PRIVACY NOTICE

Privacy Notice and Data Protection Complaints Process

Practice ND / Olena Baeva
Website: www.practice-nd.co.uk
Last updated: 17 June 2026
Effective from: 19 June 2026

This privacy notice explains how I collect, use, store and protect personal information in my therapy, supervision and consultancy practice.

I am Olena Baeva, a therapist/counsellor working primarily online with neurodivergent individuals, couples and relationships. I am the data controller for personal information I collect through Practice ND.

This means I am responsible for deciding how personal information is used and for keeping it safe.

Therapy, supervision and relationship work can involve personal, sensitive and sometimes clinically significant information. I aim to handle that information with care, clarity, confidentiality and respect.

This privacy notice applies to:

people who contact me about therapy, supervision, consultancy or training;
current and former clients;
supervisees and professional contacts;
visitors to this website.

This page also explains how you can raise a data protection concern or complaint if you are worried about how your personal information has been handled.

1. Contact details

Olena Baeva / Practice ND
Website: www.practice-nd.co.uk
General email: Olena@Practice-ND.co.uk
Data protection complaints email: Olena@Practice-ND.co.uk

I am registered with the Information Commissioner’s Office where required.

ICO registration number: ZA766482

2. Website information is not therapy or emergency support

The information on this website is provided for general information and psychoeducation. It is not a substitute for therapy, medical advice, diagnosis, legal advice, crisis support or emergency help.

If you are at immediate risk, feel unable to keep yourself safe, or are concerned that someone else may be at immediate risk, please contact emergency services, NHS 111, your GP, your local crisis team, or another appropriate urgent support service.

3. What personal information I collect

The information I collect depends on how you interact with me.

When you visit this website

Some technical information may be collected automatically, such as:

IP address;
browser type and version;
device information;
operating system;
approximate location derived from technical data;
pages visited;
date and time of visit;
referral source;
cookie preferences;
website usage information.

This helps the website function, supports security, and helps me understand whether the site is working properly.

When you contact me

If you contact me through the website, email, phone or another route, I may collect:

your name;

email address;
phone number, if provided;
the information you choose to share in your enquiry;
any preferences around contact, availability or therapy format;
brief information about what kind of support you are looking for.

Please keep initial enquiries brief. Contact forms and ordinary email are useful for arranging contact, but they are not the safest place to send detailed clinical, medical, sexual, safeguarding, trauma or third-party information.

If we arrange an initial call or begin working together

I may also collect and hold information such as:

your address or location, where needed for safety, jurisdiction, invoicing or professional reasons;
date of birth, if clinically or administratively needed;
GP details, where relevant;
emergency contact details, where appropriate;
appointment history;
payment and invoicing records;
therapy, supervision or consultancy agreements;
consent forms or working agreements;
correspondence between us;
brief clinical, supervision or consultation notes;
relevant health, mental health or wellbeing information;
information about neurodivergence, disability, sensory needs, communication preferences or reasonable adjustments;
information about personal history, relationships, family, work, identity, culture, sexuality, faith, trauma, risk, safeguarding or other life circumstances where relevant to the work.

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy or supervision.

I only collect information that is necessary for providing therapy, supervision or consultancy safely, ethically and professionally.

4. Couples, relationship and family work

In couples, relationship or family work, I may receive information about more than one person. This may include information shared by one person about another person.

I will explain the confidentiality framework for the work in the relevant therapy agreement. Relationship work often needs clear boundaries around what can and cannot be kept private between participants.

If you are attending therapy with another person, the therapy agreement should be read alongside this privacy notice.

5. Information about other people

Sometimes you may give me information about another person, such as a partner, family member, child, GP, emergency contact or other professional.

I only use this information where it is relevant to the work, administration, safety, legal duties, safeguarding or professional responsibilities.

6. How I use your information

I use your personal information to:

respond to enquiries;
arrange initial calls and appointments;
assess whether I may be able to offer a suitable service;
provide therapy, supervision, consultation or related professional services;
keep appropriate clinical, supervision and administrative records;
communicate with you about sessions, fees, cancellations or service matters;
manage payments, invoices, accounting and tax records;
maintain confidentiality, safety and professional standards;
seek clinical supervision or professional consultation;
meet legal, tax, safeguarding, professional, regulatory, insurance or court-related obligations;
respond to information rights requests;
respond to data protection concerns or complaints;
manage website security and functionality;
understand general website use and improve the website;
protect my legal rights or respond to claims.

I do not sell your personal information.

7. Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information.

For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR.

These may include:

Contract — where information is needed to arrange or provide therapy, supervision, consultation or related services.
Legitimate interests — where I need to use information to run my practice safely, respond to enquiries, keep appropriate records, maintain security, communicate about services, and protect both you and me.
Legal obligation — where I need to keep or share information to comply with the law, tax rules, accounting duties, safeguarding duties, court orders or other legal requirements.
Vital interests — where information is needed to protect someone’s life or immediate safety.
Consent — where I specifically ask for consent for something, such as a particular type of communication, sharing information in a specific way, or optional use of information.

Consent is not the only lawful basis available under data protection law. I will only rely on consent where it is appropriate to do so.

8. Special category data

Therapy and supervision may involve special category data, including information about:

physical or mental health;
disability;
neurodivergence;
sex life or sexual orientation;
racial or ethnic origin;
religious or philosophical beliefs;
trauma, risk or safeguarding matters;
family and relationship circumstances.

Where I process special category data, I need both:

a lawful basis under Article 6 UK GDPR; and
a separate condition under Article 9 UK GDPR.

The most relevant Article 9 condition is usually that processing is necessary for the provision of health, social care, counselling, therapy, supervision or related professional services by a professional subject to confidentiality.

In some situations, I may also rely on conditions relating to explicit consent, vital interests, legal claims, safeguarding, substantial public interest or legal obligations.

9. Criminal offence data

In rare circumstances, therapy or supervision may involve information about alleged offences, criminal proceedings, safeguarding, risk or legal matters.

Criminal offence data has additional protection under UK data protection law. I will only process this information where there is a lawful basis and it is necessary, proportionate and relevant to the work, safety, legal obligations or professional responsibilities.

10. Confidentiality

Therapy is confidential, but confidentiality is not absolute.

I will not share what you tell me unless there is a lawful, ethical, professional or safeguarding reason to do so. Where information needs to be shared, I aim to limit this to the minimum information necessary.

There are some limits to confidentiality. I may need to share information if:

I believe there is a serious risk of harm to you or someone else;
there is a safeguarding concern involving a child, vulnerable adult or person at risk;
I am required to do so by law, court order or legal process;
disclosure is necessary to prevent or detect a serious crime;
there is a medical emergency and information is needed to protect life;
information is needed for legal advice, insurance, complaints, audit or professional defence;
I need to consult my clinical supervisor, while protecting your identity as far as possible.

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

11. Supervision

Like other ethical therapists, I use clinical supervision to support safe and effective practice.

In supervision, I may discuss aspects of client work to support safe and ethical practice. I aim to minimise identifying detail where possible and appropriate. My supervisor is also bound by confidentiality and professional standards.

If identifying information ever needs to be discussed, this will only be where there is a clear professional, ethical, legal or safety reason.

12. Clinical notes and records

I keep brief clinical notes to support safe and ethical therapy.

Clinical records may include:

session dates;
brief themes discussed;
relevant risk, safeguarding or clinical information;
agreed actions or important decisions;
contact and administrative information;
correspondence relevant to the work;
information needed for continuity, safety, professional accountability or legal reasons.

I do not aim to keep a full transcript of sessions.

Clinical notes are kept factual, proportionate and relevant to the work.

13. How long I keep information

I keep information only for as long as necessary for the purpose for which it was collected.

As a general guide:

Enquiry information where we do not begin therapy: usually deleted within 6 months, unless there is a reason to keep it for longer.
Adult client records: usually kept for 7 years after therapy ends, based on professional, legal, insurance and safeguarding considerations.
Couples, relationship or family records: usually kept for 7 years after our last contact, unless legal, safeguarding or professional reasons require longer retention.
Records relating to children or young people: may be kept for longer, depending on age, legal requirements, safeguarding and professional guidance.
Supervision or consultation records: usually kept for 7 years after our last contact, unless professional, insurance, legal or regulatory requirements require longer.
Financial and tax records: usually kept for the period required for tax and accounting purposes.
Data protection complaints: usually kept for up to 6 years after the complaint is closed, so that I can evidence the complaint, actions taken, outcome and any learning.
Emails, messages and administrative records: reviewed periodically and deleted when no longer needed.
Website analytics and cookies: retained according to the settings of the website and relevant service providers.

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons.

I keep retention periods under review and aim to make sure they remain justified and proportionate.

14. Where your information is stored

Your information may be stored in the following systems:

Website / contact form: IONOS

Email: IONOS

Practice management or client records: Halaxy

Online sessions: Zoom by default, Google Meet, Microsoft Teams

Payments / invoicing: bank transfer

Cloud storage or backup: external drive

Phone / messages: SMS, WhatsApp

Accounting / tax records: Starling bank

I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access, secure storage and minimising what is collected and shared.

Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.

15. Online therapy

If we work online, sessions will take place using Zoom.

I will take reasonable steps to protect confidentiality from my side. I ask that you also choose a private space where you cannot easily be overheard or interrupted.

Online platforms may process technical information such as IP address, device information or connection data. Please check the privacy notice of the platform we use if you would like more detail.

16. Outdoor therapy

If we meet outdoors, I will discuss confidentiality with you in advance.

Outdoor therapy can be discreet, but it cannot guarantee the same level of privacy as a private therapy room or online session from a private space. We will agree how to manage the possibility of seeing other people, being overheard, or needing to pause the conversation.

17. AI tools, transcription and recording

I do not record, transcribe or use AI tools to process therapy sessions.

I may use digital tools, including AI tools, for general practice administration, writing, planning, education or public-facing content. Where I do, I aim to avoid putting identifiable client material into tools that are not appropriate for confidential clinical information.

I do not intentionally enter identifiable client therapy information, detailed clinical notes, confidential supervision material or special category personal data into public AI tools.

If I ever propose using an AI tool, transcription tool or recording system in relation to therapy, I will discuss this with you first. I will explain what the tool is for, what information it would process, where the data would go, any material risks or limitations, and what alternatives are available.

I will not use an AI tool, transcription tool or recording system to process therapy sessions without telling you in advance and identifying the appropriate legal basis, safeguards and any consent required for that use.

This website does not use AI to make automated decisions about whether you can access therapy, supervision or consultation.

18. Website visitors and cookies

When you visit this website, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit.

This may happen through website hosting, security, analytics or cookie tools.

My website is hosted by IONOS.

The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security.

This website may use:

essential cookies;
cookie preference tools;
website analytics;
translation tools;
security or performance tools;
embedded content from other websites.

At the time of writing, the website uses or may use:

IONOS SiteAnalytics;
Website Translator;
website hosting and technical services;
cookie-consent tools;
embedded or linked external content.

You can usually accept, reject or configure non-essential cookies through the cookie settings on the website. You can also manage cookies through your browser settings.

If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law.

In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.

Blocking all cookies may affect how the website functions.

19. Analytics

Analytics data may include technical and usage information, such as pages visited, device type, browser type, approximate location, referral source and time spent on the website.

Where possible, analytics should be configured to minimise personal identification, for example through IP anonymisation or aggregated reporting.

Analytics are used to understand general website use and improve the website. They are not used to make clinical decisions about you.

20. Embedded content and external links

This website may include embedded content or links to external websites. This may include videos, maps, articles, professional directories, research papers, booking systems, payment systems, social media content, translation tools or other external services.

Embedded content from another website may behave as if you visited that other website directly. Those third-party websites may collect personal data, use cookies, track your interaction, or use their own analytics.

I am not responsible for the privacy practices, security or content of external websites. Please check the privacy notice of any third-party website before entering personal information.

21. Contact forms, email and secure communication

Contact forms and email are convenient but may not be fully secure.

Please avoid sending detailed clinical, medical, sexual, safeguarding, trauma or third-party information through an initial contact form unless it is necessary.

If we work together, we can discuss appropriate ways to communicate and share information.

22. Sharing your information

I will not share your personal information unless there is a clear reason to do so.

Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

my clinical supervisor;
professional advisers, such as an accountant, insurer or legal adviser;
my professional body, if required in relation to a complaint or ethical matter;
safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern;
a court or legal authority, if required by law;
an appointed clinical executor if I die or become unable to contact clients myself;
trusted digital service providers who process data on my behalf;
payment, banking, invoicing or accounting providers;
website hosting, email, video-call, cloud-storage or technical providers.

Where I share information, I aim to share only what is relevant and necessary for that purpose.

23. Clinical will

I aim to have arrangements in place so that current clients can be contacted if I die or become seriously incapacitated.

This may involve a trusted professional colleague or clinical executor having access to the minimum information needed to contact current clients and manage records appropriately.

That person would be bound by confidentiality, would only access information if necessary, and would not take on an ongoing therapeutic role unless separately agreed and appropriate.

24. International transfers

Some service providers may store or process data outside the UK.

Where this happens, I aim to use providers that rely on appropriate safeguards, such as UK adequacy arrangements, standard contractual clauses, the UK International Data Transfer Agreement, or equivalent safeguards.

If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

25. Data breaches and security incidents

If there is a data breach or suspected security incident, I will assess what happened, what information was involved, who may be affected, what risk is created, and what action is needed.

Where legally required, I will report a personal data breach to the Information Commissioner’s Office. Where legally required, I will also inform affected individuals.

I will keep an internal record of relevant breaches and actions taken.

26. Marketing and newsletters

I do not use therapy enquiries or client contact details for marketing unless you have clearly agreed to receive that communication.

If I introduce a newsletter, mailing list, downloadable resource, webinar list or similar service in the future, the sign-up process will explain what data is collected, how it is used, how often you may be contacted, and how to unsubscribe.

You can withdraw consent to marketing at any time.

27. Children and young people

If I work with or receive information about children or young people, I will handle their information with particular care.

The lawful basis, consent, confidentiality and safeguarding framework may differ depending on the young person’s age, capacity, the nature of the work, parental responsibility, legal duties and safeguarding considerations.

Where appropriate, this will be explained in the relevant therapy or family-work agreement.

28. Your data protection rights

Under UK data protection law, you have rights over your personal information.

These may include the right to:

be informed about how your data is used;
ask for a copy of your personal information;
ask for inaccurate information to be corrected;
ask for information to be deleted in some circumstances;
restrict or object to certain processing;
ask for certain information to be transferred to another provider;
withdraw consent where consent is the lawful basis;
complain about how your information has been handled.

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.

If you would like to exercise your rights, please contact me using the details above.

I may need to confirm your identity before responding.

29. Subject access requests

You can ask for a copy of personal information I hold about you. This is called a subject access request.

Please email:

Olena@Practice-ND.co.uk

Use the subject line:

Subject Access Request

I will respond to a request about your rights within one month, unless an extension applies. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

If I need clarification or proof of identity, I will ask for it as soon as possible.

In some situations, information may need to be withheld, redacted or managed carefully. For example, this may apply where records include information about another person, safeguarding concerns, confidential third-party information, legal advice, or information that could create serious harm if disclosed.

30. Data protection concerns and complaints

If you have a concern about how I have collected, used, stored, shared, retained or protected your personal information, you can make a data protection complaint.

This section is about data protection complaints. If your concern is about therapy, clinical work, fees, appointments or another service issue, I may need to handle that under a different complaints process. If your concern includes both service issues and data protection issues, I will identify and respond to the data protection part appropriately.

What counts as a data protection complaint?

A data protection complaint may include concerns about:

how your personal information has been collected or used;
how long your information has been kept;
whether information held about you is accurate;
how secure your information is;
how a data breach or possible breach has been handled;
how I responded to a subject access request or other information rights request;
whether your information has been shared appropriately;
whether I have complied with UK GDPR, the Data Protection Act 2018, PECR or other relevant data protection law.

You do not need to use legal language. You only need to explain what you are concerned about.

How to make a data protection complaint

Please contact: Olena@Practice-ND.co.uk]

Subject line: Data Protection Complaint

If you cannot use email, you may contact me through the website contact form or another agreed route and say that your concern is about data protection.

Please include, where possible:

your name;
what your concern is about;
what you would like me to look into;
how you would prefer me to respond;
your preferred contact details;
what personal information you are concerned about;
when the issue happened, if known;
any relevant evidence, screenshots or correspondence;
what outcome you are seeking, if you know.

Please do not send more sensitive information than necessary at the first stage.

Complaints made by someone else on your behalf

If someone complains on your behalf, I may need evidence that they have authority to act for you, such as written consent or legal authority.

I will not disclose personal information to someone else unless I am satisfied that it is lawful and appropriate to do so.

What happens after you complain

I will:

acknowledge your complaint within 30 days of receiving it;
consider whether I need more information or proof of identity;
investigate the concern without undue delay;
keep you informed if the investigation is taking longer than expected;
tell you the outcome without undue delay;
explain, where appropriate, what action I have taken or will take;
keep a record of the complaint, the steps taken, the outcome and any learning.

If I can investigate and answer your complaint quickly, the acknowledgement and outcome may be provided together.

Data protection complaints log

I will keep a simple internal record of data protection complaints received.

This may include:

date received;
name and contact details of complainant;
nature of complaint;
information involved;
action taken;
outcome;
date closed;
any learning or changes made.

This log is kept so that I can demonstrate accountability and improve practice.

If you remain unhappy

If you are unhappy with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office.

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

31. Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.

The latest version will be available on my website.

If changes are significant and you are an active client, supervisee or professional contact, I may draw your attention to the updated privacy notice where appropriate.

32. Contact

For privacy questions, information rights requests or data protection complaints, contact:

Olena Baeva / Practice ND
Website: www.practice-nd.co.uk
General email: Olena@Practice-ND.co.uk
Data protection complaints: Olena@Practice-ND.co.uk