Trueform Therapy

Privacy and GDPR Policy

Last updated: 27/10/2026

1. Who I am

This policy explains how I collect, use and protect your personal information when you use my counselling services. I follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the BACP Ethical Framework for the Counselling Professions.

I am Dorottya Nagy, a counsellor working as Trueform Therapy. I am the data controller for your information, which means I decide how it is used and I am responsible for keeping it safe.

  • ICO registration number: ZB983384
  • BACP Register number: 415467
  • Email: dorottyanagy@trueformtherapy.co.uk

I work with adults aged 18 and over.

2. Information I collect

I only collect what I need to provide counselling safely:

  • Contact details: your name, email address, phone number and, if needed, your postal address.
  • Date of birth: to confirm you are 18 or over.
  • GP and emergency contact details: used only in an emergency or if there is a serious safeguarding concern, and wherever possible after talking with you first.
  • Health and personal information: anything you share about your mental and physical health and your history that is relevant to our work. This is “special category” data and is given extra protection.
  • Session records: the date of each session, brief notes, and any risk or safeguarding concerns and the actions taken. My notes use a client code, not your name.
  • Assessment records: the date of your first session and what you were hoping for from counselling, even if we don’t go on to work together.
  • Communications: emails and text messages between us.
  • Agreements: your signed counselling agreement and any updates to it.
  • Payment records: invoices and records of payments.

3. How I use your information

  • to provide counselling and keep appropriate records of our work, as my professional body requires
  • to arrange and confirm sessions and contact you about our work
  • to take payment and keep financial records
  • to act on safeguarding concerns and meet my legal obligations
  • to keep records I may need if a complaint or legal claim is made

I never sell your information or use it for marketing.

4. My lawful bases

The law requires me to have a lawful basis for using your information.

For your personal information in general:

  • Contract: while we work together, I use your information to provide the counselling you have agreed to.
  • Legitimate interests: after our work ends, I keep your records for 7 years to meet professional and insurance requirements and to respond to any questions, requests or complaints.
  • Legal obligation: for example, keeping financial records for HMRC, or sharing information where the law requires it.

For health and other special category information:

  • Health or social care: the information is needed to provide counselling, by a professional bound by a duty of confidentiality (UK GDPR Article 9(2)(h)).
  • Legal claims: keeping records where they may be needed to deal with a complaint or legal claim (Article 9(2)(f)).
  • Vital interests: in an emergency, where someone is at serious risk and cannot give consent (Article 9(2)(c)).

5. How long I keep your information

I keep your records, including notes, emails and your agreement, for 7 years after our last session. This also applies if we only met for an assessment session. After 7 years, everything is securely and permanently deleted.

If a complaint or legal claim is in progress at that point, I may keep the relevant records until it is resolved.

6. Who else may see your information

Your information stays confidential. It is only shared in these situations:

  • Supervision: I discuss my work with a clinical supervisor, as BACP requires. I don’t share your name or anything that would identify you.
  • The law or serious risk: if the law requires it, or if I believe you or someone else is at serious risk of harm. Wherever possible, I will talk with you first.
  • My insurer and legal advisers: only if a complaint or legal claim is made.
  • BACP: only if a complaint about me is made to them.
  • My clinical executor: if I die or become unable to work (see Section 9).

Services I use to run my practice

These companies store or handle some of your information on my behalf, under data protection agreements, and may not use it for their own purposes:

  • Google (Google Workspace): email, file storage, calendar and online booking, and Google Meet for online sessions.
  • IONOS: email at my trueformtherapy.co.uk address.
  • Payment providers: card payments are processed by Stripe, and bank transfers are received into my Mettle business account. They handle your payment details under their own data protection terms. I don’t store card details.

If you came to me through another service

  • Harley Therapy: Harley Therapy is responsible for the information you give on its platform, under its own privacy policy. Online sessions with Harley clients take place on doxy.me. My session notes are my own records and are covered by this policy.
  • YCS (Your Counselling Service): if you were referred through YCS, YCS’s own privacy policy also applies to the information it holds.

Some of these providers may process data outside the UK. Where they do, they use legally approved safeguards.

7. Artificial intelligence (AI)

I don’t use AI tools with any of your information. I don’t record sessions, and I don’t use any automated decision-making.

8. Keeping your information secure

  • My notes and client records are kept in password-encrypted files on an encrypted, password-protected laptop, with an encrypted backup in my Google account.
  • My notes use client codes instead of names. The list linking codes to names is kept separately, in its own encrypted file.
  • My Google account is protected by two-step verification.
  • I don’t keep paper records.
  • Online sessions are encrypted and never recorded.

9. If I die or become unable to work

As BACP requires, I have a clinical will. It names a qualified counsellor as my clinical executor, who is bound by confidentiality.

If I die or become seriously ill and unable to work, my executor will:

  • contact you, using the contact method we agreed, to let you know what has happened and where you can find support
  • become the data controller for my client records, so they continue to be looked after in line with data protection law. Their lawful basis will be legitimate interests or legal obligation
  • keep your records securely for 7 years after your last session, then delete them

Your notes will be kept sealed and will not be read unless you ask for a copy, a complaint or legal claim requires it, or you choose to continue therapy with my executor and agree to them reading your notes.

If you are a Harley Therapy client, Harley Therapy will also be told so it can contact you through its platform.

10. Your rights

You have the right to:

  • access the information I hold about you (a “subject access request”)
  • ask me to correct anything that is inaccurate or incomplete
  • ask me to delete your information. I may need to keep some records for the 7-year period, and if so I will explain why
  • ask me to restrict how I use your information
  • object to how I use your information, where I rely on legitimate interests
  • ask for your information in a format you can take elsewhere, where this applies

To use any of these rights, email me. It is free, and I will respond within one month.

11. Complaints

If you are unhappy with how I have handled your information, please email me at dorottyanagy@trueformtherapy.co.uk. I will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

If you are not satisfied with my response, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

12. Cookies

This website may use cookies to improve your experience and to understand how the site is used. You can turn off cookies in your browser settings, although some parts of the site may not work as well.

13. Links to other websites

This website may link to other websites. I am not responsible for their content or how they handle your information.

14. Changes to this policy

I may update this policy from time to time. The current version is always on this page, with the date it was last updated at the top.

15. Contact

If you have any questions about this policy or your information, please email me at dorottyanagy@trueformtherapy.co.uk.