PRIVACY POLICY AND DATA PROTECTION | CARE2COUNSEL

Care2Counsel is the data controller for all personal data collected and processed through this website (care2counsel.com). We operate a UKCP accredited person centred trauma specialist psychotherapy practice and a digital marketing consultancy specialising in therapists, counsellors, health and wellness professionals.

Business Name:  Care2Counsel.

Data Controller: Director; Tina Chummun MSc MUKCP, PG Dip CIM, BSc (Hons).

Registered In: England and Wales.

Contact For Data Matters: tina@care2counsel.com please mark your subject line 'Data Protection'.

Website: care2counsel.com

We collect different types of personal data depending on how you interact with us:

Psychotherapy Practice Clients

• Name, contact details and date of birth.

• Health and mental health information (special category data under UK GDPR).

• Therapy ession notes and clinical records.

• Referral information where applicable.

• Payment and invoicing details.

Marketing Consultancy Clients

• Name, job title, business name and contact details.

• Information about your practice or business shared during our engagement.

• Payment and invoicing details.

• Communications and correspondence.

Website Visitors

• IP address and browser information (collected automatically via web analytics).

• Pages visited and time spent on website.

• Information submitted via contact or enquiry forms.

• Cookie preferences.

Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contract: To provide the psychotherapy or marketing consultancy services you have engaged us for.

Legal Obligation: To meet our professional regulatory obligations (UKCP) and financial record keeping requirements.

Consent: For marketing communications, newsletter subscriptions and where required for certain cookies.

Legitimate Interests: For internal administration, service improvement, and responding to website enquiries.

Vital Interests: In rare emergency circumstances where there is a risk to life.

For health and mental health data (special category data), we rely on your explicit consent and/or the provision of health or social care services, in accordance with Article 9 of the UK GDPR.

Our website uses cookies to improve your experience and to understand how the website is used. Following changes introduced by the Data (Use and Access) Act 2025 (February 2026), the following rules apply:

Strictly Necessary Cookies: Essential for the website to function properly. These do not require your consent.

Analytics Cookies (Aggregate Only): We use web analytics tools to understand overall patterns of website use. Where data is used solely for aggregate statistical purposes (not to identify you individually), consent is not required under DUAA reforms.

Marketing / Advertising Cookies: Where used, these require your explicit consent. You can manage your preferences at any time via our cookie banner or by contacting us.

You can review or withdraw your cookie preferences at any time using the cookie settings tool on this website.

We'll help you automate your marketing processes to save time and increase efficiency, while still delivering personalized experiences to your customers.

Psychotherapy Clinical Records: 7 years from the date of last contact in accordance with UKCP and NHS guidance.

Marketing Consultancy Client Records: 6 years from the end of engagement, in accordance with HMRC requirements.

Financial And Invoicing Records: 6 years, as required by HMRC.

Marketing Consent Records: Until consent is withdrawn, plus 1 year thereafter.

Website Enquiry Form Submissions: 12 months from receipt, unless a client relationship is established.

Website Analytics Data: 26 months (Google Analytics default), used in aggregate only.

We do not sell your personal data. We only share it where necessary:

• Professional supervisors (clinical supervision - bound by the same confidentiality obligations).

• Regulators or statutory bodies where legally required (e.g. safeguarding duties, UKCP).

• Third party service providers who support our operations (e.g. website hosting, payment processing, email marketing) - all subject to data processing agreements.

• Emergency services or healthcare professionals where there is an immediate risk to life.

For Marketing Consultancy Clients: We treat all information shared during our engagement as strictly confidential and will not disclose it to third parties without your consent, except where legally required.

We do not routinely transfer your personal data outside the UK. Where any third party tool we use processes data outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement or adequacy decisions, in accordance with Chapter V of the UK GDPR.

You have the following rights in relation to your personal data. To exercise any of these rights, please email tina@care2counsel.com with the subject line 'Data Rights Request':

Right Of Access: Request a copy of the personal data we hold about you (a Subject Access Request).

Right To Rectification: Ask us to correct inaccurate or incomplete data.

Right To Erasure: Ask us to delete your data where there is no longer a lawful basis to hold it.

Right To Restrict Processing: Ask us to pause processing your data in certain circumstances.

Right To Data Portability: Receive your data in a structured, commonly used, machine readable format.

Right To Object: Object to processing based on legitimate interests or for direct marketing purposes.

Rights Re: Automated Decisions: Not to be subject to a decision made solely on the basis of automated processing that significantly affects you.

Right To Withdraw Consent: Withdraw any previously given consent at any time, without affecting the lawfulness of prior processing.

We review and update this privacy policy regularly to reflect changes in law, our services or our data practices. The current version will always be available on this website. Where changes are material, we will notify existing clients directly.

This version was updated on 19 June 2026 to reflect the Data (Use and Access) Act 2025 (DUAA).

If you have a concern about the way Care2Counsel has collected, used, stored, shared or otherwise handled your personal data, you have the right to raise this with us directly. We take all such concerns seriously and are committed to resolving them promptly and fairly.

Examples of data protection complaints include, but are not limited to:

• Concerns about how we collected your personal information.

• Objections to how we are using or processing your data.

• Concerns about your data being shared without your knowledge or consent.

• A belief that your personal data has been lost, stolen or accessed without authorisation.

• Dissatisfaction with how we responded to a Subject Access Request or other data rights request.

• Any other concern relating to your rights under the UK GDPR or Data Protection Act 2018.

Please contact us by the following:

By Email:

tina@care2counsel.com

Please mark your subject line: Data Protection Complaint

Via The Website Contact Form:

Please mark your message clearly as 'Data Protection Complaint' when submitting via care2counsel.com

To help us investigate your complaint efficiently, please include:

• Your full name and contact details.

• A clear description of your concern.

• The approximate date(s) the issue occurred or came to your attention.

• Any relevant reference numbers or previous correspondence.

• What outcome you are seeking, if known.

We will follow this process to ensure your complaint is handled fairly and without undue delay:

Step 1 - Acknowledgement (Within 30 Days)

We will acknowledge receipt of your complaint in writing within 30 days of receiving it. Our acknowledgement will confirm:

• That your complaint has been received and is being looked into.

• The name of the person handling your complaint (Tina Chummun, Director).

• An expected timeframe for our full response.

• Your right to escalate the matter to the Information Commissioner's Office (ICO) if you remain dissatisfied.

Step 2  - Investigation

We will begin investigating your complaint promptly upon receipt. This will involve reviewing the personal data we hold about you, examining the circumstances of your concern, and taking any necessary steps to understand what has occurred.

Step 3 - Full Response

We will provide you with a full written response as soon as reasonably practicable and without undue delay. Our response will:

• Set out our findings following investigation.

• Explain any steps taken or planned to address your concern.

• Confirm whether or not we consider that a breach or failing occurred.

• Outline any remedial action taken or planned.

• Remind you of your right to escalate to the ICO if you are not satisfied with our response.

We create high-quality and engaging content that resonates with your target audience, builds trust and authority, and drives conversions.

We encourage you to contact us first so that we have the opportunity to resolve your concern directly. However, this does not affect your right to contact the ICO at any stage.

Information Commissioner's Office (ICO)

The ICO is the UK's independent data protection regulator.

Website: www.ico.org.uk

Helpline: 0303 123 1113

Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

All complaints will be handled in strict confidence. Information about your complaint will only be shared with those within Care2Counsel who need to be involved in investigating and responding to it. All personal data connected with your complaint will be handled in accordance with this privacy policy and the UK GDPR.

We maintain a confidential complaints log. Each complaint received is recorded with the following details:

• Date complaint received.

• Nature of the complaint.

• Date of acknowledgement.

• Actions taken during investigation.

• Date and content of full response.

• Outcome and any remedial action.

This record allows us to identify patterns, improve our data practices, and demonstrate accountability to the ICO if required. Complainants' personal details are held securely and separately.