Last updated: 12/05/2026
Who I am and how to contact me
Data controller: Matthew McGinty, Mental Wellness Counselling
Email: Matt@mentalwellnesscounselling.uk
Phone: 01733 639 040
If you have questions about this notice or your data, please contact me using the details above.
What I may collect
I may collect and process the following information:
Contact details: your name, email address and/or telephone number, usually collected when you book or make an enquiry.
Session/attendance records: appointment dates, attendance records and, where necessary, brief confidential therapy notes.
Administrative data: invoices, receipts, payment records and other information needed to manage appointments and accounts.
Emergency details: where appropriate, I may ask for your GP details and/or an emergency contact for safety planning.
Some information shared in therapy may include sensitive personal information, such as information about your health, emotional wellbeing, relationships, trauma, personal history or other private matters.
Why I collect it
I collect and use your information where it is necessary to:
- provide therapy and manage appointments;
- maintain safe and effective practice;
- keep basic practice and administrative records;
- manage invoices, receipts and accounts;
- respond to any complaint, claim, safeguarding concern or legal issue where necessary;
- comply with the law where applicable, such as safeguarding duties or a lawful court order.
The lawful bases I rely on may include contract, legitimate interests and legal obligation.
Where information includes special category data, such as health or emotional wellbeing information, I only process this where necessary for providing therapy, maintaining safe and ethical practice, supervision, safeguarding, or responding to legal or professional issues.
How I store your data
Session notes: where kept, these are minimal and confidential. Paper notes are stored in a locked filing cabinet at my home and labelled by initials and date of first session.
Scheduling and communications: your name, email address and/or phone number may be processed by my scheduling provider, Calendly, and my email provider, Microsoft Outlook/Hotmail/SiteGround, solely to manage bookings and communications. These providers act as data processors on my behalf.
Some providers may store data outside the UK. Where they do, appropriate safeguards are used.
I use strong passwords and two-factor authentication where available. I keep data only for as long as necessary. See Retention and disposal below.
Supervision
I may discuss my work in clinical supervision to ensure safe and effective practice. I do not share identifying details; any material discussed is anonymised as far as possible.
Sharing your data
I will not share your information with third parties except in rare situations, such as:
Risk and safeguarding: if I believe there is a serious and imminent risk of harm to you or others, or concerns about the safety of a child or vulnerable adult. Where possible, I will discuss this with you first unless doing so would increase risk.
Medical emergency: if you become unwell or there is an accident during an in-person session or while on a call/video session, I may share your name, location and relevant information with emergency services or health professionals.
Legal requirements: if I am legally compelled to disclose information, for example by a court order.
Incapacity or death: if I am seriously ill or die, my appointed professional executor/supervisor will securely access a list of current clients, including names and contact details, to inform you and discuss options for ongoing support. They will maintain confidentiality to the same professional standards.
Retention and disposal
I keep personal data only for as long as it is necessary and proportionate for the purposes for which it was collected, including providing therapy, managing appointments, maintaining basic practice records, dealing with accounts, responding to any complaint or safeguarding concern, and meeting any legal or professional obligations.
I do not keep detailed session notes as standard. My records are usually limited to attendance, appointment information, brief administrative records, and any minimal notes that are necessary for safe and ethical practice.
Records are reviewed periodically and securely destroyed when they are no longer needed.
Where there are safeguarding concerns, a complaint, a legal issue, unpaid fees, or another significant risk factor, records may be retained for longer where this is necessary and proportionate.
Financial records may be kept for the statutory tax/accounting period.
Paper records are cross-shredded or incinerated. Digital records are permanently deleted from my devices and cloud storage when no longer required.