SECOND LENSPrivacy RegisterPrivacy policy check
Early version
By sector ยท Counselling, psychotherapy and therapy practices

Privacy policy for counsellors and therapists

Counsellors and therapists handle some of the most sensitive information there is. A counselling privacy policy needs everything any UK privacy notice needs, plus a clear account of how you look after health information and where confidentiality has limits.

Last checked against legislation.gov.uk on 14 October 2026. General information, not legal or professional advice. Your professional body's guidance also applies.

Session notes are health information

Information about a client's mental or physical health is "data concerning health", one of the special categories in UK GDPR Article 9. You may only use it if you have an ordinary lawful basis and also meet one of the Article 9 conditions. Your privacy policy should say which you rely on. Common choices for a private practice are:

  • The client's explicit consent (Article 9(2)(a)).
  • The provision of health or social care (Article 9(2)(h), with Data Protection Act 2018 Schedule 1 paragraph 2). This applies only where the information is handled by, or under the responsibility of, someone bound by a duty of confidentiality.

Which fits depends on your practice. If you are unsure, take advice from your professional body or a data protection specialist.

Sources: UK GDPR Article 9; DPA 2018 Schedule 1, paragraph 2.

What a counselling privacy policy should cover

  • What you record: contact details, referral information, session notes, assessments, and anything about a client's health or circumstances.
  • Why, and the lawful basis and Article 9 condition for each use.
  • The limits of confidentiality: the situations in which you might share information without consent, for example a serious risk of harm or a legal requirement. Say this in plain words; clients need to know before they disclose.
  • Supervision: if you discuss client work in clinical supervision, say so and whether you anonymise it.
  • Who else sees information: for example an online booking system, a video platform for remote sessions, your notes software, an insurer or a referring organisation.
  • Where it is stored, and whether any of it leaves the UK through the tools you use.
  • How long you keep notes, and why. Your professional body and insurer may have guidance on this.
  • Clients' rights, including access to their own notes.
  • New in 2026: the right to complain to you, and how. Free complaints procedure template.
  • The right to complain to the regulator, now the Information Commission.

Check your website, not just the policy

Many practice websites use booking widgets, analytics, embedded maps or social media pixels. Each sends visitor information to another company, and people visiting a therapist's website may be looking for help with something sensitive. Make sure your policy names every tool your site uses.

Check your practice's privacy policy

The Privacy Register reads your policy and website, asks whether you handle sensitive data, and shows the gaps with suggested wording. Free, no sign-up.

Check my privacy policy

Questions

Does a sole-practitioner counsellor need a privacy policy?

Yes. If you collect personal information from clients or website visitors, you must tell them the things UK GDPR Article 13 lists, whatever the size of your practice.

Should I mention the limits of confidentiality in my privacy policy?

Yes. People must be told who their information may be shared with and why. Explaining when you might break confidentiality, in plain words, is part of that, and it lets clients make an informed choice.