Privacy Policy Mindbody Counselling | Paul Weeden

Paul Weeden, BACP-registered integrative therapist, trading as Mindbody Counselling. Practice locations: Seaford, Hove and London W1, and online. Email: contact@mindbodycounselling.co.uk | Tel: +44 (0)7900 822973. Paul Weeden is the data controller for all personal data collected through this website and practice. ICO registration number: [ ZB880380. Paul Weeden works to the BACP Ethical Framework for the Counselling Professions 2026.

When you make an enquiry or begin therapy, supervision or coaching, we may collect: your name, contact details (email, phone, address), date of birth, GP details, next of kin, payment information, and clinical session notes. If you are referred by an insurer, employer or referral service, they give us your name, contact details and the reason for referral.

If you visit this website, standard data such as your IP address and cookies may be collected automatically (see Cookies section).

Electronic records are stored on devices protected by built-in encryption and strong passwords [and two-factor authentication]. A VPN is used to protect our internet connection when working online. Online sessions use [a secure connection / end-to-end encryption where available]. Paper notes, if any, are kept locked 1 Sandgate Close, Bn25, 3LL

Your data is collected and processed to provide counselling, therapy, coaching and supervision services. The lawful basis is: contractual necessity (during active work), legitimate interest (after work ends, for record-keeping and to deal with any complaint or claim), and legal obligation (for example safeguarding duties, tax and accounting). Health and session data is special category data, processed under Article 9(2)(h) as necessary for the provision of health care by a professional bound by confidentiality. Where we rely on your consent, for example for non-essential cookies, a newsletter, or entering your data into an AI tool, you can withdraw it at any time.

Client and supervision records are kept for 7 years after our work together ends, including for clients who were under 18 when work began. After this period, records are securely deleted. Enquiries that do not lead to work are deleted after [1 month]. Financial records are kept for at least 56years after the 31 January Self Assessment deadline for the relevant tax year. We may keep records longer if the law or our insurer requires it, or if there is a complaint or claim.

Your data is not sold or shared for marketing purposes. It may be shared with: your clinical supervisor (anonymised wherever practical), your GP or emergency services where there is a serious risk to life, or as required by law (for example safeguarding obligations).

We use a small number of providers who process data on our behalf, under data protection terms: Zoom for online sessions (and Google Meet as a backup), [practice-management or booking system], [email provider], [payment provider], [website host], and our accountant, who sees financial information only. We may also share information with our professional indemnity insurer or BACP if there is a complaint or claim, and with the person named in our clinical will (see below).

This website only uses the small files (cookies) it needs in order to work. We only use anything extra, such as visitor counting, if you say yes in the cookie banner. You can change your mind at any time, and you can also control cookies through your browser settings.

Electronic records are stored on devices protected by built-in encryption and strong passwords [and two-factor authentication]. A VPN is used to protect our internet connection when working online. Online sessions use [a secure connection / end-to-end encryption where available]. Paper notes, if any, are kept locked [at location]. In the unlikely event of a data breach, you will be notified as required by UK GDPR, and the ICO will be informed within 72 hours if required.

Under UK GDPR, you have the right to: access the data held about you, correct inaccurate data, request erasure (subject to legal retention obligations), restrict or object to processing, data portability, and withdraw consent where we rely on it. To exercise any of these rights, contact Paul Weeden using the details above. We will reply within one month, and tell you if we cannot fully meet a request and why.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk | 0303 123 1113. If your concern is about professional conduct, you can contact BACP and its Professional Conduct process.

What you tell us is confidential. We only share identifiable information with your consent, or where there is a legal or ethical justification. The situations where we may need to share it are:

• Serious harm: if we believe you or someone else is at risk of immediate serious harm.
• Safeguarding: to protect children or adults at risk, in line with our legal duties.
• Legal duty: where the law requires or permits disclosure, such as a court order or preventing serious crime.
• Supervision: we discuss our work with a clinical supervisor to keep it safe and ethical, anonymised wherever practical.
• Clinical will: if Paul Weeden dies or becomes unable to contact clients (see below).

Where it is safe and possible, we will tell you before we share anything, and we will only share what is needed.

We use digital tools in this practice, such as Zoom (and Google Meet as a backup), email and [booking and payment tools]. Before using any AI tool, digital tool or online platform, we assess its risks, check how it handles and stores data, and take steps to protect your confidentiality.

• We will not enter your personal data into any AI or digital tool without your informed consent.
• We will tell you which tools we use, and the benefits and risks of using them.
• We do not hand decisions about your work with us to AI, and we remain responsible for checking anything an AI tool produces.
• We do not currently use AI tools with client information. 
• We do not record or transcribe sessions. 

You can ask about any tool we use, and you can decline its use at any time.

If Paul Weeden dies or becomes too ill to contact you, a trusted person, bound by a written confidentiality

agreement, has been appointed to contact clients, help them find alternative support if they want it, and

arrange for records to be kept or deleted securely. They would use the contact details and preferred

contact method you give us. Please tell us if there is a way of contacting you that is not safe.

Your data is stored [in the UK / in the UK and EEA]. If any provider processes it outside the UK, we make

sure it is protected by an approved safeguard, such as a UK adequacy decision or the ICO's international

data transfer agreement.