Privacy Notice

Mark Mahoney Counselling

This privacy notice explains what personal information I collect, why, how I look after it, and what rights you have, whether you’re simply making an enquiry or already a client. It applies from your first point of contact through to after therapy has ended.

I adhere to current data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR).

I am registered with the Information Commissioner’s Office (ICO), registration number ZB284773.

If you have any questions about this notice, email me at markmahoneytherapy@gmail.com.

I also adhere to the ethical guidelines on client privacy and confidentiality set by the British Association for Counselling and Psychotherapy (BACP).

​

Who is the data controller?

​

The “data controller” is the person or organisation that collects, stores, and is responsible for your personal data. In this case, that’s me:

Mark Mahoney, trading as Mark Mahoney Counselling 160 Ravensbourne Avenue, Shortlands, Bromley, BR2 0AY Phone: 07903 722341 Email: markmahoneytherapy@gmail.com

​

What personal information do I collect?

​

Personal information is anything that can identify you — such as your name, address, phone number, or email address.

I may also collect special category data under Article 9 of the UK GDPR — information that’s more sensitive and requires higher protection, such as details about your mental health, presenting issues, session notes, risk assessments, and GP details.

​

Why do I process your information, and what’s my legal basis?

​

• Article 6(1)(b) — Contractual necessity: to assess whether I can offer you therapy, and to deliver counselling services once we’ve agreed to work together.

• Article 6(1)(a) — Consent: for non-essential communications, such as appointment reminders by email.

• Article 6(1)(c) — Legal obligation: where disclosure is required by law, such as a court order or safeguarding duty.

• Article 9(2)(a) — Explicit consent: for processing special category (health/mental health) data — by proceeding with therapy, you provide explicit consent for clinical notes to be created and held.

• Article 9(2)(h) — Health or social care provision: for delivering health or care treatment under the management of a health professional.

I will never use your personal data for anything beyond the administration of the therapy I provide — arranging, confirming, and rescheduling appointments, and delivering safe, effective counselling.

​

How I collect and use your information

​

Initial contact. When you enquire about counselling, I’ll collect your name and a contact method (email or phone) so I can respond and arrange an appointment. Your GP or another health professional may also send me your details when making a referral, or a trusted individual may give me your details when making an enquiry on your behalf. If you decide not to proceed, I’ll delete this information within 3 months, sooner, if you ask me to.

​

During therapy. At your first session, I’ll ask you to complete a personal details form (name, address, date of birth, contact details, and your GP’s details). I won’t routinely contact your GP, your attendance is confidential — but I may need to where it’s clinically necessary, and I’ll discuss this with you first wherever possible.

​

Everything discussed in session is confidential. Confidentiality is only broken where there’s a legal or ethical obligation to disclose — for example, disclosure of abuse or neglect of a child or vulnerable adult, indication of serious harm to yourself or others, or where a court of law requires it. Where possible, I’ll always discuss this with you before breaking confidentiality.

I attend regular clinical supervision, as required by BACP. My supervisor never receives identifying information about you.

I keep brief clinical notes to support our work together. These are for my use only, stored electronically on a secure, password-protected system accessible only by me.

​

After therapy ends. I retain records for a minimum of seven (7) years following the end of the therapeutic relationship, in line with BACP guidance and my professional indemnity insurance requirements. Financial records are retained for six (6) years in line with HMRC obligations. I may need to retain information for longer in some circumstances — for example, to defend a professional complaint.

​​

How I store your information

​

Your information is stored electronically on password- and/or biometrically-protected devices, in files that are further password protected and accessible only by me. Where cloud-based tools (including email) are used to process personal data, appropriate safeguards — such as Standard Contractual Clauses adopted by the relevant provider — are relied upon for any transfer of data outside the UK.

Any paper notes use your initial only. Digital copies of any paperwork you complete are stored securely; original paper copies are shredded.

​

Who else sees your information?

​

Your information is not shared with anyone else within my practice — I run it independently as a sole trader — and I will never share it with a third party unless:

•             you’ve explicitly asked me to, to help you access support or healthcare;

•             it’s needed for anonymised clinical supervision;

•             there’s a safeguarding concern, court order, or risk to life; or

•             it’s needed by my professional indemnity insurers or legal advisors to defend a professional complaint (handled confidentially).

​

Website visitors and cookies

​

Details of how this website uses cookies and analytics (including Google Analytics) are set out in my separate Cookie Policy.

​

Your data protection rights

You have the right to:

•             Access a copy of the personal data I hold about you (a Subject Access Request).

•             Rectification of inaccurate data.

•             Erasure (“right to be forgotten”), subject to my legal retention obligations.

•             Restriction of processing while a concern is investigated.

•             Object to processing based on legitimate interests.

•             Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of earlier processing.

To exercise any of these rights, write to me at the address above or by email. I’ll respond within one calendar month.

​

Raising a concern or making a complaint

​

If you have any concerns about your sessions or my conduct as a counsellor, please raise this with me directly in the first instance. If we’re unable to resolve the matter, you may contact BACP’s Professional Conduct department (bacp.co.uk).

If you have a concern about how your personal data has been handled, you can also raise this with me directly. I will acknowledge any such complaint within 30 days and respond without undue delay.

Raising a concern with me doesn’t affect your right to complain to the Information Commissioner’s Office (ICO) at any time: ico.org.uk | 0303 123 1113.

​

Mark Mahoney is a BACP Accredited Counsellor/Psychotherapist (Reg. 390753), offering in-person counselling in Bromley, Forest Hill, and Peckham, and online counselling across the UK.

​

​

​

​