top of page

Data Retention Policy

This policy explains how long I keep your personal information, why I retain it, and how I dispose of it securely. I am committed to keeping your data only for as long as necessary and handling it responsibly throughout.

1. Why I Retain Your Data

I keep records of our therapeutic work and related information for several important reasons:

  • Legal obligations — UK law requires me to retain certain records for specified periods, including tax and financial records under HMRC requirements

  • Professional standards — As a counsellor in private practice, I maintain records in accordance with the professional standards expected of counsellors and psychotherapists, including the common-law duty of confidence

  • Insurance requirements — My professional indemnity insurance requires me to retain records so that I can respond to any claims that might arise after therapy ends

  • Your ongoing care — Records may be needed if you return to therapy or require information about your previous sessions

  • Legal claims — The Limitation Act 1980 allows certain legal claims to be brought for several years after an event, and adequate records help protect both you and me

2. Retention Periods

Type of RecordRetention PeriodReason

Client therapy records (session notes, assessments, correspondence)7 years after your last sessionIn line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Enquiry and contact data (people who contact me but do not become clients)12 months from last contactTo respond to follow-up enquiries and manage my practice appropriately

Financial records and invoices6 years from the end of the financial yearHMRC legal requirement

Insurance records7 yearsProfessional indemnity insurance requirements

Website contact form submissions12 monthsUnless the enquiry leads to a client relationship, in which case the retention period for client records applies

3. What I Retain

The records I keep typically include:

  • Session notes — Brief records of our therapeutic work together

  • Contact details — Your name, address, telephone number, and email address

  • Assessment and intake information — Initial consultation notes and any forms you complete

  • Correspondence — Emails, letters, and text messages relating to your therapy

  • Payment records — Invoices and records of payments received

  • Contracts and consent forms — Your signed agreement to therapy and any consent documentation

4. How Your Data Is Stored

I take the security of your information seriously and store your records as follows:

Electronic records:

  • Stored on password-protected devices

  • Encrypted to protect against unauthorised access

  • Access restricted to me, Maria Schultz

Paper records:

  • Kept in a locked filing cabinet

  • Located in a secure room within my practice premises

  • Access restricted to me, Maria Schultz

I am currently putting clinical will arrangements in place to ensure your records are handled appropriately in the event of my incapacity or death. Once these arrangements are finalised, I will update this policy and inform clients accordingly.

5. Your Right to Erasure

Under UK GDPR, you have the right to request that I delete your personal data. However, this right is not absolute. I may need to retain your information where:

  • Retention is required for legal compliance (such as HMRC requirements for financial records)

  • Records are necessary to meet professional standards expected of counsellors in private practice

  • Retention is required for the establishment, exercise, or defence of legal claims

  • My professional indemnity insurance requires me to keep records

If you ask me to delete your data and I am unable to do so, I will always explain my reasons clearly and in plain language. Where partial erasure is possible, I will delete what I can while retaining only what is strictly necessary.

6. Secure Disposal

When your data reaches the end of its retention period, I dispose of it securely:

  • Paper records — Shredded 

  • Electronic records — Permanently deleted using secure deletion software that overwrites the data to prevent recovery

I review records regularly to ensure data is not kept longer than necessary.

7. Questions and Complaints

If you have any questions about how long I keep your data, or if you wish to make a complaint about my data retention practices, please contact me:

To submit a complaint:​

I will acknowledge your complaint within 7 days and aim to resolve it within 28 days.

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Telephone: 0303 123 1113

  • Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

​

bottom of page