What is the purpose of this policy?

I recognise that you trust me with your personal information and I take my data protection responsibilities seriously.  This privacy notice explains how I handle any personal information about you, what I do with your information, why, and what rights you have. I’ve tried to keep it plain. If anything here isn’t clear, please ask me.

1.    Who I am

I’m Carina Badger. I work as a sole trader under the name Carina Badger Psychotherapy, offering individual therapy, group therapy and clinical supervision in Manchester (United Kingdom) and online.

I am the data controller for the information I hold about you. That means I’m responsible for deciding how it’s held and used, and accountable for looking after it.

• Email: carina@carinabadger.com

• BACP registration: 388754

• UKCP registration: 2011175213

• ICO registration: ZB015192

Email is the best way to reach me about anything in this notice.

2.    Who this notice is for

This notice covers everyone I hold information about in the course of my work:

• people who contact me but don’t go on to become clients or supervisees

• individual therapy clients

• group therapy members

• supervisees

Where something applies only to one of these groups, I’ve said so.

3.    What information I hold

When you first get in touch, I hold your name, email address and phone number, and whatever you choose to tell me about what’s bringing you to therapy or supervision.

If you become a client (including as a member of a therapy group), I also hold:

• handwritten notes of our sessions — I keep these very brief and I use reasonable efforts not to include information that would identify you

• a short electronic record: your name, email address, phone number, GP details, and the number of sessions we’ve had

• emails between us and appointment details

• a record of payments and invoices

• occasional session recordings, where you have agreed to them (see section 6)

Much of what you tell me in therapy is what data protection law calls special category information. This is information that needs extra protection — for example, your health and mental health, your ethnicity, your religious or philosophical beliefs, your sexual orientation, your gender identity, and your relationships. You’re not obliged to tell me any of it. It comes up because it’s part of the work.

Your notes may also mention other people — a partner, a family member, a colleague. I keep what I record about them to the minimum needed to make sense of our work.

If you’re a supervisee, I hold your name, contact details, your training and training institute (if applicable), professional body, notes of our supervision, a record of sessions and payments, and occasional recordings where you’ve agreed. Supervisees don’t share identifiable information about their own clients with me.

If you’re a member of a therapy group, please note that other members of the group will hear what you share. The group will typically agree to keep what’s said in the group confidential, but I can’t guarantee that they will.

4.    Where I get information about you from

Almost always I get this information directly from you: by email, in sessions, or when you book through Calendly. Occasionally someone is referred to me by a colleague or another professional, and in that case I only accept information about you with your knowledge.

5.    Why I use your information, and my lawful basis

Under UK data protection law, I need a lawful basis for everything I do with your information.

• Arranging and providing therapy or supervision, and communicating with you about it: Contract; and for special category information, Article 9(2)(h) UK GDPR with paragraph 2, Schedule 1 of the Data Protection Act 2018 (health or social care purposes, provided by someone under a duty of confidentiality)

• Keeping clinical records: Contract, and my legitimate interests in practising safely and being able to answer a complaint or claim

• Discussing my work in clinical supervision, as my professional bodies require: My legitimate interests in ethical and competent practice

• Recording sessions: Your explicit consent, which you can withdraw at any time

• Invoicing, payments and tax records: Contract, and legal obligation

• Letting you know about waiting list availability, future groups, or supervision-related events: Your consent

• Contacting someone else if I believe you or another person is at serious risk of harm: Vital interests, and where it applies, the safeguarding condition in paragraph 18, Part 2, Schedule 1 of the Data Protection Act 2018

• Responding to a legal requirement, court order, complaint or claim: Legal obligation, and my legitimate interests in defending legal claims

I don’t use your information for marketing, I don’t sell it, and I don’t use it for automated decision-making or profiling.

6.    Recording sessions

I record occasionally, never routinely, and never without asking you first.

• Therapy sessions, individual and group — recordings are used for my own clinical supervision and nothing else. I delete the recording once it has been used in supervision.

• Supervision sessions — recordings are used for my own supervision, and for case studies and professional accreditation. I delete the recording once the relevant training or accreditation is complete.

• For a group session, I ask every member present. If anyone would rather I didn’t record, I don’t and that is absolutely okay.

Saying no to recording has no effect on the work we do together, and you can change your mind at any point, including about a recording already made.

7.    How I store and protect your information

Session notes are handwritten and kept in a locked cupboard at my home. They are not stored online.

Electronic records are held in password-protected files on encrypted devices, with two-factor authentication on the accounts I use.

Emails are held in Google Workspace, which is a business service with a data processing agreement rather than a personal email account.

Recordings are made on a password-protected device, transferred to secure storage promptly, and deleted from the recording device.

Your contact details only are held in the Clinical Will platform (see section 11).

I have a procedure for dealing with a suspected data breach, and I will tell you and the ICO where the law requires it.

8.    Who I share your information with

I will not share your information with anyone else without your consent, except in the situations below.

People I share with in the ordinary course of the work

• My clinical supervisors. I discuss all of my client work in supervision, as my professional bodies require. I use first names only and keep identifying detail to a minimum. My supervisors are members of the BACP and/or UKCP and are bound by their ethical codes.

• If you are in training and you need me to sign a record of therapy or supervision sessions attended, which will always be with your express consent. I may also need to complete a supervision report for your training provider.

• My clinical trustee, but only if I die or become incapacitated. See section 11.

• An employer, where an employer is paying for your sessions. I share attendance, session dates and session numbers for billing. Nothing about the content of our work is shared with your employer, ever.

People I share with only where I have to

• Emergency services, your GP, or another appropriate person, if I reasonably believe you or someone else is at serious risk of harm. Wherever it’s possible and safe, I’ll discuss this with you first.

• A court, or another body I’m legally required to disclose to, including under legislation on safeguarding, terrorism or criminal activity.

• My professional body or insurer, if there is a complaint or claim.

• My legal advisers, if I need legal advice.

Service providers who handle information on my behalf

These act on my instructions and cannot use your information for their own purposes:

• Google Workspace: Email, calendar and file storage

• Squarespace: My website and its contact form

• Calendly: Booking, for existing clients only

• Zoom and Google Meet: Online sessions

Clinical Will: Secure storage of client contact details for the arrangements in section 11

Some of these providers store information outside the UK. Where that happens, the transfer is covered by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum.

9.    How long I keep your information

• Enquiries from people who don’t become clients or supervisees: 6 months

• Client records, individual and group: 7 years after our work ends

• Supervision records: 7 years after our work ends

• Recordings of therapy sessions: deleted once used in supervision

• Recordings of supervision sessions: deleted once the relevant training or accreditation is complete

• Invoices and financial records: 7 years, to meet tax requirements

• Contact details held for waiting lists or notifications: until you ask me to stop or one year, whichever is sooner

I keep client and supervision records for seven years because my professional bodies and my indemnity insurer require it, and because I need to be able to show I’ve acted properly if a complaint or claim is ever made. This means there are periods during which I can’t delete some information even if you ask me to. I’ll always explain why if that comes up.

Anything I no longer have a reason to keep, I delete or destroy securely.

10.   Your rights

You have the right to:

• ask for a copy of the information I hold about you

• ask me to correct anything inaccurate or incomplete

• ask me to delete it, in some circumstances

• ask me to restrict or stop using it, in some circumstances

• object to how I’m using it

• ask me to transfer it to you or someone else, where that applies. This doesn’t extend to session recordings, which contain my personal information as well as yours and can’t be separated

• withdraw your consent at any time, where I’ve relied on your consent — for recordings, or for keeping you on a waiting list

• complain, both to me and to the ICO. See section 12

Please make requests by email. I’ll respond within one month. If I need to ask you for more information before I can deal with your request, that time limit pauses until you reply.

Withdrawing consent won’t affect the quality of the work between us, although it may affect what I can offer safely and ethically.

11.  If I die or become incapacitated

My professional bodies require me to have arrangements in place so that clients aren’t left without support if something happens to me. This is called a clinical will.

I have appointed a BACP-registered psychotherapist as my clinical trustee. If I die or become incapacitated, she can access your name, email address and phone number — and nothing else — in order to contact you, let you know what has happened, and help you find support elsewhere. She is bound by the same kind of ethical code and duty of confidentiality that I am.

These contact details are held securely and in encrypted form on the Clinical Will platform, which exists solely for this purpose.

12.  How to complain

If you’re unhappy with how I’ve handled your information, please tell me. You can use this form, email me at carina@carinabadger.com. You don’t need to use any particular form of words, or call it a complaint.

I will:

• acknowledge your complaint within 2 weeks

• look into it without undue delay

• keep you updated on progress

• tell you the outcome, and what you can do if you’re not satisfied

I keep a record of complaints and how they were dealt with.

You can also complain to the Information Commissioner’s Office at any time, whether or not you’ve raised it with me first:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113

13.  Cookies and this website

My website uses only the cookies it needs to function. There are no analytics, tracking or advertising cookies, nothing about your visit is monitored, and no consent banner is needed as a result.

If that ever changes, I’ll update this notice and add a banner before turning anything on.

14.  Changes to this notice

I review this notice at least once a year, and whenever my practice or the law changes. The current version will be on this page.

© Carina Badger, 2026