I am Paula Aguiriano, a counsellor working with adolescents and young adults aged 12 to 25. This notice explains what personal information I collect, why I need it, how I protect it and your rights over it. It covers enquiries and counselling in my private practice.

I am the data controller, which means I am responsible for how I collect, use and keep your personal information. I follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the BACP Ethical Framework for the Counselling Professions.

Email: contact@paulaaguiriano.co.uk
ICO registration number: ZB151972

What information do I collect

I collect information relevant to enquiries, counselling and the running of my practice. This may include:

· Your name, date of birth and contact details.

· Parent or carer contact details, where relevant.

· GP and emergency contact details.

· Information about your health, family, education, relationships and circumstances relevant to counselling.

· Brief session notes, relevant correspondence and appointment records.

· Attendance, payment and invoicing records.

Counselling records may contain sensitive information, known in law as special category data. This includes information about mental health, ethnicity, beliefs, sex life or sexual orientation. I only collect and record information relevant to our work.

With your consent, I may photograph artwork or other creative activities from sessions. These photographs form part of your confidential counselling record.

Most information comes directly from you. I may also receive information from a parent, carer or another professional involved in your support, such as a GP or school. I will explain how I handle this information.

Why do I collect this information

I collect information to respond to enquiries, assess whether I can offer suitable support, provide counselling and maintain records of our work. I also need information to arrange appointments, communicate about sessions, manage payments and respond to safeguarding concerns, complaints or legal claims.

Some information, such as contact details and information needed to work safely, is necessary for counselling to proceed. If you prefer not to provide it, we can discuss whether I can still offer sessions.

What legal grounds do I rely on

The legal grounds depend on the purpose:

· Contract: Information necessary to arrange and provide counselling where I have a contract with you (Article 6(1)(b)).

· Legitimate interests: Information necessary to respond to enquiries, run my practice safely, provide counselling where a parent arranges it and retain appropriate records after counselling ends (Article 6(1)(f)). I consider your privacy rights, with particular care where you are under 18.

· Legal obligation: Information needed to meet specific legal requirements, such as tax record keeping or a valid court order (Article 6(1)(c)).

· Consent: Where I ask for your agreement to an optional use of information, such as photographing creative work (Article 6(1)(a)). You can withdraw that consent by contacting me.

For sensitive information necessary to provide counselling, I rely on the health or social care condition under Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. I handle this information under my duty of confidentiality.

For necessary safeguarding disclosures, I rely on the applicable legal obligation or legitimate interest in protecting someone from harm. Where sensitive information is involved, I also apply an appropriate condition, such as safeguarding under Article 9(2)(g) and Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018, where its requirements are met. Information necessary to establish, exercise or defend legal claims may be processed under Article 9(2)(f).

Confidentiality and sharing information

What you discuss in counselling is confidential. I do not routinely report session content to parents, carers, schools or other professionals.

I attend regular clinical supervision to review my work. My supervisor is bound by confidentiality. I limit identifying information when discussing our sessions.

I may also share relevant information:

· With your agreement, for example to liaise with your GP or school.

· Where necessary to safeguard you or someone else, or respond to a serious risk of harm.

· Where the law requires disclosure, such as a valid court order.

· Where necessary to respond to a complaint or legal claim, with appropriate professional advisers or my insurer, Newline Syndicate 1218, through Holistic Insurance Services.

I share only what is necessary. Wherever possible, I discuss this with you first, unless doing so would increase risk or prevent a necessary response. Website and email providers also process information as explained below.

Young people and parents

Young people have privacy rights over their own information. Arranging or paying for counselling does not automatically give a parent access to session content or records.

We discuss confidentiality and parent involvement at the start of counselling. I take account of the young person’s understanding, developmental needs, wishes and safety. I explain privacy in language they can understand. Requests from parents for records are considered in light of the young person’s capacity, wishes, best interests and legal rights.

How long do I keep information

I keep counselling records and signed agreements to meet my insurance conditions and enable me to respond to complaints or legal claims. My normal retention periods are:

· Counselling records where counselling ends before your 18th birthday: until your 23rd birthday, which is five years after you turn 18.

· Counselling records where counselling ends when you are 18 or older: five years after the final session.

· Enquiries that do not lead to counselling: up to 12 months after the last contact.

· Financial records: six years after the end of the tax year to which they relate.

Signed agreements, correspondence, photographs and artwork kept as part of the counselling record follow the same retention period. If a claim is made or I become aware of circumstances likely to lead to a claim, I preserve the relevant records. I may also retain relevant records longer where necessary for an ongoing safeguarding matter, complaint or specific legal requirement. I review the need for continued retention. When records are no longer needed, I securely destroy or delete them.

How do I protect information

I keep electronic counselling notes on a password protected drive. Printed notes, photographs and artwork are kept in a locked cabinet. I limit access to records and take reasonable steps to protect information from loss, misuse, unauthorised access or disclosure.

My website and email are hosted by Hostinger. Hostinger processes information necessary to provide those services, including email addresses, email content, website enquiry information and technical information associated with website hosting. This is separate from access to the counselling records held on my drive or in my cabinet.

Hostinger and its service providers may process information outside the UK. Its data processing terms provide for international transfer safeguards, including standard contractual clauses with the UK International Data Transfer Addendum where applicable. You can read its privacy policy at https://www.hostinger.com/legal/privacy-policy and its data processing terms at https://www.hostinger.com/legal/dpa. You can also contact me for information about the safeguards relevant to your data.

No email or online system can be guaranteed completely secure. Please keep your initial enquiry brief and save detailed personal information for a conversation with me.

Website enquiries

If you contact me through my website or by email, I use the information you provide to respond to your enquiry and discuss counselling arrangements. I do not use counselling enquiries or records for advertising or sell your personal information.

My website may contain links to other websites. Their own privacy notices apply when you visit them.

Your rights

You have the right to know how I handle your information, ask for access to your personal data, including information in counselling notes, and ask me to correct inaccurate information. Depending on the circumstances, you may also ask me to delete information, restrict its use or provide it in a transferable format.

You have the right to object to processing based on legitimate interests. Please contact me to raise an objection.

Where processing relies on consent, you can withdraw it at any time by contacting me. This does not affect processing that took place before withdrawal. Some rights apply only in certain circumstances. If a legal restriction or exemption applies to your request, I will explain this.

To make a request, contact me at contact@paulaaguiriano.co.uk. I normally respond within one month. If a permitted extension is necessary, I will explain the reason and timescale. I may need to confirm your identity before releasing information.

Access to another person’s information is not automatic. Where legally permitted, I may withhold or redact information to protect another person’s confidentiality or where the applicable serious harm exemption is met.

Questions or complaints

Please contact me at contact@paulaaguiriano.co.uk if you have a question, want to exercise your rights or wish to complain about how I handle information. I will investigate your concern and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

Review of this notice

I review this notice when my practice arrangements or relevant requirements change. The current version will be available on my website.

Last reviewed: 10 October 2026