Legal Notice

Association of Christians in Counselling & Linked Professions

British Association of Counsellors and Psychotherapists. (BACP)

GDPR Statement Last updated: 19 June 2026

My Commitment to Your Privacy At Lifepath Resources.

 I believe that trust is at the heart of therapy. Protecting your personal information is an essential part of the safe, confidential space I create for our work together. This statement explains clearly how I, Sandy Cutts at Lifepath Resources do the following: 

1.    Collect, use, and protect your information in line with UK GDPR, the Data Protection Act 2018, and the Data (Use

       and Access) Act 2025.

2.    What Information I Collect When you work with me, I may collect and keep the following information: Your

       name and contact details (address, phone number, email) Emergency contact information

3.    Details about what brings you to therapy (your presenting issues)

4.    Session notes recording our work together – stored digitally on an external hard drive.

5.    Relevant medical or health history you share with me Information about your GP (if you choose to provide this)

6.    Payment and invoice details If you are under 18: details of your parent or guardian, and records relating to

       consent.

Why I Collect This Information :

I need to collect and use your information so that I can provide you with therapy. The legal reasons for this are: For general personal data: Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into an agreement, and I need your information to fulfil my side of that agreement. For health-related information: Because therapy often involves sensitive information about your mental or physical health, I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional legal condition is DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care). Working with Children and Young People A part of my practice involves working with children and young people under 18. I take particular care with young clients' information:

Consent: If you are under 13, I will always need a parent or guardian's consent before we begin working together. For young people aged around 12–16, I will assess whether you are able to give your own consent based on your understanding of what therapy involves (this is known as Gillick competence). In many cases, I will involve a parent or guardian in the consent process, but I will always discuss this with you first. Whose information is it? Even if a parent has given consent for therapy, the child or young person is the data subject. This means that if a parent asks to see their child's therapy records, I will consider carefully whether sharing that information is in the child's best interests. I will not automatically share records with parents, and I will always discuss any such request with the young person first where appropriate.

Keeping records longer: Because young people may wish to access their own records once they become adults, I keep records of clients who were under 18 until they reach the age of 25. This gives you time to request access when you are ready.

Professional Obligations and Supervision: As a BACP-registered therapist, I am required to discuss my clinical work in regular supervision. This is an essential part of maintaining high standards of care. Your identity is protected: I do not share your name or any identifying details with my supervisor. I use anonymised case material only — this means I might discuss the themes or challenges arising in our work, but my supervisor will not know who you are. My supervisor is also bound by their own professional body's confidentiality requirements.

Clinical Will Arrangements:  I am currently putting clinical will arrangements in place. A clinical will ensures that if I become suddenly unable to continue practising (due to serious illness, incapacity, or death), your records will be handled respectfully and confidentially by a nominated colleague. I will let you know once these arrangements are finalised.

Who Else May See Your Information Beyond myself:  the following people or services may have limited access to your information: Clinical supervisor: As explained above, my supervisor sees anonymised case material only. They do not have access to your name or identifying details.

Bookkeeping:  I manage my own bookkeeping using an online platform called Zoho Books which has no access to session notes or any clinical information. Only your name and email address is recorded on the system.

Digital service providers: I use IONOS to run my practice: IONOS hosts my website and I use Zoom for online sessions These providers process limited data (such as your name, email, or appointment times) and are bound by their own data protection obligations.

Statutory authorities: In rare circumstances, I may be legally required to share information with authorities such as the police, courts, or social services (see below).

When I Might Need to Break Confidentiality:  Confidentiality is fundamental to therapy, but there are rare situations where I may need to share information without your consent: If I believe there is a serious risk of harm to you or someone else If there are safeguarding concerns about a child or vulnerable adult If I receive a court order requiring me to disclose information Wherever possible, I will discuss this with you first and explain what I need to do and why.

How Long I Keep Your Records:  I keep your records in digital format for 7 years after our last session. This is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements. If you were under 18 when we worked together: I will keep your records until you reach the age of 25. This allows you to request access to your records as an adult if you wish. At the end of the retention period, I dispose of your records securely: Electronic records which are stored on an external hard drive are permanently deleted using secure deletion software.

Your Rights:  You have important rights over your personal information: See your records: You can ask to see what information I hold about you. I will respond within one month.

Correct mistakes: If any information I hold about you is wrong, you can ask me to put it right. Request deletion: In some circumstances, you can ask me to delete your records. However, I may need to keep certain information for legal, insurance, or safeguarding reasons — I will explain this clearly if it applies.

Object or restrict processing: You can ask me to stop using your information in certain ways, or to limit what I do with it.

Data portability: You can ask for a copy of your information in a format you can take elsewhere. If you are a young person, these are your rights — not just your parents' rights. I will always listen to you and take your views seriously.

Making a Complaint:  If you are unhappy with how I have handled your information, please talk to me first. I take complaints seriously and will do my best to resolve any concerns. You can contact me at: info@lifepathresources.co.uk