Last Updated: 13 March 2026

As we continue to offer our clients new services (such as mental health and/or neurodiversity screenings and Couples Therapy) we may revise this privacy policy. We will notify you of any significant changes by placing a notice on our website for one month.

1. Your Privacy

Your privacy is very important to us. You can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to us. We adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The term ‘your work with us’ refers to any time you spend with our team members, including receiving Counselling, Psychotherapy, Coaching, Group Therapy, Mindfulness, mental health and/or neurodiversity screenings, or any other service provided by the company.

2. Data Controller

The Green Rooms Counselling, Psychotherapy, Coaching Ltd is the ‘Data Controller’. This means the company is responsible for how your personal data is collected, stored, and protected.

• Company Director: Alison Barr

• Email: alison.barr@thegreenrooms.net

• ICO Registration Number: A8370751

• Company Number: SC704707

3. Why we process your information (Lawful Basis)

The law requires us to have a ‘lawful basis’ for processing your data.

• Contractual Necessity: While we are working together, or if you are enquiring about our services, we process your data to fulfil our contract with you.

• Legitimate Interests: Once our work has ended, we hold your information under ‘legitimate interest’ to maintain clinical records and meet insurance requirements.

• Special Category Data: Because we handle health information (mental health, fertility, neurodiversity, etc.), we process this under the basis of ‘provision of health treatment’ and the performance of a contract with a health professional.

4. Confidentiality and the ‘Circle of Care’

Everything discussed with our team is confidential within our ‘circle of care’. This means your information may be shared internally between your practitioner, the Director, and their respective professional supervisors to ensure clinical quality and safety. Beyond this internal clinical team, your information is kept private unless a confidentiality breach is deemed necessary.

For Couples Therapy:

We operate a ‘no secrets’ policy. Any information shared in individual sessions or via screening forms may be brought into the joint sessions to ensure the work remains effective and transparent. Individual confidentiality will only be granted in exceptional circumstances where disclosure would be unsafe, such as in instances of domestic abuse. If a conflict of information makes it impossible for our team to work with you effectively, the Couples Therapy may have to end.

Limits to Confidentiality:

Confidentiality will only be broken:

• To facilitate a ‘Clinical Will’ in the event of the death or incapacity of your practitioner.

• If it is believed that you, the practitioner, and/or another person are in danger of serious harm.

• Where it is in the public interest or necessary for public protection.

• If required by a court of law or under any other legal obligation.

• Within professional Supervision. Client identity is always protected during these sessions.

• When seeking advice or guidance from, or answering questions from, a professional ethical body, insurance company, or legal advisors.

• When consulting with specialist organisations (for example, those focused on domestic abuse or safeguarding) to ensure the safety and integrity of the work.

• If you wish to raise a concern regarding professional conduct; in such cases, you can refer to the ‘BACP Guide to Making a Complaint’ (or the equivalent guide for your practitioner’s specific ethical body).

5. Data Retention (The 6-Year Rule)

We only keep your information for as long as is necessary. Any non-essential personal data is securely destroyed upon the completion of our work together. However, in accordance with UK GDPR (which allows for data retention when there is a legitimate legal or professional basis), Scots Law regarding prescription and limitation (which generally allows for legal claims to be raised within 5 to 6 years), and the requirements of professional indemnity insurance, we retain your clinical records for 6 years after our work has ended.

This ensures that:

1. We meet our accountability obligations under UK GDPR to maintain accurate records of our clinical processing.

2. We can respond to any clinical or legal enquiries within the statutory timeframes.

3. We comply with the limitation period for potential ‘breach of contract’ claims under Scots Law.

4. We adhere to the ethical framework and audit requirements of your practitioner’s professional body.

After 6 years, these remaining clinical records are securely destroyed.

6. E-commerce and Screenings

When you purchase a mental health and/or neurodiversity screening:

• Financial Data: Payments are processed securely via third parties (such as Stripe or PayPal). The company does not store your credit or debit card details.

• Consent: By purchasing a screening, you give explicit consent for us to process sensitive ‘special category’ data regarding your health.

• Nature of Service: Screenings are clinical tools and do not constitute a formal medical diagnosis.

7. Security and Storage

We take technical and organisational measures to protect your data from loss or unauthorised access, particularly as our contact forms and questionnaires often contain sensitive health and ‘special category’ information.

• Encryption and Web Security: Our website uses SSL (Secure Sockets Layer) encryption to ensure that any information you submit through our contact forms or screening questionnaires is encrypted while in transit.

• Sensitive Data Handling: Information submitted via our website forms is processed by our secure administrative systems and is only accessible to authorised team members within the ‘circle of care’.

• Digital Data: Once received, all digital records are stored on encrypted, password protected systems. This includes the use of reputable third party providers for website hosting, content management, email, and administrative services.

• Physical Data: Any signed forms or paper notes are kept in locked cabinets.

• Team Access: Access to the software and filing systems containing your data is strictly limited to authorised team members who require it to perform their professional duties.

• Third Parties: We do not rent, sell, or exchange your personal information with third parties for marketing purposes.

8. Cookies

We use a browser feature known as a ‘cookie’, which assigns a unique identification to your computer and is typically stored on your computer’s hard drive. Information collected from cookies is used to evaluate and improve the effectiveness of our website and to improve your experience.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc. (‘Google’) which uses cookies to help the website analyse how people use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States of America. Google will use this information for the purpose of evaluating your use of the website and compiling reports on website activity. You may refuse the use of cookies by selecting ‘no’ to the displayed cookies question on our website, or by selecting the appropriate settings on your browser.

9. CCTV Privacy

CCTV may be used at our premises for security. Footage is processed for our legitimate interest in crime prevention.

• Storage: Erased after 30 days unless required for evidence.

• Rights: You may request access to footage of yourself, provided it does not compromise the privacy of others.

10. Your Rights

Under the UK GDPR, you have the following rights:

• Access: You can request a copy of your records in writing. These will be provided within one month free of charge.

• Rectification: You can ask us to correct inaccuracies.

• Erasure: You can request the deletion of your data; however, we may refuse this if we are legally or ethically required to keep it (for example, for the 6-year insurance and legal period).

• Portability: You can request your data be transferred to another service in a machine-readable form.

If you have any questions or wish to exercise these rights, please contact us at alison.barr@thegreenrooms.net. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.