Privacy Notice

Last updated: 2 October 2026

Who is responsible for your information?

I am Darren Boyce-Smith, trading as DBS Therapy. I am the data controller, which means I am responsible for deciding how your personal information is used.

Email: Darrenislistening@gmail.com
Phone: 07303 123235

I handle personal information in accordance with the UK GDPR and the Data Protection Act 2018, alongside my professional confidentiality responsibilities.

What information I collect

Depending on your enquiry and our work together, I may collect:

Your name, date of birth, address and contact details.
Your communication preferences.
Your GP surgery and emergency-contact details.
Information you share about your circumstances, health and reasons for seeking counselling.
Brief, relevant counselling notes.
Registration forms, counselling agreements and consent records.
Appointment details, correspondence, invoices and payment records.

Counselling information may include sensitive personal information, such as information about your physical or mental health, beliefs or sexuality.

Most information comes directly from you. Where relevant, information may also come from someone referring you or another professional involved in your care.

If you provide emergency-contact details, please let that person know you have given me their information and make this notice available to them.

Why I use your information

I use information to respond to enquiries, provide counselling, maintain appropriate records, arrange appointments, communicate with you, manage payments and address relevant safety concerns.

I collect only information that is relevant to these purposes. I do not sell, rent or trade your personal information.

My lawful bases

For information necessary to arrange and provide the counselling service you request, I rely on performance of a contract, including steps taken at your request before entering into that contract.

Where necessary to meet statutory obligations, such as keeping required tax records, I rely on legal obligation. Where appropriate, I rely on legitimate interests for proportionate practice administration, record retention and handling complaints or legal claims. These interests must be balanced against your rights and privacy.

For health and other sensitive personal information necessary to provide counselling, I rely on the health or social care condition in Article 9(2)(h) of the UK GDPR, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. I use this information only where necessary to provide counselling and maintain appropriate clinical records. I am subject to a duty of confidentiality and protect your information in accordance with that duty and the BACP Ethical Framework. This is separate from your agreement to take part in counselling.

How information is stored and processed

I use WriteUpp for client records, forms, agreements, appointments, appointment communications and online video sessions. Stripe processes online payments and relevant transaction information. Email communications are also processed through my email provider. These services process information needed to perform their functions. Stripe’s handling of payment information is explained in its privacy policy: https://stripe.com/gb/privacy.

Electronic records are protected by access controls. Paper records are kept in locked storage. I take reasonable steps to protect information, although email and other internet communications cannot be guaranteed completely secure.

Processing outside the UK

Some of the services I use store or process personal information outside the UK.

WriteUpp: Client records are hosted in the European Union. WriteUpp identifies Ireland and the Netherlands as hosting locations, and its terms also allow processing by service providers in the United States. Transfers to Ireland and the Netherlands are covered by UK adequacy regulations, which recognise their data protection standards. WriteUpp’s terms require other transfers to use a valid legal transfer mechanism.

Stripe: Online payment information may be processed internationally, including in the United States and India. Stripe uses recognised adequacy arrangements where applicable, including the UK Extension to the EU–US Data Privacy Framework for eligible US transfers, or Standard Contractual Clauses with the UK International Data Transfer Addendum.

Google/Gmail: Email information may be processed on Google’s servers outside the UK, including in the United States. Google uses adequacy arrangements, including the UK Extension to the EU–US Data Privacy Framework, and Standard Contractual Clauses where required.

Further information is available from:

You can contact me for further information about the arrangements relevant to your information or to request a copy of the applicable contractual safeguards. Google and Stripe also explain how to request these through the links above.

Confidentiality and sharing information

What you share in counselling is treated as confidential. I may discuss our work in professional supervision to support safe and ethical practice. I minimise identifying information, and supervision is subject to confidentiality arrangements. Information may also be shared with your agreement, where required by law, or where a lawful and necessary disclosure is needed to address a serious safety concern. This might involve your GP, emergency contact, emergency services or another relevant professional. Where possible and appropriate, I will discuss a disclosure with you first. I share only information relevant to its purpose.

How long I keep information

My usual policy is to retain counselling records for seven years after our work together ends. Records are reviewed and securely deleted or destroyed when no longer needed.

A different period may apply where there is a specific legal requirement, an unresolved complaint or legal claim, or a justified need concerning a child or young person’s records.

Financial records are retained for the applicable statutory period. Enquiries that do not lead to counselling are kept only as long as reasonably needed to deal with the enquiry.

Professional development

I may retain separate anonymised learning reflections for professional development. These exclude information that could reasonably identify you.

Your rights

Depending on the information and the lawful basis used, you may have the right to:

Access your personal information.
Have inaccurate information corrected.
Request deletion.
Restrict how information is used.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.

Withdrawal of consent does not affect processing that was lawful before withdrawal. You also have the right to object to processing based on legitimate interests. Some rights are subject to legal limits. If I cannot fulfil a request, I will explain why. Please contact me using the details above to make a request or change your communication preferences.

Questions or complaints

Please contact me if you have questions or concerns about how I handle your information.

You also have the right to complain to the Information Commissioner’s Office:

https://ico.org.uk/make-a-complaint/