Privacy Policy

This policy takes effect from 25 May 2018 in line with the new General Data Protection Regulations (GDPR) legislation.

We sometimes ask you to give us information about yourself and your family, so we can make sure you receive the appropriate services. This policy explains what happens with this information.

Your consent

When you contact Calm Reflections, we'll tell you how your information will be used, and that it may be necessary to share this with other services and organisations.

If you do not want us to share your information, you should let us know. However, there are times when we may still need to share it, for example:

  • any stated purposes we tell you about when you supply us with information
  • to allow me to ensure any therapy provided meets appropriate professional ethics
  • as part of our duty to protect a child, a vulnerable adult, yourself or the public, including sharing with other agencies in the event of an emergency
  • for the prevention and detection of a crime
  • if we are required to do so by any court or law within England and Wales.

What information do we record?

The information we request from you may include personal or sensitive information, such as:

Personal information

  • first name or given name
  • family name or surname
  • address
  • telephone numbers
  • date of birth

Sensitive personal information (Special Category data)

  • ethnicity and marital status
  • religious or other cultural beliefs
  • physical or mental health or condition
  • sexuality

Generally the information we collect would fall into these categories:

Personal Information

Medical History and Diagnosis

Personal Health Information

Relationship history  

Information about family relationships

Information relating to difficult events

Information relating to your aims for therapy

Information of session activity

Information relating to scoring process tools (GAD/PHQ)

What do we use it for?

We may also use some of the information you provide us with for other reasons, such as to:

  • maintain records
  • respond to any enquiries you make
  • account for our decisions and investigate complaints
  • meet our statutory obligations
  • identify and protect those at risk of harm
  • ensure the accuracy of our records
  • prevent and detect crime (CCTV)
  • protect you and other people

Lawful basis under which we process your data

The lawful basis under which we process your data is Consent.  We ask you to explicitly consent to our use of your data, whether personal or special category.

We specifically process your special category data in line with the following two conditions:

We ask you to give explicit consent for specified purposes.

a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

We process your data so that we can manage your psychological needs and how best to work with you to provide the most appropriate therapy.

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

We also process specific information relating to medical professionals identified by you as responsible for your medical care under the lawful basis of Legitimate Interest.

How long do we keep your information for?

By default, if you give us consent to process your information, it is kept during the time you are using our services, and for 6 months after your last therapy session.  After 6 months, your information is securely destroyed shredded and incinerated.

You have a right to request erasure of any information we hold about you at any time.  If you wish to request this, please contact the data controller shown at the bottom of this page.

Information security

We recognise that the information you provide may be sensitive and we will respect your confidentiality. We keep information about you confidential. This means we store it securely and control who has access to it. We will only share information where we are legally required to do so or you are at risk of harm to yourself or others.

Your rights

You have the right to:

  • Be informed why we are collecting your data and what we are doing with it
  • Withdraw your consent to all or some processing of your data
  • Have errors corrected
  • Have your data erased
  • Have your data use restricted
  • Request a copy of specific data via a Subject Access Request (SAR)
  • Request that your data be transferred to another data controller
  • Object to the processing of your data

If you wish to exercise any of your rights, please email us at for further information.

You can find further information about your rights on the ICO website:

Concerns or complaints

If you have any concerns or problems concerning our privacy practices, we will take these issues seriously and work to address them.  Please email us at to bring them to our attention.

We will endeavour to resolve any issues you might have with our privacy practices as swiftly as possible, but you also have the option to contact the Information Commissioners Office (ICO) should you be dissatified with the resolution.

Please see the following link for more information about the ICO complaints procedures:


We record images at our premises for the purposes of crime detection and prevention.

CCTV footage is generally held for a maximum of 30 days.

We will disclose personal information to the police or other statutory law enforcement agencies where they clearly demonstrate that the information will directly assist in the prevention or detection of a specific crime, or in the apprehension or prosecution of an offender.    

Changes to this privacy policy

We may need change the contents of this privacy policy from time to time.  Following any changes, this will be reflected by the review date at the bottom of the policy. 

The pending GDPR legislation on the 25 May 2018 may introduce changes to the existing policy.

Data controller

Nichola Teresa Hall is registered as the data controller for Calm Reflections and is responsible for the collecting and processing of your personal information. Processing includes the organisation, retrieval, consultation, use and deletion or destruction of information and its disclosure to other agencies.

The information you provide will be processed mainly in connection with the administration of our services. A full list of what information we control and process and for what purposes is set out in our notification with the Information Commissioner's Register of Data Controllers. Our registration number is ZA141100. You can view our registration at the Information Commissioner's website.

If you have difficulty understanding this information or want to ask more questions, please contact us.

Contact us

For any information about our privacy practices, please contact us via the email address

Last reviewed date: 19 May 2018.

© Calm Reflections 2023
Bromley, Beckenham, Orpington, south-east London Counsellor