may store information in your browser. It is loaded on the Contact page only, and is used solely to protect the form. Google’s use of this information is covered by Google’s privacy policy.

Analytics and cookies

This website uses Google Analytics to count visits and see which pages are used, how people arrive and roughly how long they stay, so that I can improve the site. It sets cookies (whose names start with _ga) in your browser and sends Google details of your visit: the pages you view, your browser and device type and your approximate location. Google does not keep your full IP address.

I use this information only as overall statistics, never to identify or follow individual visitors. Google processes it on my behalf and may not use it for its own purposes. Advertising features and Google signals are switched off, and the site uses no advertising or remarketing cookies. Nothing you type into the enquiry form is sent to Google Analytics. Google may process the information outside the UK, under the safeguards described in section 6, and it is deleted after two months.

The law allows cookies used only for statistics like these without asking first, as long as you can object. My lawful basis under the UK GDPR is my legitimate interest in understanding how the site is used.

To turn analytics off, use Cookie settings at the bottom of any page. Your choice is remembered in this browser, and you can turn analytics back on there. If your browser sends a Global Privacy Control signal, analytics stays off unless you turn it on.

The typefaces are served from this website itself, so reading a page does not contact Google Fonts.

Links to other services

The “Bookings” link goes to Halaxy, a separate booking service with its own privacy notice. The map link on the Contact page opens Google Maps. Nothing on this site sees what you do once you are on another service.

11. Questions and complaints

Please contact me first if you have a question or concern about your information so that I can try to help. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

12. Changes to this notice

I may update this notice when my services, systems or legal responsibilities change. I will make the current version available and will tell existing clients about a material change where appropriate.

This page was last updated on 10 October 2026.