Privacy notice
How your information is looked after
At Core Sanctum, I respect your privacy and am committed to handling your personal information confidentially and securely, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice explains what I collect, why, how I keep it safe and the choices you have.
Who I am
Core Sanctum is an independent counselling practice run by [FULL LEGAL NAME], a sole trader trading as Core Sanctum. I am the data controller for your personal information, which means I decide how it is used and I am responsible for protecting it.
Contact: hello@coresanctum.co.uk
ICO registration number: [ICO REGISTRATION NUMBER]
Information I collect
- Contact details: your name, email address, telephone number and preferred contact times.
- Booking and payment information: appointment dates, attendance, cancellations and payment records. Card details are handled by the payment provider; I do not see or store your full card number.
- Counselling information: brief session notes and anything you choose to share during counselling.
- Sensitive information: counselling may involve information about your physical or mental health, and sometimes about your ethnicity, religion or beliefs, sexual orientation or other personal matters, if you choose to share them. UK law calls this "special category" data and gives it extra protection.
- Emergency or GP contact details: only if you agree to provide them, for use in the circumstances described under the limits of confidentiality.
Please do not send detailed personal or clinical information through the website enquiry form or by email before we have spoken.
How I use your information, and why I am allowed to
UK law requires a lawful basis for each use of your information, and an additional condition for special category information.
| What I use it for | Lawful basis | Condition for special category information |
|---|---|---|
| Responding to enquiries and arranging an introductory call | Taking steps at your request before entering a contract | Not usually needed |
| Providing counselling and keeping session notes | Contract (our counselling agreement) | Health or social care (UK GDPR Article 9(2)(h), Data Protection Act 2018 Schedule 1) |
| Taking payments and keeping financial records | Contract and legal obligation (tax law) | Not applicable |
| Clinical supervision, with no identifying details | Legitimate interests: meeting professional standards and providing a safe service | Health or social care |
| Acting where there is a serious risk of harm | Vital interests, legal obligation or public task, depending on the situation | Vital interests, or safeguarding under Data Protection Act 2018 Schedule 1 |
| Meeting professional, insurance and legal requirements, including complaints | Legal obligation and legitimate interests | Establishing, exercising or defending legal claims (Article 9(2)(f)) |
I do not use your information for marketing, and I do not sell it.
Confidentiality and its limits
What you share in counselling is kept confidential. As part of good professional practice, I discuss my work with a qualified clinical supervisor. I do this without using your name or any details that could identify you.
There are a small number of situations where I may need to share information without your consent:
- where I believe there is a serious risk of harm to you or to someone else
- where there is a concern about the safety of a child or an adult at risk
- where the law requires it, for example a court order, or information relating to terrorism or certain serious crimes
Wherever it is safe and possible, I will discuss this with you first, and I will share only what is necessary. We will go through these limits together before counselling begins.
Who else processes your information
I use a small number of trusted service providers to run the practice. They act on my instructions, under contracts that require them to keep your information secure:
- Practice management (online booking, session notes and client records): WriteUpp
- Payments: Stripe, connected through WriteUpp
- Video sessions: Google Meet (provided by Google)
- Email: [EMAIL PROVIDER]
- Website hosting: Cloudflare
I do not share your information with anyone else unless you ask me to, or one of the situations above applies.
Where your information is stored and how it is protected
Your information is stored electronically in secure, encrypted systems, protected by strong passwords and two-factor authentication. Client records and session notes are kept in WriteUpp. I do not keep session notes in email, on paper or on personal devices. Online sessions take place on a secure video platform, and sessions are never recorded.
Some of my service providers, such as Stripe, Google (for Google Meet) and Cloudflare, may process information outside the UK. Where this happens, it is protected by safeguards recognised under UK law.
How long I keep your information
| Information | How long I keep it |
|---|---|
| Counselling records and session notes | [7] years after counselling ends, then securely deleted |
| Financial and payment records | As long as tax law requires, usually [6] years |
| Enquiries that do not lead to counselling | [6 months], then securely deleted |
If a complaint or legal claim is made, relevant records may be kept until it is resolved.
Your rights
You have the right to:
- ask for a copy of the information I hold about you
- ask me to correct information that is inaccurate or incomplete
- ask me to delete your information, or restrict how I use it
- object to my use of your information
- ask for information you have given me to be transferred to you or another provider, in a commonly used format
Some rights depend on the circumstances. For example, I may need to keep certain records to meet legal or professional obligations. I will explain if that applies. Making a request is free, and I will respond within one month.
This website
If you contact me through the website, I use the details you provide only to respond to your enquiry. The website and the online booking system may use cookies that are needed for them to work, such as keeping the booking process secure. I do not use cookies for advertising.
Contact and complaints
If you have any questions or concerns about your information, please contact me at hello@coresanctum.co.uk. I would welcome the chance to put things right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, or 0303 123 1113.
Changes to this notice
I may update this notice when my practices or legal obligations change.
Last updated: 30 October 2026