Privacy Policy

Last updated: April 2026  ·  Version 1.0

1. Who we are

Reflection Room is an online counselling and psychotherapy practice operated by three BACP-registered and ADMP UK-registered therapists: Lalida Puengklai, Ash Sachdev, and Bua Khemacheva. We can be contacted at reflectionroom.uk@gmail.com.

As we handle special category health data, we act as data controllers under UK GDPR.

2. What personal data we collect

We may collect and process the following categories of personal data:

• Full name and email address
• Phone number
• Emergency contact name and details
• Health information and therapy history (special category data)
• GP details where required by law or clinical necessity
• Payment information (bank transfer references only, we do not store card details)
• Session notes and clinical records
• Information you share during sessions or via our enquiry form

3. Legal basis for processing

We process your personal data under the following legal bases:

• Contract, to provide the counselling services you have engaged us for
• Legal obligation, to comply with UK law, including Safeguarding duties
• Legitimate interests, for administrative purposes such as scheduling and payment
• Explicit consent, for special category health data, obtained at the start of therapy

4. How we use your data

Your personal data is used only for the purposes of providing and administering your therapy. This includes:

• Communicating with you about appointments and enquiries
• Maintaining clinical records as required by our professional bodies (BACP and ADMP UK)
• Processing payment via bank transfer
• Contacting your emergency contact only in a genuine safety emergency
• Fulfilling our Safeguarding obligations under UK law

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5. How we store your data

Clinical notes and personal records are stored securely within our practice management system (Jane App), which uses encrypted cloud storage and complies with UK data protection standards. Communication takes place via Gmail (Google Workspace) and sessions are conducted via Google Meet, both of which operate under GDPR-compliant data processing agreements.

Access to your records is restricted to your treating therapist only.

6. How long we keep your data

In line with BACP guidance and UK data protection law, we retain client records for 7 years following the end of therapy (or 7 years after a minor turns 18, where applicable). After this period, records are securely deleted or destroyed.

7. Confidentiality and exceptions

Everything you share in sessions is held in strict confidence. However, we are legally and ethically required to break confidentiality in the following limited circumstances:

• Where there is a serious and immediate risk of harm to you or another person
• Where required by a court of law
• Where Safeguarding duties apply under the Children Act 1989 or the Care Act 2014

Where possible, we will discuss any disclosure with you before it is made.

8. Your rights

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you
• Rectification, request correction of inaccurate data
• Erasure, request deletion of your data, subject to our retention obligations
• Restriction, request that we limit how we use your data
• Portability, receive your data in a portable format
• Object, object to processing based on legitimate interests
• Withdraw consent, at any time, where processing is based on consent

To exercise any of these rights, please contact us at reflectionroom.uk@gmail.com. We will respond within one month.

9. Complaints

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to this policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated to active clients by email. The current version will always be available on this page.

11. Contact us

For any questions about this Privacy Policy or how we handle your data, please contact us at reflectionroom.uk@gmail.com.