Your Privacy and Data Protection

Last updated: 16 June 2026

At Explora Counselling, Psychotherapy and Coaching, your privacy, confidentiality, and trust are central to the therapeutic relationship. This page explains how your personal information is collected, used, stored, and protected, and outlines your rights under UK data protection law.

Explora Counselling, Psychotherapy and Coaching is registered with the Information Commissioner’s Office (ICO) (Registration Number: ZB499532) and operates in accordance with UK GDPR, the Data Protection Act 2018, and current UK data protection legislation, including the Data (Use and Access) Act 2025 where applicable.

1. Who I Am

I am Fabiola Toso, a qualified counsellor, psychotherapist and coach providing counselling, psychotherapy and coaching services through Explora Counselling, Psychotherapy and Coaching.

I am an accredited member of the British Association for Counselling and Psychotherapy (BACP), membership number 393760.

If you have any questions about this notice, please contact:

Email: fabiolatoso.counselling [at] gmail.com

2. What Personal Information I Collect

I may collect and process the following information:

Contact and administrative information

Name
Telephone number
Email address
Emergency contact details
GP details
Website contact form submissions
Appointment and payment information

Therapy and health information

Reasons for seeking counselling
Personal history and circumstances relevant to therapy
Emotional wellbeing, relationships, and mental health information
Physical health information where relevant
Medication or healthcare support (where relevant)
Session notes, assessments, and therapeutic records

Information relating to your health is classified as special category data under Article 9 UK GDPR and is subject to additional safeguards.

3. How Your Information Is Collected

Information is collected directly from you when you:

Contact me via email, phone, or website
Complete intake forms or questionnaires
Attend an initial consultation
Engage in ongoing therapy sessions
Communicate between sessions

I do not collect information about you from third parties unless required by law or safeguarding obligations.

4. Lawful Basis for Processing

Under UK GDPR, I must have a lawful basis to process your personal data.

General personal data

Processing is carried out under Article 6(1)(b) UK GDPR, where it is necessary for the performance of the therapeutic agreement between us.

Special category (health) data

Health-related data is processed under Article 9(2)(h) UK GDPR, for the provision of health or social care services, supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

5. Confidentiality

Everything you share in therapy is treated as confidential.

Information will only be shared without your consent in exceptional circumstances, including where:

There is a serious concern about your safety or the safety of another person
There are safeguarding concerns involving a child or vulnerable adult
Disclosure is required by law or a court order

Where possible, I will aim to discuss any disclosure with you first.

6. Clinical Supervision

As part of safe and ethical practice, I attend regular clinical supervision.

All supervision discussions are fully anonymised
No identifying information is shared
Supervisors are bound by confidentiality and professional ethics

7. Clinical Continuity (Clinical Will)

A professional clinical will arrangement is in place to ensure secure handling of client records in the event of serious illness, incapacity, or death.

Any appointed professional will be bound by strict confidentiality and data protection obligations.

8. Who Your Information May Be Shared With

Your personal data is never sold or used for marketing purposes.

Information may be processed by trusted data processors who support the delivery of services, including:

Wix (website hosting, security and functionality)
Google (Gmail for professional communications)
Zoom (online counselling sessions)

These providers only process data under my instruction and in accordance with UK GDPR.

9. International Data Transfers

Some service providers may process or store data outside the UK.

Where this occurs, appropriate safeguards are in place, including:

UK International Data Transfer Agreement (IDTA), and/or
Standard Contractual Clauses (SCCs)

These safeguards ensure your data remains protected in line with UK data protection law.

10. Data Retention

Your personal data is retained only for as long as necessary for legal, professional, and insurance purposes.

Adult therapy records: 7 years after the final session
Financial records: 6 years (HMRC requirement)
Website enquiries (non-clients): up to 12 months

After this period:

Paper records are securely shredded
Electronic records are permanently and securely deleted

11. How Your Information Is Stored

Appropriate technical and organisational measures are used to protect your data.

Electronic records

Password-protected systems
Encrypted storage where applicable
Restricted access

12. Your Rights Under UK GDPR

You have the right to:

Be informed about how your data is used
Request access to your data (Subject Access Request)
Request correction of inaccurate information
Request deletion (where legally possible)
Restrict or object to processing
Request data portability (where applicable)

Explora Counselling, Psychotherapy and Coaching does not use automated decision-making or profiling.

To exercise your rights, contact:

fabiolatoso.counselling [at] gmail.com

13. Cookies

This website is hosted by Wix, which uses cookies to ensure secure and reliable website functionality.

Essential cookies

These are required for the website to function and cannot be disabled.

Analytics cookies

Where enabled, these are used only with consent and provide anonymised information about website usage.

Explora Counselling, Psychotherapy and Coaching does not use cookies for advertising, behavioural tracking, or marketing profiling.

You may manage cookies via your browser settings at any time.

14. Data Protection Complaints

If you are concerned about how your personal data has been handled, please contact me first so I can address your concerns.

Fabiola Toso
Explora Counselling, Psychotherapy and Coaching
fabiolatoso.counselling [at] gmail.com

How complaints are handled

When a data protection complaint is received:

It will be acknowledged within 30 calendar days
It will be reviewed and investigated without undue delay
You may be contacted if further information is required
You will be kept informed where appropriate
A clear outcome will be provided once the investigation is complete

If you remain dissatisfied

You have the right to refer your complaint to the:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

You may contact the ICO at any time and are not required to wait for the outcome of the internal process.

15. Changes to This Notice

This notice may be updated periodically to reflect changes in law, professional guidance, or practice operations.

The “Last updated” date at the top of this page indicates the most recent version.

Make a Data Protection Complaint

If you believe Explora Counselling, Psychotherapy and Coaching has not handled your personal data in accordance with UK data protection law, you can use this form to submit a formal complaint.

Your complaint will be reviewed and investigated carefully. You will receive a response once the matter has been assessed.

If you are not satisfied with the outcome, you have the right to escalate your concern to the Information Commissioner’s Office (ICO).

Your Privacy and Data Protection

​

Make a Data Protection Complaint

​

​

​

​

​

​

​​

​

​

​​