Privacy Policy

Last updated: 22 June 2026

Who we are

Fern River is a therapy practice run by Dianne Harrison. I am registered with the Information Commissioner's Office (ICO) under registration number ------------.

If you have any questions about how we handle your personal data, please contact me at carima [at] --------------------------- (please replace [at] with @ when emailing).

What personal data we collect

We collect and process the following types of personal data:

Contact details: your name, address, telephone number, and email address
Emergency contact information: name and contact details of someone we can reach in an emergency
Health and therapy-related information: presenting issues, relevant medical history, GP details, current medications, and information about your mental and emotional wellbeing
Session notes: records of our therapeutic work together, including observations and progress
Financial records: invoices and payment information
Enquiry details: information you provide when contacting us through our website contact form

Important: Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and we may only process it under specific conditions set out in law.

How we collect your data

We collect personal data directly from you:

When you first contact us (by telephone, email, or through our website contact form)
During your initial consultation and intake assessment
Throughout our therapeutic sessions together
Through ongoing communication between sessions

We do not collect personal data about you from third parties unless you have given explicit consent for this, or where you are referred through an Employee Assistance Programme.

Why we process your data — lawful basis

Under UK data protection law, we need a lawful basis to process your personal data. Because therapy involves health-related information, we rely on two separate legal bases:

Article 6 basis (general personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. This means we need to process your data to provide the therapy service you have engaged us for.

Article 9 basis (special category health data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care). Processing is carried out by a qualified counsellor/psychotherapist subject to the professional obligation of confidentiality under the BACP Ethical Framework for the Counselling Professions.

Professional obligations and CPD

We are required by BACP to attend regular clinical supervision as part of our professional practice. We may discuss our therapeutic work with our supervisor to ensure we are providing you with the best possible care.

When we do so:

Your name and any identifying details are not shared with our supervisor
We use anonymised or pseudonymised case material only
Our clinical supervision is provided by a qualified professional bound by the same confidentiality obligations as we are
Our supervisor is bound by their own professional code of ethics and practice

Clinical supervision is a professional requirement that helps us reflect on our practice and ensures the quality of the therapy we provide.

Clinical will — what happens to your records if we are unable to practise

We are currently putting arrangements in place for a clinical will. A clinical will ensures that if we become unexpectedly unable to continue practising (due to serious illness, incapacity, or death), your records will be handled securely and confidentially by a nominated professional colleague.

Once these arrangements are complete, we will update this policy and inform clients of the details.

Who we share your data with

We take your confidentiality seriously and keep the sharing of your data to a minimum. The following people or services may have access to your personal data:

Clinical supervisor: receives anonymised case material only — your name and identifying details are never shared
External accountant or bookkeeper: has access to invoice data only for accounting purposes
Employee Assistance Programme (EAP): where you are referred to us through an EAP, limited information may be shared as part of the commissioning arrangement
External IT support: may have incidental access to data during system maintenance

We also use the following third-party services which may process your data:

Sentry — error monitoring for our website
Wix — website hosting platform
Zoom — video session platform
Microsoft Teams — video session platform
Google Meet — video session platform
Calendly — appointment scheduling

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

We never sell your personal data.