Privacy & Terms

1. Who I am

I am Bianca Borrello, a counsellor registered with the British Association for Counselling and Psychotherapy (BACP membership 414153), trading as B. Borrello Therapy in Wilmslow, Cheshire. I work with adults, teenagers and families, both in person and online.

For data protection purposes I am the data controller for the information described in this policy. That means I decide what is collected and why, and I am responsible for looking after it.

Email

hello@bborrellotherapy.com

Phone

07931 907218

Area

Wilmslow, Cheshire and South Manchester, plus online

2. What I collect

This depends entirely on how you interact with me. Browsing the website involves far less than becoming a client.

If you only visit the website

• Enquiry details. If you use the contact form, I receive your name, email address, phone number if you provide one, and your message.
• Technical and usage data. Your IP address, browser and device type, the pages you visited and where you arrived from. This is collected through the analytics tools listed in section 10.

If you become a client

Before sessions begin I ask you to complete an onboarding form. Through it I collect:

• Your full name and date of birth
• Your home address, phone number and email address
• An emergency contact name and number
• Your GP or medical practitioner, if you choose to share it. This is optional.
• Your agreement to my Terms & Conditions, and, where the client is a child under 16, a parent or carer's consent to treatment
• An image of your signature, drawn on screen, together with the date and time you signed, the version of the document you agreed to, and the IP address you submitted from. This is what makes the signed document meaningful as a record.

Where the client is a child under 16, I collect the child's name and date of birth, and the parent or carer's full contact details. The parent or carer signs on the child's behalf.

During our work together

• Session notes. Brief working notes recording themes, progress and anything relevant to your safety. These are kept to the minimum needed to do the work well.
• Appointment and payment records. Dates of sessions and whether they were paid, cancelled or missed.
• Correspondence. Emails and texts between us about scheduling or administration.

I do not ask for, and do not want, more detail than is necessary. If you send me something I do not need, I will usually delete it.

3. Health data and my lawful basis

Information about your mental health is special category data under the UK GDPR. It carries stronger protection than ordinary personal information, and I need a lawful basis under both Article 6 and Article 9 to hold it at all.

Because the therapy record rests on Article 9(2)(h) rather than consent, withdrawing consent does not by itself require me to delete it. I explain what that means in practice in section 9.

4. How I use your information

• To respond to your enquiry and arrange an initial conversation
• To provide counselling, and to plan and reflect on our work together
• To keep you safe, and to act where I have a serious concern
• To take payment and keep proper financial records
• To send you your signed paperwork and appointment arrangements
• To meet my professional obligations as a BACP-registered counsellor, including clinical supervision
• To comply with the law, including tax and accounting requirements

I will never sell your information, share it with advertisers, or use your therapy record for marketing. I do not use automated decision-making or profiling.

Like all registered counsellors, I discuss my work in clinical supervision. This is a professional requirement and it improves the quality of your care. In supervision I anonymise what I can, and my supervisor is bound by the same duty of confidentiality.

5. How long I keep it

I keep records for as long as I have a professional or legal reason to, and no longer.

The longer period for children reflects that a young person may want access to their own records, or may need them, once they reach adulthood. When a retention period ends, records are deleted securely.

6. Where it is stored, and who else can see it

I use a small number of trusted services to run the practice. Each one only receives what it needs, and each is bound by contract to protect it. These are my processors: they act on my instructions and cannot use your information for their own purposes.

Beyond those services, the only people who may see your information are my clinical supervisor, as described in section 4, and anyone I am required to share with under section 7. Paper notes, where I keep any, are stored locked and separately from your contact details.

7. Confidentiality, and its limits

What you bring to sessions is confidential. This is the foundation of the work and I take it seriously. There are a small number of situations where I may need to share information without your agreement, and I would rather you knew about them now than discovered them later.

• Where there is a serious risk of harm to you
• Where there is a serious risk of harm to someone else
• Where a child or vulnerable adult may be at risk
• Where I am required to by a court order or by law, including certain terrorism and money laundering duties

Wherever it is safe and possible, I will talk to you first and explain what I need to do and why. I would share only what is necessary, and only with the person or organisation that needs it. These limits are the same ones set out in the Terms & Conditions you sign before we begin.

8. Children and young people

I work with children and teenagers, and their information deserves particular care.

• Under 16. A parent or carer completes the onboarding form and signs the consent to treatment. They are my main contact and, in practice, the emergency contact too.
• 16 and over. A young person can usually complete the form and consent for themselves.
• The young person still has their own rights. A child's information belongs to the child. As they grow in understanding, they can exercise their own data protection rights, and at that point they may do so instead of their parent.
• Sessions remain confidential. Being the parent who arranged and paid for therapy does not give an automatic right to know what was discussed. I will agree with both of you at the start what will and will not be shared, subject always to the safety limits in section 7.

9. Your rights

Under the UK GDPR you have the right to:

• Be informed about what I do with your information, which is what this policy is for
• Access a copy of the information I hold about you
• Rectification, meaning correction of anything inaccurate
• Erasure of your information in certain circumstances
• Restrict how I use your information while a concern is resolved
• Object to processing based on legitimate interests
• Data portability, meaning a copy in a transferable format
• Withdraw consent at any time, where I relied on consent

To exercise any of these, email hello@bborrellotherapy.com. It is free, and I will respond within one month. I may need to confirm your identity first, so that I am not disclosing your records to someone else.

Two honest limits. These rights are not absolute. I may not be able to delete a therapy record while I still have a professional or legal obligation to keep it, as described in section 5. And if your record contains information about another person, or if releasing it would risk serious harm, I may need to withhold part of it. If I ever refuse a request, I will tell you why and explain how to challenge it.

10. Cookies and tracking

A cookie is a small file a website stores on your device. This site uses cookies that are strictly necessary for it to work, and analytics tools that help me understand which pages people find useful.

The analytics tools currently in use include Google Analytics and Google Tag Manager. These set cookies and may collect your IP address and browsing behaviour on this site.

11. Security

• Signed documents are stored encrypted, in a private location that is not reachable from the public internet
• The whole website is served over HTTPS, so anything you submit is encrypted in transit
• Access to systems holding client information is protected by strong, unique passwords and two-factor authentication where available
• Only I have routine access to client records
• Any paper notes are kept locked, and separately from your contact details

No system is completely secure, and I will not pretend otherwise. If a breach ever occurred that was likely to put your rights at risk, I would report it to the Information Commissioner's Office within 72 hours and tell you without undue delay.

12. Changes to this policy

I will update this page when what I do with your information changes. The date at the top always shows the current version. If a change materially affects how I handle your records, I will contact current clients directly rather than relying on you to notice.