Data Retention Policy
Alba Counselling & Psychotherapy
Data Controller: Cinzia Procter
Last updated: 09 August 2026
Legal Entity: Alba Counselling and Psychotherapy is a trading name of Cinzia Procter Counselling and Psychotherapy Ltd; a company registered in England and Wales (Company Number 16965125). All counselling and psychotherapy services are provided by Cinzia Procter Counselling and Psychotherapy Ltd.
1. Why We Retain Your Data
As a counsellor and psychotherapist in private practice, I keep records of our work together for several important reasons:
•Legal obligations — The law requires me to keep certain records for specific periods, including financial records for tax purposes
•Professional standards — I maintain records in accordance with the professional standards expected of therapists in private practice and the ethical framework of BACP
•Insurance requirements — My professional indemnity insurance requires me to retain records in case a claim is made after therapy ends
•Continuity of care — If you return to therapy, having access to previous records helps me provide appropriate support
•Your protection and mine — Records may be needed if questions arise about the therapy we undertook together
2. Retention Periods
TYPE OF RECORD HOW LONG I KEEP IT REASON
Client therapy records (adults). 7 years after our last session To meet professional, legal and professional indemnity
insurance requirements and to
enable the establishment,
exercise or defence
of legal claims where necessary.
Enquiry and contact data. 12 months from last contact. To respond to your enquiry and
(non-clients) follow up if appropriate
Financial records and invoices 6 years Required by HMRC for tax purposes
Insurance records 7 years To evidence coverage in case of a claim
Website contact form submissions 12 months Unless you become a client, in which case the therapy records
retention period applies
Contracts and consent forms Same as therapy records These form part of your client file
3. What Records I Keep
The records I maintain may include:
•Contact details — your name, address, telephone number, and email address
•Session notes — brief written records of our sessions, including themes discussed and any agreed actions
•Assessment information — initial assessment notes and any questionnaires you complete
•Correspondence — emails, letters, and messages between us
•Consent forms — your signed therapy agreement and consent documentation
•Financial records — invoices, payment records, and receipts
•Referral information — details of how you came to therapy, including any referral from an Employee Assistance Programme where applicable
4. How Your Data Is Stored
I take the security of your information seriously and use the following safeguards:
Electronic records:
•Stored on encrypted, password-protected devices
•Access restricted to me only
•Regular backups maintained securely
Paper records:
•Kept in a passcode protected file in a locked filing cabinet
•Located in a secure room with restricted access
•Access limited to me only
Who has access to your information:
•Me (Cinzia Procter) — I have full access to your records
•My clinical supervisor — I discuss my clinical work in supervision to maintain professional standards, but I share only anonymised case material with my supervisor, meaning no information that could identify you is disclosed
•EAP or referral platform — If you were referred through an Employee Assistance Programme, limited information may be shared as part of the commissioning arrangement. This is explained to you at the start of therapy
•My Clinical Will Executors. Only in the case that I am unable to carry out therapy due to incapacitation through serious illness, injury or death. My Clinical Will Executors are Laura Odom (email: Lauraodomtherapy@gmail.com) and Kate Pegg (email: hello@katepeggcounselling.co.uk).
5. Your Right to Erasure
Under UK GDPR, you have the right to request that I delete your personal data. However, this right is not absolute. I may need to retain your records where:
•Retention is necessary to comply with legal obligations
•Records are needed for the establishment, exercise, or defence of legal claims
•Professional standards or insurance requirements apply.
If you request erasure and I am unable to comply fully, I will always explain my reasons clearly and in plain language. Where possible, I will delete any data that is not subject to these restrictions.
6. Secure Disposal of Records
When the retention period ends, I dispose of your records securely:
•Paper records — shredded using a cross-cut shredder
•Electronic records — securely and permanently deleted from the systems on which they are held.
7. Clinical Will Arrangements
I have a clinical will in place to ensure your records are handled appropriately in the unlikely event I become unable to continue practising (for example, due to serious illness or death). If I am unable to practice, and only in this event, access to your information will be strictly limited to what is necessary to implement my Clinical Will, manage client contact and ensure that records are handled appropriately by my colleagues in Arbour Counselling.
My Clinical Will Executors are Laura Odom (email: Lauraodomtherapy@gmail.com) and Kate Pegg (email: hello@katepeggcounselling.co.uk). They will use these details to contact you only to inform you that I am unable to continue therapy with you. My colleagues are both members of the BACP and as such work within the BACP ethical framework, which includes confidentiality.
8. Questions, Concerns or Data Protection Complaints
If you have any questions about how long I keep your personal information, or if you wish to exercise any of your data protection rights, please contact me at:
Email: info@albacounselling.org
If you have a concern or complaint about how I have collected, used, stored, shared or otherwise handled your personal information, please contact me in the first instance so that I have the opportunity to investigate and resolve the matter. I will acknowledge receipt of a data protection complaint within 30 days. I will take appropriate steps to investigate the complaint without undue delay, keep you informed where appropriate, and let you know the outcome of my investigation. If you remain dissatisfied following my response, you have the right to raise your concern with the Information Commissioner’s Office (ICO). This policy is reviewed annually and will also be updated where there are relevant changes to legislation, professional requirements or my data retention practices.