Your Privacy and Data Protection

Explora Counselling, Psychotherapy and Coaching

Last reviewed: 1 November 2026

At Explora Counselling, Psychotherapy and Coaching, your privacy, confidentiality and trust are central to the therapeutic relationship.

I understand that sharing personal information, particularly information about your emotional wellbeing, mental health and personal circumstances, requires trust. I am committed to treating your information with care, respect and confidentiality.

This Privacy and Data Protection Notice explains what personal information I collect, why I collect it, how it is stored and protected, when it may be shared, and what rights you have in relation to your information.

Explora Counselling, Psychotherapy and Coaching is registered with the Information Commissioner's Office (ICO), registration number ZB499532.

I work in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection legislation.

My professional practice is also guided by the British Association for Counselling and Psychotherapy (BACP) Ethical Framework for the Counselling Professions 2026.

1. Who I Am

I am Fabiola Toso, a qualified counsellor, psychotherapist and coach providing counselling, psychotherapy and coaching services through Explora Counselling, Psychotherapy and Coaching.

I am an accredited member of the British Association for Counselling and Psychotherapy (BACP).

BACP membership number: 393760

I am the data controller responsible for determining how and why your personal information is collected and processed in connection with the services I provide.

If you have any questions about this Privacy Notice or how your information is handled, please contact me:

Email: fabiolatoso.counselling [at] gmail.com

2. What Personal Information I Collect

I only collect personal information that is relevant and necessary for the provision and administration of my services.

Depending on the nature of our work together, this may include the following.

Contact and administrative information

Name and contact details.
Telephone number and email address.
Emergency contact details, where appropriate.
GP or healthcare professional details, where relevant.
Website contact form submissions.
Appointment and attendance information.
Payment and invoicing information.
Relevant communications relating to appointments and our work together.

Therapeutic and health information

Reasons for seeking counselling, psychotherapy or coaching.
Personal history and circumstances relevant to the work.
Emotional wellbeing and mental health information.
Information about relationships, family and significant life events.
Physical health information, where relevant.
Medication and healthcare support information, where relevant.
Risk assessments and safeguarding information, where necessary.
Session notes, assessments and other relevant therapeutic records.

Information relating to your physical or mental health is classified as special category personal data under Article 9 UK GDPR and receives additional legal protection.

I take particular care to ensure that sensitive information is collected, used and retained only where necessary for the provision of services and my professional responsibilities.

3. How Your Information Is Collected

Your personal information may be collected directly from you when you:

Contact me by email, telephone or through my website.
Complete intake forms or questionnaires.
Attend an initial consultation.
Participate in counselling, psychotherapy or coaching sessions.
Communicate with me between sessions.
Make payments or arrange appointments.

In some circumstances, information may also be received from third parties, such as healthcare professionals, emergency contacts or other relevant individuals.

This will only occur where necessary and appropriate, for example in connection with safeguarding, the provision of services or a legal obligation.

Where personal information is obtained from another source, I will provide the relevant privacy information as required by data protection law, unless a lawful exemption applies.

4. Lawful Basis for Processing

Under UK GDPR, I must have a lawful basis for processing personal information.

I identify the appropriate lawful basis according to the purpose for which the information is being processed.

General personal information

Depending on the circumstances, I may rely on:

Article 6(1)(b) – Contract: Where processing is necessary to enter into or fulfil the therapeutic or service agreement between us.
Article 6(1)(f) – Legitimate interests: Where processing is necessary for legitimate business and professional purposes, provided these interests are not overridden by your rights and freedoms.
Article 6(1)(c) – Legal obligation: Where processing is necessary to comply with a legal requirement.

Special category personal information

Information relating to your physical or mental health is processed under an applicable condition in Article 9 UK GDPR.

For the provision of counselling, psychotherapy and associated health or social care services, the relevant condition may be:

Article 9(2)(h) – Health or social care, supported by the applicable provisions of Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, where the statutory requirements are met.

Where appropriate, another applicable Article 9 condition may be used, such as explicit consent under Article 9(2)(a).

The appropriate condition depends on the nature of the processing and the legal and professional circumstances in which the services are provided.

I ensure that the lawful bases and conditions relied upon are documented and reviewed as necessary.

5. Confidentiality

Confidentiality is fundamental to the therapeutic relationship.

Everything you share in counselling, psychotherapy or coaching is treated with respect and confidentiality.

I will not routinely share information about you with family members, friends, employers, GPs or other professionals without your agreement.

However, confidentiality is not absolute.

There may be exceptional circumstances where information needs to be disclosed without your consent, including:

Where there is a serious and immediate concern about your safety or the safety of another person.
Where there are significant safeguarding concerns involving a child or an adult at risk.
Where disclosure is necessary to prevent serious harm.
Where disclosure is required by law, a court order or another applicable legal obligation.
Where disclosure is otherwise legally permitted and ethically justified.

Any decision to disclose information will be carefully considered, taking account of the circumstances, applicable legal requirements and my professional and ethical responsibilities.

Where information needs to be shared, I will aim to disclose only what is necessary and proportionate.

Wherever possible and appropriate, I will discuss a proposed disclosure with you beforehand, unless doing so would increase risk, compromise safeguarding or otherwise be inappropriate.

6. Clinical Supervision

Regular clinical supervision is an essential part of safe, effective and ethical practice.

I attend professional supervision to reflect on my work, consider clinical and ethical issues, maintain professional standards and ensure that clients receive an appropriate standard of care.

Information relating to therapeutic work may be discussed with my clinical supervisor for these purposes.

I use anonymised or pseudonymised information wherever reasonably possible and take care to minimise the information shared.

Where identifiable information needs to be discussed, this will be handled in accordance with applicable confidentiality obligations, data protection requirements and any relevant lawful justification.

My clinical supervisor is expected to maintain appropriate professional confidentiality and data protection standards.

7. Clinical Continuity (Clinical Will)

I have established a professional clinical will arrangement to support the continuity of care and the secure handling of client records in the event of serious illness, incapacity or death.

An appointed professional clinical executor is responsible for carrying out the necessary arrangements.

In these circumstances, the clinical executor may need to access relevant client records for the limited purpose of:

Contacting clients where necessary.
Informing clients of any interruption or ending of services.
Supporting appropriate professional continuity.
Helping clients make alternative therapeutic arrangements.
Ensuring the secure and appropriate handling of client records.

The clinical executor is bound by appropriate confidentiality and data protection obligations.

Access to personal information will be restricted to what is necessary for these purposes.

8. Who Your Information May Be Shared With

Your personal information is never sold or used for marketing purposes.

I use a small number of trusted service providers to support the administration and delivery of my services.

These providers may process limited personal information as necessary to provide their services.

Clinical records and practice management – Kiku

Kiku is my sole clinical records and practice management system.

It is used to securely maintain relevant client information, including contact details, appointments, clinical notes and other therapeutic records.

Kiku publishes information about its security arrangements, including encryption, password protection, two-factor authentication and secure hosting through Amazon Web Services in Ireland.

Access to clinical information is restricted and subject to the provider's security arrangements.

Professional communications – Gmail

Gmail is used for professional email communications and administrative correspondence.

Personal information shared through email is treated confidentially and handled in accordance with applicable data protection requirements.

Online sessions – Zoom

Zoom is used exclusively to provide live online counselling, psychotherapy and coaching sessions.

Sessions are not recorded.

I do not use automated transcription, AI-generated session summaries or AI Companion features.

Zoom may process technical and connection information necessary to provide its online meeting service.

Website hosting – Wix

Wix hosts the Explora website and may process limited personal information through website contact forms, cookies and other website functionality.

I take reasonable steps to ensure that service providers handling personal information provide appropriate security and confidentiality protections.

Where a provider acts as a data processor on my behalf, appropriate contractual data protection arrangements are maintained.

Some providers may also act as independent data controllers for particular aspects of their services.

9. International Data Transfers

Some service providers may process or store personal information outside the United Kingdom.

For example, Kiku publishes that its application is hosted using Amazon Web Services infrastructure in Ireland.

Where personal information is transferred outside the UK, I ensure that the transfer is handled in accordance with applicable UK data protection legislation.

Depending on the destination and circumstances, this may involve:

UK adequacy regulations.
The UK International Data Transfer Agreement (IDTA).
The UK Addendum to the EU Standard Contractual Clauses.
Other appropriate transfer mechanisms permitted under UK GDPR.

Where required, appropriate assessments and safeguards are put in place to protect personal information.

Further information about international data transfers and relevant safeguards can be requested by contacting me.

10. Data Retention

I retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet relevant legal, professional, safeguarding and insurance obligations.

My retention periods are as follows:

Adult clinical records
Adult therapy records are retained for seven years following the final session.
Financial records
Financial and accounting records are retained for the periods required by applicable HMRC and other legal requirements. This is generally six years for relevant business records, although specific requirements may differ.
Website enquiries and non-client information
Website enquiries and general correspondence from individuals who do not become clients are retained for up to 12 months, unless a longer period is necessary for a legitimate or legal purpose.

Other records

Information relating to complaints, safeguarding matters or legal issues may need to be retained for longer where justified by the circumstances and applicable obligations.

Retention periods are reviewed periodically.

When information is no longer required:

Paper records are securely destroyed.
Electronic records are securely deleted or disposed of through appropriate procedures.

Where information remains in secure backups, it will be managed in accordance with the relevant provider's backup and deletion arrangements.

11. How Your Information Is Stored and Protected

Protecting your personal information is a priority.

I use appropriate technical and organisational measures to protect information against unauthorised access, loss, alteration, disclosure or destruction.

Clinical records

All clinical records are maintained within Kiku, my sole clinical records and practice management system.

Kiku publishes information about its encryption, access controls, password protection, two-factor authentication and backup arrangements.

Its application is hosted through Amazon Web Services in Ireland.

Professional correspondence

Professional email correspondence and administrative information may be held within Gmail.

Security measures

My information security arrangements include appropriate measures such as:

Secure, password-protected accounts and devices.
Two-factor authentication where available.
Restricted access to personal and clinical information.
Appropriate encryption and secure communication arrangements.
Careful handling of sensitive electronic correspondence.
Secure destruction and deletion of information when no longer required.

I regularly review my information security arrangements to ensure they remain appropriate for the nature and sensitivity of the information held.

Personal data breaches

In the unlikely event of a personal data breach, I will take appropriate steps to contain, assess and investigate the incident.

Where legally required, the Information Commissioner's Office will be notified within the applicable statutory timescale, generally within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to your rights and freedoms, you will also be informed without undue delay, as required by law.

12. Your Rights Under UK GDPR

You have a number of rights concerning your personal information.

Depending on the circumstances, these include:

Right to be informed

You have the right to understand how your personal information is collected, used, stored and shared.

Right of access

You can request a copy of the personal information I hold about you. This is known as a Subject Access Request.

Right to rectification

You can ask for inaccurate or incomplete personal information to be corrected.

Right to erasure

You can request the deletion of personal information in certain circumstances.

However, this right is not absolute. Some information may need to be retained to meet legal, professional, safeguarding or insurance obligations.

Right to restrict processing

You can request that the use of your personal information is restricted in certain circumstances.

Right to object

You can object to certain types of processing, depending on the lawful basis relied upon.

Right to data portability

Where applicable, you can request that certain personal information is provided to you or transferred to another organisation in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn. Information may still need to be retained where another lawful basis or legal obligation applies.

These rights are subject to certain legal limitations and exemptions.

To exercise your rights or ask questions about your personal information, please contact:

fabiolatoso.counselling [at] gmail.com

I will respond in accordance with the applicable legal requirements.

13. Cookies

The Explora website is hosted by Wix.

The website may use cookies and similar technologies to support essential website functionality, security and, where enabled, analytics.

Essential cookies

These are necessary for the website to function correctly and securely.

Analytics cookies

Where analytics cookies are used, they help provide information about website usage and performance.

Non-essential cookies will only be used where the required consent has been obtained.

The website does not intentionally use cookies for advertising, behavioural advertising or marketing profiling.

You can manage your cookie preferences through the website's cookie consent mechanism, where available.

You may also manage cookies through your browser settings.

Further information about the cookies used on the website is available through the relevant cookie information provided by Wix and the website's cookie settings.

14. Data Protection Complaints

If you are concerned about how your personal information has been collected, used, stored or shared, you have the right to raise a data protection complaint directly with me.

I take all data protection concerns seriously and will handle complaints fairly, confidentially and without undue delay.

How to make a complaint

You can submit a data protection complaint by contacting:

Fabiola Toso
Explora Counselling, Psychotherapy and Coaching
Email: fabiolatoso.counselling@gmail.com

How complaints are handled

When a data protection complaint is received:

Receipt will be acknowledged within 30 calendar days.
The complaint will be reviewed and investigated without undue delay.
Appropriate enquiries will be made to establish the circumstances.
You may be contacted if further information is required.
You will be kept informed of progress where appropriate.
A clear outcome will be communicated without undue delay.

Where appropriate, steps will be taken to resolve the issue and prevent similar concerns arising in the future.

If you remain dissatisfied

If you are unhappy with how your personal information has been handled, you have the right to complain directly to the Information Commissioner's Office (ICO).

You may contact the ICO at any time. You do not have to complete my internal complaints process before contacting them.

Information Commissioner's Office (ICO)

Website: https://ico.org.uk

Telephone: 0303 123 1113

15. Changes to This Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in legislation, professional guidance, technology or the way I operate my practice.

Where significant changes are made that affect how your personal information is processed, appropriate information will be provided.

The date at the top of this notice indicates when it was last reviewed or updated.

If you have any questions about this notice or your personal information, please contact me:

Fabiola Toso
Explora Counselling, Psychotherapy and Coaching
fabiolatoso.counselling [at] gmail.com

Make a Data Protection Complaint

If you believe Explora Counselling, Psychotherapy and Coaching has not handled your personal information in accordance with applicable data protection legislation, you can submit a formal data protection complaint.

Your complaint will be acknowledged within 30 calendar days and investigated without undue delay.

Please provide sufficient information to help me understand your concern and investigate the matter appropriately.

You will be kept informed where appropriate and will receive a clear outcome once the investigation has been completed.

If you remain dissatisfied, you have the right to refer your complaint to the Information Commissioner's Office (ICO).