Looking after your information with care.

I am Leanne Marley, trading as Leanne Marley Counselling. I am the data controller for personal information processed in connection with this counselling practice. That means I decide how and why your information is used, and I am responsible for looking after it properly.

Face-to-face counselling is offered at The Chakra Room, Shoemakers Court, 13 Bolton Street, Ramsbottom, Bury, BL0 9FZ. Online counselling is available across the United Kingdom.

As a sole trader processing personal data electronically, I am required to register with the Information Commissioner’s Office (ICO) as a data controller. My ICO registration number will be published on this page once confirmed. You can also ask me for it at any time.

To contact me about privacy, please email me at hello@leannemarleycounselling.co.uk, or write to me at the practice address above. You can also use the contact page.

The information I hold depends on how you are in contact with me.

Website enquiries

When you use the website contact form, I collect the details you choose to share. At present this typically includes your name, email address, optional phone number, preferred way of working (face-to-face, online, or not sure yet), and your message.

You do not need to share anything you are not ready to share. A short message is enough to begin.

Consultation and counselling

If we arrange an initial consultation or begin counselling together, I may also hold:

• Contact and emergency contact details
• Appointment times, attendance and cancellation notes
• Brief clinical records and session notes relevant to our work
• Information you share about your experiences, wellbeing and circumstances
• Payment and invoice records (for example, amounts paid and dates)
• Emails, messages or forms relating to our counselling arrangement

Some of this may be special category data under UK GDPR — for example information about your health, mental health, or aspects of your personal life that you bring to counselling. This kind of information is given extra protection in law.

Booking and scheduling

When booking tools are used (including a scheduling service such as Calendly, once introduced), I may collect your name, email address, phone number if provided, preferred appointment time, and any notes you choose to add when booking. Those tools may also process technical data needed to run the booking page securely.

Website technical data

Like most websites, the hosting platform may process limited technical information needed to deliver the site securely — for example IP address, browser type, and basic request logs. I do not currently use marketing or behavioural advertising tools on this website.

UK GDPR requires a lawful basis for using personal data. For special category (sensitive) data, an additional condition also applies.

Personal data

• Contract — If you are enquiring about, arranging, or receiving counselling with me, I process your information where it is necessary to take steps at your request before a contract, or to perform our counselling agreement (including arranging sessions, communicating with you, and keeping appropriate records).
• Legitimate interests — After counselling has ended, I may retain records for a limited period where this is necessary for professional, legal, insurance and ethical reasons (for example responding to complaints or claims). I balance this carefully against your privacy. I may also rely on legitimate interests for essential website security and hosting.
• Legal obligation — Where I must keep or disclose information to meet a legal requirement.
• Vital interests — In rare situations where processing is necessary to protect someone’s life or safety.

Special category data

Where counselling involves health or other special category information, I typically rely on the condition that processing is necessary for the provision of health or social care / treatment under UK GDPR Article 9(2)(h), together with the relevant provisions of the Data Protection Act 2018, and that it is carried out by a professional subject to a duty of confidentiality. Where appropriate, I may also rely on explicit consent for a specific purpose, or another Article 9 condition (for example vital interests or establishing, exercising or defending legal claims).

You do not have to provide information you are not ready to share. If certain details are needed for us to work safely together (for example a way to contact you), I will explain why.

I use personal information to:

• Respond to enquiries and arrange an initial consultation
• Provide counselling and keep appropriate clinical and administrative records
• Schedule, confirm, rearrange or cancel appointments
• Communicate with you about our work together
• Process payments and keep financial records
• Meet professional, ethical, legal and insurance responsibilities
• Keep the website and related systems secure and working reliably

I do not sell your personal information. I do not use your counselling information for marketing lists or advertising profiles.

I do not use automated decision-making or profiling that produces legal or similarly significant effects about you.

What you share in counselling is treated as confidential. That private space is an important part of feeling able to talk openly.

As part of ethical counselling practice, I discuss my work with a clinical supervisor. Those conversations are confidential. Identifying details about you are not shared unless there is a clear reason connected to your safety or another agreed purpose, and even then only as far as necessary.

There are limits to confidentiality. For example, I may need to share information if I am seriously concerned about your safety or someone else’s safety, or if the law requires disclosure. Wherever possible, I will talk with you first. These boundaries are discussed at the beginning of our work together, and you are welcome to ask questions about them at any point. You can also read more in the frequently asked questions.

I only share personal information where it is necessary for the purposes above, required by law, or needed to protect someone’s safety. Where organisations process information on my behalf, I take care to use reputable providers and appropriate contractual protections (including data processing terms where required).

Services that may process information for me

• Website hosting — This website is hosted on Microsoft Azure Static Web Apps. The host may process technical data needed to serve and protect the site.
• Email and contact-form delivery — Website enquiries are sent using Amazon Simple Email Service (Amazon SES). Enquiry details are processed by an Azure Function on this website’s host and then delivered by SES to my practice mailbox and as a confirmation to you. My day-to-day email inbox remains on Google Workspace; SES is used only to send these transactional messages. Amazon’s privacy information is available on the AWS website.
• Appointment booking (planned) — I intend to use a scheduling tool such as Calendly so you can book consultation or session times. When that is introduced, Calendly (or the chosen provider) will process booking details as a processor on my behalf. Embedded booking tools may also set cookies or similar technologies; if so, this notice will be updated and any consent required under PECR will be obtained before non-essential cookies are set.
• Online video sessions — Online counselling uses a secure video platform. The platform processes the technical data needed to connect the session. Please also take care with your own privacy (for example a private space and headphones if helpful).
• Clinical supervisor — As described above, for ethical practice and client safety.
• Professional advisers, insurers or regulators — Only where necessary (for example indemnity insurers, legal advisers, HMRC for accounting records, the ICO, or BACP in connection with a complaint process).

If in future I introduce a counselling case-management system, this notice will be updated before client records are moved into it, with clear information about the provider and how data is protected.

Some providers (including certain email, hosting or booking services) may store or access personal data outside the United Kingdom. Where that happens, I will take steps required by UK data protection law — for example using a provider that offers an appropriate transfer mechanism such as the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses, and assessing the arrangements as needed.

Calendly, for example, states that invitee booking data may be processed in the United States with contractual safeguards in place. Details for each live provider will be kept under review and reflected here.

I keep information only for as long as it is needed for the purposes set out in this notice, including professional and legal responsibilities. Typical periods are:

• Enquiries that do not proceed — usually deleted or securely destroyed within 12 months of last contact, unless you ask me to delete sooner or there is a clear reason to keep something longer.
• Counselling records — usually kept for 7 years after our work together ends, then securely destroyed. This timeframe reflects common professional and insurance practice for adult counselling records.
• Financial records — retained for the periods required by tax and accounting rules.
• Booking and email correspondence — retained while relevant to our work, then deleted or archived with the related client record according to the periods above.

If you would like me to consider deleting information sooner, please ask. There may be situations where I cannot delete everything immediately (for example where I must keep records for legal or insurance reasons). If that applies, I will explain why.

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure. These include, as appropriate:

• Limiting access to client information to what is needed for the practice
• Using password protection and device security
• Using reputable providers with security and confidentiality commitments
• Keeping paper records (if any) in secure storage
• Taking care when communicating by email about sensitive topics

No method of transmission or storage is completely risk-free. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, I will assess it and, where required, notify the ICO without undue delay (and within 72 hours of becoming aware, where feasible), and inform affected people where the law requires.

Under UK data protection law, you generally have the right to:

• Be informed about how your information is used (this notice)
• Access a copy of the personal information I hold about you
• Have inaccurate information corrected
• Ask for information to be erased in certain circumstances
• Ask me to restrict how I use your information in certain circumstances
• Object to certain types of processing
• Receive certain information in a portable form (where applicable)
• Withdraw consent where I am relying on consent (this does not affect processing already carried out)

Some rights have limits — for example where another lawful basis applies, or where withholding or retaining information is necessary for legal or safeguarding reasons. If I cannot fully meet a request, I will explain why.

To exercise any of these rights, please contact me using the details in this notice. I will respond without undue delay and within one month in most cases (or explain if I need more time, where the law allows). You can read more at ico.org.uk/for-the-public.

If you are concerned about how your personal information has been handled, please contact me first. I take these concerns seriously and will do my best to resolve them.

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

If your concern relates to professional counselling practice more broadly, you may also contact the BACP. Details are available on the BACP website.

This website is published at leannemarleycounselling.co.uk. It is hosted on Azure Static Web Apps.

At present I do not use non-essential analytics or advertising cookies on this site. The hosting platform may use strictly necessary technologies to deliver the site securely and reliably.

When an embedded booking tool (such as Calendly) or other third-party embeds are added, those services may set their own cookies or similar technologies. Before any non-essential cookies are used, this notice will be updated and, where required, consent will be requested.

If you submit the contact form, the information you enter is processed so that your enquiry can reach me. Please only include what you are comfortable sharing in writing.

I may update this privacy notice from time to time — for example when email delivery or Calendly booking goes live, if a case-management system is introduced, or if the law or professional guidance changes. The current version will always be available on this page, with the “last updated” date at the top.

If you have a question about this notice or about your information, please email me at hello@leannemarleycounselling.co.uk, or use the contact page. My hope is that from your first contact, you feel able to ask anything you need to — including about privacy.

Practice: Leanne Marley Counselling
Address: The Chakra Room, Shoemakers Court, 13 Bolton Street, Ramsbottom, Bury, BL0 9FZ
Email: hello@leannemarleycounselling.co.uk