Calm Waters Counselling
Serena Edwards — BACP Accredited Psychotherapist and Clinical Supervisor
Last reviewed: 14 October 2026
1. Introduction
At Calm Waters Counselling, I am committed to protecting your privacy, maintaining confidentiality and handling your personal information responsibly.
This Privacy Notice explains how I collect, use, store, share and retain personal information when providing counselling, psychotherapy, EMDR, clinical supervision and related professional services.
I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and my professional obligations under the BACP Ethical Framework.
2. Who is responsible for your information?
The data controller is:
Serena Edwards
Calm Waters Counselling
32 Grange Park
Bishopsteignton
Devon
TQ14 9TT
Email: serena@calmwaterscounselling.co.uk
Website: www.calmwaterscounselling.co.uk
I am registered with the Information Commissioner’s Office (ICO) and pay the applicable data protection fee.
Please contact me if you have questions about your information or wish to exercise your data protection rights.
3. What information do I collect?
Depending on the service provided, I may collect:
- Your name, date of birth, address and contact details.
- Emergency contact information.
- Relevant medical, mental health and medication information.
- Personal history, family circumstances and significant life experiences.
- Information relating to trauma, emotional wellbeing and therapeutic needs.
- Appointment and attendance information.
- Clinical assessments, treatment plans and session notes.
- Information relevant to clinical supervision.
- Payment and financial administration information.
- Correspondence by email, telephone, text message or WhatsApp.
Some of this information is classified as special-category personal data because it concerns your physical or mental health or other sensitive aspects of your life.
I aim to collect only information that is relevant and necessary for the services I provide.
4. Why do I use your information?
I use personal information to:
- Respond to enquiries and arrange appointments.
- Assess whether I can offer an appropriate service.
- Provide safe and effective counselling, psychotherapy and clinical supervision.
- Maintain appropriate clinical records.
- Monitor therapeutic progress and professional practice.
- Communicate about appointments and relevant clinical matters.
- Meet safeguarding, professional, insurance and legal responsibilities.
- Manage payments, accounting and business administration.
- Respond to complaints or legal claims when necessary.
5. Lawful bases for processing
Under Article 6 of UK GDPR, the lawful bases I rely on may include:
Contract: Where processing is necessary to provide agreed professional services or take steps before entering into a contract.
Legal obligation: Where processing is necessary to comply with applicable legal requirements.
Legitimate interests: Where processing is necessary for appropriate practice administration, record keeping or the establishment and defence of legal claims, provided those interests are not overridden by your rights.
Information about physical or mental health requires an additional condition under Article 9 of UK GDPR.
For the provision of confidential therapeutic services, I may rely on Article 9(2)(h), concerning health or social care, where the relevant professional secrecy and UK legal requirements are satisfied.
Other Article 9 conditions may apply in particular circumstances, including the establishment, exercise or defence of legal claims.
The precise lawful basis and special-category condition used for each processing activity are documented and reviewed as part of my data protection arrangements.
6. Confidentiality and sharing information
Information shared during counselling, psychotherapy or supervision is treated as confidential.
There may be circumstances where information needs to be disclosed, including:
- Serious concerns about safety or safeguarding.
- A legal requirement or court order.
- Appropriate professional consultation or clinical supervision.
- The establishment, exercise or defence of legal claims.
- Exceptional arrangements under my clinical will.
Where practicable and appropriate, I will discuss disclosures with you beforehand.
When discussing clinical work in professional supervision, I aim to minimise identifying information.
I do not sell client information.
7. Children and young people
I provide services to children and young people as well as adults.
I recognise that children and young people have their own privacy and confidentiality rights. Information is handled with consideration of their age, understanding, capacity, safeguarding needs and the rights and responsibilities of those with parental responsibility.
Confidential information is not automatically disclosed to parents or carers simply because a client is under 18.
The limits of confidentiality are discussed as appropriate when therapy begins.
8. How I store and protect information
Paper clinical records are stored in a locked filing cabinet.
Electronic clinical records are currently held in a dedicated, non-shared Calm Waters Counselling folder within Apple iCloud Drive.
My Apple account is protected by two-factor authentication, and Advanced Data Protection is enabled to provide end-to-end encryption for supported categories of iCloud information.
Electronic clinical records are also included in encrypted Time Machine backups held on an external drive. Backup contents and a basic file restoration have been successfully checked.
Access to confidential information is restricted, with appropriate exceptional arrangements under my clinical will.
I review the security, confidentiality and suitability of my record-storage arrangements.
No electronic storage or communication system can be guaranteed completely risk-free.
9. Online appointments
Online counselling, psychotherapy and clinical supervision may take place using Microsoft Teams through my Microsoft 365 Business account.
I do not routinely record online sessions and do not use Microsoft Copilot, automated AI session notes or automatic transcription for these sessions.
Microsoft may process account, technical and service-related information in accordance with its applicable terms and privacy documentation.
Clients are asked not to record sessions without prior agreement.
10. Email, telephone, text messages and WhatsApp
I use email, telephone, text messaging and WhatsApp for appointments, administration and, where appropriate, clinically relevant communication.
These methods carry different privacy and security risks. I encourage clients to consider the sensitivity of information they send electronically.
Clinically significant communications may be summarised or incorporated into the clinical record.
Routine appointment messages are normally retained for up to three months after the relevant appointment or last contact, unless there is a legitimate reason to retain them longer.
Communications relevant to safeguarding, complaints, clinical care or legal matters may be retained as part of the appropriate record.
WhatsApp communications use the security protections provided by that service, and end-to-end encrypted backups are enabled on my account.
11. Enquiries and website contact forms
If you contact Calm Waters Counselling through the website, I collect the name, email address and message you provide.
I use this information to respond to your enquiry, discuss availability and suitability, and arrange services where appropriate.
Please avoid including detailed medical or highly sensitive personal information in an initial website enquiry.
If an enquiry does not lead to a professional relationship, the correspondence is normally retained for six months after the last contact, unless a longer period is necessary for a lawful reason.
The website may use essential technical services and security measures to operate its contact form.
12. How long I retain information
I retain information only for as long as necessary for the relevant professional, legal, insurance or administrative purpose.
My normal retention arrangements are:
Adult counselling and psychotherapy records: Six years after the therapeutic relationship ends.
Children’s and young people’s clinical records: Until the client’s 25th birthday, in accordance with written guidance received from my professional insurer, subject to any overriding legal or professional requirement.
Clinical supervision records: Six years after the supervision relationship ends.
Unsuccessful enquiries: Six months after the last contact.
Routine appointment messages: Normally up to three months after the appointment or last relevant contact.
Financial and accounting records: Retained for the period required by applicable tax and accounting obligations.
Records may be retained longer where necessary and lawful, including in connection with safeguarding, complaints, investigations, legal proceedings or insurance requirements.
When information is no longer required, it is securely deleted or destroyed as appropriate. Copies held in backups may remain until the relevant backup retention cycle expires.
13. Financial records
Financial and accounting information is maintained in electronic spreadsheets on password-protected devices and within Apple iCloud Drive.
This information is used for invoicing, payment administration, accounting and compliance with applicable tax obligations.
14. Service providers and international transfers
In operating my practice, I use third-party technology and communication providers, including Apple, Microsoft and WhatsApp, together with providers supporting my website and communications.
These services may process personal information or associated technical data in the course of providing their services.
Where personal information is processed outside the United Kingdom, I assess the applicable data protection arrangements and whether appropriate safeguards or other lawful transfer mechanisms are required.
I review the suitability of services used to process confidential personal information.
15. My clinical will
I have arrangements in place for a qualified professional to act as my clinical executor if I become unexpectedly unable to practise.
In those circumstances, the clinical executor may access only the information reasonably necessary to manage client communications, continuity of care, outstanding professional responsibilities and appropriate record arrangements.
Any access is subject to confidentiality and relevant legal and professional obligations.
16. Your data protection rights
Depending on the circumstances and the lawful basis for processing, you may have the right to:
- Be informed about how your information is used.
- Request access to personal information held about you.
- Request correction of inaccurate information.
- Request erasure of information in certain circumstances.
- Request restriction of processing.
- Object to certain processing.
- Request data portability where applicable.
- Withdraw consent where consent is the lawful basis being relied upon.
These rights are not absolute. Certain information may need to be retained for lawful professional, safeguarding or legal reasons.
Please contact me using the details above to make a request.
I will respond within the applicable statutory timescale, normally one month, subject to any lawful extension.
17. Concerns or complaints
If you have concerns about how your personal information is handled, please contact me first so I can consider and respond to them.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
18. Website cookies
The Calm Waters Counselling website does not currently use any identified non-essential tracking or advertising cookies.
The website may use strictly necessary technical cookies when particular functions are accessed, such as website administration or security features.
I periodically review the website’s use of cookies and similar technologies. If non-essential cookies are introduced, appropriate information and consent controls will be provided where legally required.
19. Changes to this Privacy Notice
This Privacy Notice will be reviewed periodically and updated when my services, information-handling arrangements or applicable legal requirements change.
The current version will be available on the Calm Waters Counselling website.