Privacy & Complaints Policy
Sarah Amer Therapy
Last updated: June 2026
Introduction
Your privacy is important to me and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose for which it was given to me. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data Use and Access Act 2025.
This privacy notice tells you what I will do with your personal information from initial point of contact through to after our work together has ended, including:
- Why I am able to process your information and what purpose I am processing it for
- Whether you have to provide it to me
- How long I store it for
- Whether there are other recipients of your personal information
- Whether I intend to transfer it to another country
- Whether I carry out any automated decision-making or profiling
- Your data protection rights
I am happy to discuss any questions you might have about this privacy notice. You can contact me via email at info@sarahamertherapy.co.uk
I am the data controller for the personal information I hold about you. This means I am responsible for deciding how and why your personal data is held and used.
Contact Details
info@sarahamertherapy.co.uk
My Lawful Basis for Holding and Using Your Personal Information
UK data protection law requires me to have a lawful basis for processing your personal data. The lawful basis I rely on depends on the stage of our relationship.
If you are currently having counselling with me or are in contact with me to consider it: I process your personal data where it is necessary for the performance of our contract.
If our work together has ended: I use legitimate interests as my lawful basis for holding and using your personal information, in order to maintain appropriate clinical records.
For special category information: Some of the information you share with me may be sensitive in nature, including information about your health, relationships, identity or background. This is called special category personal information. The lawful basis for processing this is that it is necessary for the provision of counselling, a health treatment service, under a contract between us.
How I Use Your Information
Initial contact
When you contact me with an enquiry about counselling, I will collect basic information to help me respond to you. This will typically include your name and contact details, and any information you choose to share about what has brought you to seek counselling.
If you decide not to proceed to therapy, I will delete your personal data within three months of our last contact. If you would like me to delete it sooner, please let me know.
While you are having counselling
Everything you discuss with me in sessions is confidential. I will only break that confidentiality in the following limited circumstances: where there is a serious and immediate risk of harm to you or to others; where I am legally required to do so; or where you give me explicit permission to share information. I will always try to discuss this with you first, unless there are safeguarding reasons that prevent me from doing so.
I keep brief written notes of each session. These are stored securely on a password-protected laptop. They are not shared with any third party, except in anonymised form with my clinical supervisor for the purposes of maintaining good practice. My supervisor is bound by the same standards of confidentiality as I am.
I keep a record of your contact details and any other personal information you have provided, such as your emergency contact details and relevant health or background information. These are stored securely on a password-protected laptop and in a separate password-protected email account.
If you contact me by text message for practical purposes such as cancellations or running late, I will retain those messages for the duration of our work together and delete them when our work ends. Text messages will not contain clinical information.
Email correspondence between us is retained in a separate, password-protected email account for the duration of our work together and for the retention period described below.
After counselling has ended
Once our work together has ended, your records will be kept for a minimum of seven years from the date of our last contact, in line with the guidance of the British Association for Counselling and Psychotherapy. After this period, all records are securely destroyed.
If you would like me to delete your information before this period has elapsed, please contact me. I will consider such requests carefully, though in some circumstances I may be required to retain records for legal or professional reasons.
Sensitive Personal Information
In the course of our work together, you may share sensitive personal information with me. This could include information relating to your physical or mental health, your racial or ethnic background, your religious or philosophical beliefs, your sexual orientation or sex life, or your political views. I record such information in my session notes only where it is clinically relevant to our work.
This information is handled with particular care, is stored securely, and is not shared with any third party except in the limited circumstances described in this notice.
Automated Decision-Making and Profiling
I do not carry out any automated decision-making or profiling using your personal data. All decisions relating to your counselling are made by me as a practitioner, based on our work together.
Data Security
I take the security of your personal information seriously. Your data is stored on a password-protected laptop and in a separate password-protected email account. I do not use unsecured cloud storage for client records. I do not share your personal information with any third party except in the limited circumstances described in this notice.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, I will notify the Information Commissioner's Office within 72 hours and will inform you directly where required.
Who I Share Your Information With
I do not share your personal information with third parties except in the following circumstances:
- With my clinical supervisor, in anonymised form as far as possible, for the purposes of maintaining safe and ethical practice
- With relevant authorities where there is a serious and immediate risk of harm to you or others, or where I am legally required to do so
- With emergency services in a situation where there is immediate risk to life
I use Google and Meta platforms for website analytics and online advertising. These platforms may process data about visitors to my website, including IP addresses and browsing behaviour. No client therapy records or special category data are shared with these platforms. Both Google and Meta participate in the UK-US Data Bridge, which means data transfers to the United States comply with UK data protection law.
Your Data Protection Rights
Under UK data protection law you have the following rights:
Right of access: You have the right to ask me for copies of the personal information I hold about you.
Right to rectification: You have the right to ask me to correct personal information you think is inaccurate or incomplete.
Right to erasure: You have the right to ask me to delete your personal information in certain circumstances.
Right to restriction of processing: You have the right to ask me to limit how I use your personal information.
Right to object to processing: You have the right to object to my processing of your personal information in certain circumstances.
Right to withdraw consent: Where I rely on consent as a lawful basis, you have the right to withdraw that consent at any time.
To exercise any of these rights, please contact me at info@sarahamertherapy.co.uk. I will respond without undue delay and within one month of receiving your request.
You can read more about your data protection rights at ico.org.uk/your-data-matters.
How to Complain
If you have any concerns about how I have handled your personal data, I want to hear from you and I will take your concern seriously.
Step 1: Contact me directly
Please raise your concern with me in the first instance using any of the following:
Online: www.sarahamertherapy.co.uk/privacy-and-data-protection
Email: info@sarahamertherapy.co.uk
I will acknowledge your complaint within 30 calendar days of receiving it, and will investigate and respond as soon as reasonably possible.
Step 2: Contact the ICO
If you are not satisfied with my response, or if I have failed to respond within a reasonable time, you have the right to escalate your complaint to the Information Commissioner's Office, the UK's data protection regulator.
ICO website: ico.org.uk
ICO helpline: 0303 123 1113
ICO address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Visitors to My Website
When someone visits www.sarahamertherapy.co.uk, I use Google Analytics to collect standard internet log information and details of visitor behaviour patterns, such as the number of visitors to various pages. This information is processed in a way that does not identify individuals. I use this information to improve my website and my services.
My website uses cookies to help it function effectively. Under the Data Use and Access Act 2025, low-risk analytics cookies of this kind do not require explicit consent. You can read Google's privacy notice at policies.google.com/privacy.
If you fill in a contact form on my website, that information will be sent to me via email and stored in my password-protected email account.
Changes to This Notice
I will update this privacy notice when necessary. The date of the most recent revision is shown at the top of this document. If I make significant changes, I will make this clear on my website.