Jo Robinson-Castro
Privacy Policy
This privacy notice explains how I will manage your personal information, including why I collect it, how I use it and how I keep it secure. I am registered with the Information Commissioner’s Office (ICO), and I adhere to current data protection legislation.
Data Controller - Jo Robinson-Castro
Email - [email protected]
ICO registration number - ZB777183
Information I Collect & Use
To provide you with the best possible counselling service I will collect your personal contact details, including your name, address, phone number and email. I will also request your pronoun preferences, your date of birth, emergency contact details, GP details, some health information (including medical conditions, allergies, and any medical requirements relevant to an emergency). These personal details are necessary to arrange our work together and to support you in the case of an emergency. I will normally collect personal information directly from you.
I keep brief, factual notes about our sessions. These are used as an aide-memoire for me. I will also keep a record of sessions scheduled, attended and fees paid, which are needed for fulfilling my tax obligations.
Information Storage
Information held electronically is stored on password protected devices and, where necessary, in secure cloud storage services used to administer my practice. Information held in physical paper form, such as a signed copy of our counselling agreement, is stored in a locked filing cabinet. Any communications between us via email or text and accessed on my phone are password protected. I take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure.
International Transfers
Some of the service providers I use to support my practice, including Dropbox, Apple iCloud and Zoom, may process or store personal information outside of the UK. Where this occurs, I ensure that appropriate safeguards are in place in accordance with UK data protection law, such as the use of approved contractual protections and providers’ UK GDPR compliance commitments.
Data Retention / Deletion
If you become a client, I will keep your personal information for the duration of our work together and five years thereafter. This is in accordance with the recommendation made by my insurance company. If you make an enquiry via my website or a counselling directory, I will keep your basic contact details for not more than 6 months. I keep personal information only for as long as necessary to provide counselling services and to meet my professional, legal, insurance and business obligations. Once the relevant retention period has expired, information will be securely deleted or destroyed. Papers records will be securely shredded and electronic records permanently deleted when they are no longer required.
Data Sharing
Our work together is confidential. However, there are limited situations in which I may need to share your relevant personal information, as follows:
GP, other health providers or emergency services - if I have a major concern and need to safeguard yourself or others from serious harm, I may need to contact your GP or another health service. I would aim to discuss this with you in advance to gain your consent, but in an emergency this may not be possible.
Supervision – to maintain high standards of professional practice and meet the obligations of my professional bodies, I engage in regular clinical supervision. Only information necessary for the purposes of professional supervision will be shared. Wherever possible, identifying information is minimised, and my supervisor is bound by professional and ethical duties of confidentiality and is UKCP and BACP registered.
Clinical will – in the event of my death, serious illness or other incapacitation that prevents me contacting you personally, I have appointed an executor of my clinical will. This is a requirement of my professional associations. The executor is a trusted colleague who is also UKCP or BACP registered and is authorised by me to communicate with you in these circumstances. This person only has access to your contact details and any information reasonably necessary to notify you of my inability to work and to assist with arrangements for ongoing support if you wish.
Legal obligation – I may have to disclose some personal information if required to do so by a court of law.
Lawful Bases & Your Rights
Under UK data protection law, I must have a lawful basis for collecting and using your personal information. For the provision of counselling services, my lawful basis for processing your personal information is:
Contract – processing is necessary for me to enter into and fulfil a counselling agreement with you. This includes arranging appointments, maintaining client records, communicating with you about our work together and managing payments.
Legitimate interests - processing is necessary for the legitimate interests of running a safe and professional counselling practice. This includes maintaining appropriate records, professional supervision, responding to complaints, meeting insurance requirements, safeguarding clients and complying with professional standards.
Some of the information I process, including details about your physical or mental health, is classed as special category data under UK data protection law. Where I process this information I do so because it is necessary for the therapeutic service I provide and for the management of that service and because appropriate safeguards are in place to protect your confidentiality.
Where I ask for your consent to process information, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn.
You have the right to request access to the personal information I hold about you, to request correction of inaccurate information, to request restriction of processing in certain circumstances, and to request erasure of information where applicable. Depending on the circumstances, you may also have the right to object to certain types of processing and to request that your personal information be provided in portable format. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
To exercise any of your rights, please contact me at [email protected] . I will respond without undue delay and normally within one month of receiving your request.
How to Complain
If you have any concerns about how I have handled your personal information, you may submit a complaint by email to [email protected]. I will acknowledge your complaint and investigate it fairly and promptly. I aim to respond to complaints within 30 days, although more complex matters may take longer. If you remain dissatisfied after my response, you may complain to the Information Commissioner’s Office (ICO). For more information visit the ICO website.
Privacy policy last updated: June 2026