Privacy Policy
Out of the Blue Counselling and EFT Tapping
Lori Thackham – Data Controller
Last updated: September 2026
This Privacy Policy explains what personal information I collect, why I collect it, how I use and protect it, who it may be shared with, how long I keep it and your rights in relation to your information.
It applies to my counselling, EFT Tapping and counselling supervision services, whether provided face-to-face, online or by telephone, as well as enquiries made through my website, professional directories, email, telephone, messaging services or professional social-media pages.
I am the Data Controller for the personal information I hold about my clients and prospective clients.
Information I Collect
The information I collect will depend on the service you are using and what is relevant to our work.
When you become a client, I routinely ask for:
Your full name
Address
Date of birth
Telephone number and email address
GP details
The name and contact details of an emergency contact
Depending on the nature of our work, I may also hold information about:
What has brought you to counselling, EFT or supervision
Previous counselling, therapy or supervision
Physical and mental health
medication where relevant;
Relationships, family and dependants
Occupation and other relevant aspects of your life
Information you choose to share about your experiences, identity, beliefs, culture or relationships
Assessments such as PHQ-9, GAD-7 or CORE where these are relevant
Session notes
Appointments and communications relating to our work
Invoices and payment information.
Counselling and EFT naturally involve people sharing sensitive and personal information. My records may therefore contain information classified under UK data-protection law as special category data, including information about physical or mental health and, where relevant to what you choose to discuss, matters such as racial or ethnic origin, religious or philosophical beliefs or sexual orientation.
I only collect and retain information that is relevant to providing my services safely, ethically and professionally.
Why I Collect Your Information
I use your information to:
Provide counselling, EFT Tapping or supervision
Communicate with you and arrange appointments
Maintain appropriate clinical and professional records
Understand and support our work together
Respond appropriately if a health, safety or safeguarding concern arises
Meet my ethical, professional, insurance and legal responsibilities
Manage the administration and financial records of my practice
Respond to enquiries about my services
At the beginning of our work, I ask for your GP and emergency-contact details so that appropriate information is available if an unexpected health or safety concern arises.
For example, if you became unwell during a session, I would have details of someone who could be contacted if necessary.
I do not routinely contact your GP or emergency contact.
My Lawful Basis for Using Your Information
UK data-protection law requires me to have a lawful basis for processing personal information and an additional condition where I process special-category information.
Depending on the purpose for which information is being used, I rely principally on:
Performance of a contract, where processing is necessary to provide the counselling, EFT or supervision service we have agreed
Legitimate interests, where processing is necessary for the safe, effective, ethical and professionally accountable running of my practice, provided those interests do not override your rights and interests
Because counselling and EFT may involve health and other special-category information, I also process relevant special-category data where this is necessary for the provision and management of health or social-care-related services by a professional subject to confidentiality obligations.
In some circumstances, information may also need to be processed or retained for the establishment, exercise or defence of legal claims or to comply with another legal obligation.
Where I specifically ask for your consent for a particular activity – for example, my use of Heidi Health to assist with session note-taking – I will explain what you are agreeing to and how you can withdraw that agreement.
Withdrawing agreement to the use of Heidi does not prevent you from continuing counselling or EFT with me and does not remove my professional obligation to maintain appropriate clinical records.
Session Notes and WriteUpp
I keep brief clinical notes to support continuity in our work and to meet my professional, ethical and legal responsibilities.
My main client-record system is WriteUpp, a practice-management system designed for healthcare professionals.
Client records, session notes, relevant forms and other clinical information are stored within WriteUpp.
WriteUpp uses security measures including encryption and two-factor authentication and is ISO 27001 certified. Its UK and European customer data is hosted within the European Union.
Heidi Health and AI-Assisted Note-Taking
With your explicit agreement, I may use Heidi Health to assist me in creating notes from our sessions.
I will explain this to you before Heidi is used and ask you to complete a separate consent form. You do not have to agree to Heidi being used and you can withdraw your agreement to its use at any time without this affecting your ability to continue working with me.
Heidi processes the conversation in real time to produce a transcript from which notes can be generated. Heidi states that audio from real-time consultations is not stored.
I review the information produced by Heidi and remain professionally responsible for the clinical record. Relevant notes are transferred into WriteUpp, which remains my main clinical record system.
Heidi does not make therapeutic decisions on my behalf and does not replace my professional judgement.
Other Digital and AI-Assisted Tools
From time to time I may use secure digital tools, including AI-assisted tools, to support administrative tasks, document preparation, structuring information or professional reflective work.
Where I use these tools outside my designated clinical record systems, I do not enter names, contact details or other information intended to identify a client.
Information is anonymised or de-identified wherever possible before it is used in this way.
These tools do not replace clinical supervision, professional judgement or my responsibility for maintaining client confidentiality.
Email communications are managed through a Microsoft Exchange account hosted by Microsoft. My IT provider has confirmed that my Exchange account is hosted within Microsoft’s UK data centres.
I use email primarily for enquiries, arranging appointments and other appropriate communication relating to my practice. Where information received by email needs to form part of your clinical record, relevant information may be recorded within WriteUpp.
Email is not my preferred method for sharing detailed or sensitive therapeutic information. Although I take appropriate steps to protect my email account, email communication carries privacy and security risks. I therefore recommend that, wherever possible, sensitive or detailed information about your therapeutic work is discussed with me during a session rather than sent by email.
If you do send me sensitive information by email, I will treat it confidentially and, where appropriate, relevant information may be transferred to your secure clinical record.
Telephone, Text and WhatsApp Business
I may communicate with clients and prospective clients by telephone, text message or WhatsApp Business, depending on how you contact me and the communication arrangements we agree.
My smartphone is protected by security controls. Client telephone numbers are stored using a first name and identifying code rather than a full clinical record.
I recommend that WhatsApp and text messaging are used primarily for practical communication such as appointments. Where possible, sensitive or detailed therapeutic information is better discussed during a session.
If information sent by message is clinically significant, relevant information may be transferred to your secure clinical record.
WhatsApp and mobile-network services are provided by third parties and have their own privacy and data-processing arrangements. Detailed clinical records are not stored within WhatsApp.
Facebook and Instagram
Occasionally someone may first contact me through Facebook or Instagram Messenger after finding one of my professional social-media pages.
These services are not used for storing clinical records or for ongoing therapeutic conversations.
If you contact me through social media, I may suggest that we continue our communication by email, telephone or another agreed method.
I recommend that sensitive or detailed therapeutic information is not sent through social-media messaging.
Facebook, Instagram and their associated messaging services are operated by Meta and are subject to Meta’s own privacy and data-processing arrangements.
Online Sessions and Zoom
Where we work online, sessions may take place using Zoom.
I do not routinely record counselling, EFT or supervision sessions.
If there were ever a specific reason for a session to be recorded, this would only be done after discussing it with you and obtaining your explicit agreement.
When working online, I may ask you to confirm where you are physically located if you are attending from somewhere other than your usual address. This enables me to respond appropriately if an emergency or safeguarding concern arises during a session.
Website, Professional Directories and Enquiries
You may contact me directly through my website or through a third-party professional directory, such as Counselling Directory.
Information you submit through a third-party directory is initially processed through that organisation’s systems and is subject to its own privacy and data-protection arrangements. Once I receive your enquiry, I will handle the information you have provided in accordance with this Privacy Policy.
Enquiry information is used to respond to you and, where appropriate, arrange a discovery call or appointment. If you subsequently become a client, relevant information may form part of your clinical record.
When making an initial enquiry, I recommend providing only the information needed for me to understand the general nature of your enquiry and contact you. Detailed or particularly sensitive therapeutic information is usually better discussed with me directly.
Information submitted through my own website enquiry facility is used to respond to your enquiry and is not used for unrelated marketing purposes.
My website and professional-directory profiles may contain links to other websites. I am not responsible for the privacy practices of websites operated by other organisations.
Clinical Supervision
I undertake regular clinical supervision as part of maintaining safe, ethical and reflective practice.
I may discuss aspects of my client work within supervision. Wherever possible, information is anonymised and identifying details are not used unless they are necessary for the particular issue being considered.
My clinical supervisor is also bound by professional confidentiality.
Clinical Will
I have a Clinical/Therapeutic Will so that appropriate arrangements can be made for clients if I die or become seriously ill and am unexpectedly unable to continue working.
Relevant contact information is securely held through the Clinical Wills Platform.
If my Clinical Will needs to be activated, my Therapeutic Executor – a qualified counsellor/supervisor who is bound by confidentiality – may be given appropriate access so that current clients can be contacted and informed.
My Executor may also provide information about alternative sources of support where appropriate.
Safeguarding and Sharing Information
Confidentiality is fundamental to my work, but it is not absolute.
There may be circumstances in which I need to share relevant information to protect you or somebody else from serious harm, meet safeguarding responsibilities or comply with a legal requirement.
If I become concerned that there is a significant risk of harm to you or somebody else, I will normally discuss my concerns with you where it is safe and appropriate to do so. We may consider whether your GP, emergency contact, mental-health service, safeguarding service or another appropriate professional or organisation needs to be involved.
There may be circumstances where the seriousness or immediacy of the risk means that relevant information needs to be shared without your consent.
Where information needs to be shared, I will aim to disclose only information that is relevant and necessary for the purpose.
Further information is available in my Safeguarding Policy.
Other Circumstances in Which Information May Be Shared
Where necessary and appropriate, personal information may also be shared with:
Organisations providing services that process information on my behalf
My professional insurer or legal adviser where advice or representation is required
HMRC or other authorities where I have a legal obligation to provide information
Healthcare, mental-health, safeguarding or emergency services where necessary
My Therapeutic Executor if my Clinical Will is activated
Another person or organisation where disclosure is required by law
Where organisations process personal information on my behalf, I take reasonable steps to use services that provide appropriate data-protection and security safeguards.
Some technology providers may use infrastructure or subprocessors located outside the UK. Where this involves an international transfer of personal information, appropriate UK data-protection safeguards must apply.
How Long I Keep Your Information
I do not keep personal information indefinitely.
Adult clinical records are retained for 5 years following the end of our work together, in accordance with my professional insurance requirements.
For a client under the age of 18, clinical records are retained for 5 years after they reach the age of 18.
Financial and accounting records are retained for 6 years in accordance with HMRC requirements.
Emails, Messages and Enquiries
Routine emails, text messages, WhatsApp messages and other correspondence are not retained indefinitely and will normally be deleted within 12 months of the communication no longer being required.
Where an email or message contains information relevant to your clinical record – for example, information relating to risk, safeguarding or our therapeutic work – the relevant information may be recorded within your secure clinical record in WriteUpp. It will then be retained in accordance with the clinical-record retention periods above.
Where someone makes an initial enquiry but does not go on to become a client, their enquiry and related correspondence will normally be deleted within 12 months of our last contact, unless there is a legitimate reason for retaining it for longer.
After the relevant retention period has expired, information is securely deleted or destroyed unless there is a specific legal or professional reason requiring it to be retained for longer.
Recording Sessions
You should not record our counselling, EFT or supervision sessions without discussing this with me and obtaining my explicit agreement.
Likewise, I will not record a session without discussing this with you and obtaining your explicit agreement.
The use of Heidi for real-time note-taking is covered separately above and by my Heidi consent process.
Your Data-Protection Rights
Depending on the circumstances and the lawful basis on which information is being processed, you have rights in relation to your personal information.
These may include the right to:
Be informed about how your information is used
Request access to the personal information I hold about you
Ask for inaccurate information to be corrected
Ask for incomplete information to be completed
Request erasure of information in certain circumstances
Request restriction of processing in certain circumstances
Object to certain types of processing
Request data portability where this right applies
Withdraw consent where processing is specifically based on consent
Not all of these rights apply in every circumstance. For example, I may need to retain some information because of legal, professional or insurance requirements even if you ask for it to be erased.
I will respond to a valid data-protection request within the timescale required by data-protection law, normally within one calendar month.
Concerns or Complaints About Your Information
If you have a question or concern about how I handle your personal information, please contact me in the first instance:
Lori Thackham
Out of the Blue Counselling and EFT Tapping
Tavistock, Devon
Email: enquiries@outofthebluecounselling.org
You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.
Changes To This Privacy Policy
I will review this Privacy Policy regularly and update it when my practice, the services I use, professional guidance or relevant data-protection requirements change.
The date of the most recent review will be shown at the top of this policy.