data protection & privacy policy

This privacy policy explains how your personal data is collected, used, and stored in accordance with the UK General Data Protection Regulation (GDPR), as well as the ethical standards set by my professional body. Your privacy is taken seriously, and all information you share is handled with care, transparency, and respect. 

1. Who I Am 

I am a registered practitioner offering counselling and coaching services. I am the data controller for the personal information you provide and am responsible for how it is used and stored. 

Contact:
Name: Maria Castano 

Practice Name: Maria Castano Therapy  
Email Address: mariacastanotherapy@gmail.com

2. What Personal Data I Collect 

I may collect and store the following information: 

• Your name, contact details (email, phone), and emergency contact information 
• Information shared in the contact form (e.g. type of service you are interested in, reasons for seeking support) 
• Notes from sessions, where relevant  
• Email correspondence and appointment history 
• Payment and invoicing information (where applicable) 

3. Why I Collect This Data 

Your data is collected for the following lawful and ethical purposes: 

• To arrange and provide counselling or coaching services 
• To communicate with you about appointments and relevant information 
• To maintain records in accordance with legal, financial, and professional requirements 
• For safeguarding purposes, if necessary 

The lawful basis for processing this data under GDPR may include: 

• Contractual necessity (to deliver a service) 
• Legal obligation (e.g. tax records) 
• Vital interests (e.g. risk of harm) 
• Legitimate interest (e.g. to manage the therapeutic relationship) 
• Consent, where required (e.g. for initial contact or storing sensitive data) 

4. How Your Data Is Stored 

Your data is securely stored using password-protected and encrypted systems. Any written notes are stored in locked filing systems. Access to your data is restricted to me and is only shared in limited, lawful situations (see section 6). 

I retain your data in accordance with professional guidelines — typically for 7 years after the end of our work together — after which it is safely destroyed. 

5. Confidentiality 

All sessions are confidential, in line with professional ethical standards. However, there are rare exceptions where I may need to share information: 

• If there is a serious risk of harm to you or someone else 
• If there is a safeguarding concern involving a child or vulnerable adult 
• If required by law (e.g. a court order or disclosure of certain criminal activity) 

Wherever possible, I will discuss this with you first and explain the steps being taken. 

6. Sharing Your Data 

I do not share your personal data with third parties for marketing or commercial purposes. Your data may be shared only in the following situations: 

• With my professional supervisor (anonymised and bound by confidentiality) 
• With legal or emergency services if required by law or for safety reasons 

7. Your Rights 

Under GDPR, you have the right to: 

• Access the personal data I hold about you 
• Request correction of inaccurate information 
• Request deletion of your data (under certain conditions) 
• Object to or restrict certain types of processing 
• Withdraw your consent at any time (where consent is the legal basis) 
• Lodge a complaint with the Information Commissioner’s Office (ICO) 

You can learn more or file a complaint via the ICO website: https://www.ico.org.uk 

8. Website and Online Communication 

If you contact me through the website, the information you submit (e.g. contact forms or emails) will be processed to respond to your enquiry. My website may use basic cookies or analytics tools — no sensitive data is collected this way. 

If you use online platforms (e.g. video sessions), I use secure, encrypted services and will discuss this with you in advance. 

9. Updates to This Policy 

This privacy policy may be updated occasionally to reflect changes in legal or professional requirements. The latest version will always be available on my website or upon request. 

If you have any questions or concerns about how your data is handled, please feel free to get in touch.