At Awaken Discovery, I am committed to protecting your privacy and safeguarding your personal information. Whether you are exploring therapy, accessing a resource or engaging with my services, your information is treated with care, respect and transparency.
This Privacy Policy explains how I collect, use, store, share and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, international data protection laws.
This policy applies to:
- Clients and prospective clients
- Website visitors
- Individuals engaging with my content, services, products or online spaces
01Data Controller
Awaken Discovery is operated by Allyson Donoghue, who is the Data Controller responsible for your personal data.
Awaken Discovery operates in accordance with applicable professional, ethical and legal obligations, including those required by relevant professional membership bodies and insurers.
02Personal Information I Collect
I only collect information that is necessary to provide safe, ethical and effective services. This may include:
- Name, email address, telephone number
- Emergency contact details or next of kin information
- GP or healthcare provider contact details
- Relevant health, medical and wellbeing information
- Counselling and psychotherapy notes, assessments and correspondence
- Session records and professional observations
- Payment and invoicing details, where applicable
- Payment transaction references and financial records necessary for accounting, taxation and service administration purposes
Payment information may be processed through my banking and payment providers, including Co-operative Bank, Mettle and Stripe. While Awaken Discovery records payment references, invoices and transaction details necessary for service delivery and accounting purposes, banking and payment providers process personal and financial information in accordance with their own Privacy Policies, regulatory obligations and UK GDPR requirements.
Where services are provided to children or young people, personal information may also be collected from parents, guardians or other individuals with parental responsibility where appropriate and lawful to do so.
Some of this information is classified as special category data under UK GDPR (for example, health and medical information). Because this data is particularly sensitive, it is subject to enhanced legal protection.
I take additional care to ensure it is processed lawfully, confidentially and securely, and only where necessary for the provision of care.
03Lawful Basis for Processing
Under UK GDPR, I rely on the following lawful bases:
- Contract — to provide counselling and psychotherapy services agreed with you.
- Consent — for processing certain sensitive information and for sending non-essential communications or marketing materials (explicit opt-in only).
- Legal obligation — to meet safeguarding duties, insurance requirements or professional record-keeping obligations.
- Vital interests — where processing is necessary to protect your life or the life of another person in an emergency.
- Legitimate interests — for managing, maintaining and improving my services, where this does not override your rights.
Personal data is generally processed under Article 6(1)(b) UK GDPR(performance of a contract).
Special category data (including health-related information) is processed under Article 9(2)(h) UK GDPR (provision of health or social care), in line with professional ethical frameworks, and/or explicit consent where required.
04How I Use Your Information
Your personal data is used to:
- Provide safe, ethical and effective counselling and psychotherapy services
- Communicate with you regarding appointments, changes or relevant information
- Maintain accurate, lawful and confidential client records
- Meet professional, ethical and insurance requirements
- Monitor and improve my services
- Share service updates, resources, events or promotions only where you have explicitly opted in
Information submitted through website contact forms will be used solely for the purpose of responding to your enquiry, arranging services or providing information you have requested.
Where you request a free resource, guide, workbook or downloadable content, the information you provide will only be used for the purpose explained at the point of collection. Receiving a resource does not automatically subscribe you to marketing communications unless you have explicitly consented to this.
Awaken Discovery does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
Important
Accessing a service or downloading a resource does not automatically subscribe you to marketing communications. You will only receive these where you have provided clear, explicit consent.
You may withdraw consent for non-essential communications at any time.
05Email Communications and Marketing
Email sign-ups, resource requests, contact messages and similar communications on this website are collected through website forms (and, where still in use, Fillout forms — for example DSAR requests). Where you have opted in or submitted your details, that information may be used to send you emails relating to the service or resource you requested.
Newsletter and free-resource emails are managed with Mailchimp. When you sign up for a guide or newsletter (including via the contact form), your details are added to the relevant Mailchimp audience so we can deliver the resource and supportive follow-up emails.
Contact-form messages and internal signup notifications are sent using Resend.
Where you choose to receive emails:
- You will be asked for clear, explicit consent (no pre-ticked boxes)
- Your consent is recorded and stored securely
- You can unsubscribe at any time via the link provided in every email
Emails may include:
- Reflections and wellbeing resources
- Service updates
- Events, offers or relevant content
06Disclosure and Sharing of Information
I do not sell your personal data.
Your information may be shared only:
- With your explicit consent
- Where required by law (e.g. safeguarding concerns or court orders)
- Where there is a risk of serious harm to you or others
- With professional advisors, insurers, supervisors or secure service providers (such as email, booking or record-keeping platforms), strictly for the purpose of delivering services
Clinical supervision forms part of safe, ethical and professional counselling practice. Limited information relating to client work may be discussed with a clinical supervisor for the purposes of professional support, quality assurance, safeguarding and ethical practice.
Wherever possible, information is anonymised or pseudonymised and reasonable steps are taken to ensure clients cannot be identified unless disclosure is legally or ethically required.
While confidentiality is maintained wherever possible, there may be circumstances in which information must be disclosed without consent, including where required by law, safeguarding concerns, risk of serious harm, prevention of serious crime, or professional and ethical obligations.
All third parties are required to handle your data lawfully, securely and in line with data protection obligations.
07Transfers Outside the UK
Some systems I use (including cloud storage, email platforms or booking systems — for example Microsoft and Google) may store or process data outside the UK.
Where data is transferred internationally, appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent protections, to ensure your data remains protected.
08Data Security and Storage
I take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure or destruction, with support from OnTech.
Data is stored:
- Electronically on secure, password-protected systems with encryption and, where available, two-factor authentication
- In paper format within locked and secure storage
Financial transactions are processed through regulated banking and payment providers, including Co-operative Bank, Mettle and Stripe. These organisations act as independent Data Controllers for the information they process and are required to comply with UK GDPR, the Data Protection Act 2018 and relevant financial regulations.
OnTech provides technical support and website services where required and is contractually required to handle any personal data securely and in accordance with applicable data protection legislation.
Email communications are managed through a secure third-party email marketing provider, Mailchimp. Information provided for newsletters, guides, resources, courses and subscriptions will only be used for the purposes described and may be stored securely by that provider in accordance with applicable data protection legislation.
For details of how Awaken Discovery uses AI-assisted and digital tools, see Artificial Intelligence (AI) and Digital Tools below.
Awaken Discovery only accesses and retains payment information necessary for invoicing, bookkeeping, taxation and service administration purposes.
09Artificial Intelligence (AI) and Digital Tools
Awaken Discovery uses a limited range of digital and AI-assisted tools to support appropriate administrative, writing, educational, professional-development and business activities. These may include Microsoft Word and Microsoft 365 features, Windows Copilot and ChatGPT/OpenAI.
AI is used as a supporting tool and does not replace professional judgement, clinical decision-making, therapeutic assessment, safeguarding decisions, supervision or my professional responsibilities.
09AUse of AI with client information
Counselling and psychotherapy involve confidential information and may involve special category personal data, including information concerning a person's physical or mental health. Such information is subject to additional protection under UK data-protection law.
Awaken Discovery follows the principles of data minimisation, purpose limitation, confidentiality, security and accountability when considering the use of AI. Only information that is adequate, relevant and necessary for a specified purpose should be processed.
I do not intentionally submit identifiable client clinical records, session notes, assessments, formulations, client correspondence or other identifiable confidential clinical information to general-purpose AI tools for analysis, summarisation, rewriting or generation.
AI tools are not used to make decisions about a client's suitability for therapy, diagnosis, treatment, safeguarding, referral or other significant clinical matters.
Where information is used with an AI tool for legitimate professional, educational or business purposes, it will be appropriately anonymised and minimised wherever possible so that an individual client cannot reasonably be identified.
If a proposed future use of AI would involve processing identifiable client information, I will first consider whether the proposed processing is lawful, necessary and proportionate and whether appropriate safeguards are in place. This includes consideration of confidentiality, data minimisation, security, accuracy, transparency, the nature and sensitivity of the information, the AI provider's terms and data-processing arrangements, and whether a documented risk assessment or Data Protection Impact Assessment is required.
09BMicrosoft Word, OneDrive and Windows Copilot
Awaken Discovery uses Microsoft Word and Microsoft OneDrive through a Microsoft 365 Family subscription and a personal Microsoft account.
Some Microsoft services and Windows features include AI-assisted functionality. Windows Copilot may display recently used files as part of the Windows recent-file experience. The appearance of a document in a recent-file list does not, by itself, mean that the contents of the document have been uploaded to or analysed by Copilot.
Awaken Discovery does not intentionally use Copilot to analyse, summarise, rewrite or generate content from identifiable client clinical records.
Clinical records are created and stored in Microsoft Word and OneDrive as part of the normal clinical record-keeping process. AI functionality is not intentionally used to process those records.
Microsoft's products and functionality may change over time. Where new AI functionality becomes available within software used by Awaken Discovery, its use will be considered in accordance with confidentiality, UK data-protection requirements, professional obligations and the principles set out in this Privacy Notice.
09CChatGPT / OpenAI
ChatGPT/OpenAI is used by Awaken Discovery for business development, website and resource development, educational work, professional development, research, drafting, editing and other non-clinical purposes.
Identifiable client information is not intentionally entered into ChatGPT for the purpose of obtaining clinical advice, generating clinical records, analysing identifiable client material or making decisions about clients.
Where professional or educational material is discussed using ChatGPT, it will be appropriately anonymised and minimised wherever possible so that an individual client cannot reasonably be identified.
10Data Retention
Awaken Discovery retains personal information only for as long as it is necessary for the purpose for which it was collected, taking account of professional, legal, regulatory, safeguarding, insurance and business requirements.
Because counselling and psychotherapy records may be required to demonstrate the care provided, respond to complaints, establish or defend legal claims and maintain professional and insurance protection, clinical records are retained in accordance with the applicable requirements of my professional practice and insurance policy.
10AClinical and therapy records
Under the current record-keeping requirements of Balens professional insurance:
- Adult client records: retained for a minimum of 7 years following the last occasion on which treatment was provided.
- Young people/minors: retained for a minimum of 7 years after the client reaches the age of 18, ordinarily meaning until at least their 25th birthday.
- Vulnerable adults: records may need to be retained for longer than seven years where there may be extended limitation periods or other circumstances requiring longer retention.
- Complaints, claims, safeguarding matters, legal proceedings or other matters requiring evidence: relevant records may be retained for longer where this is necessary to establish, exercise or defend legal rights or comply with a legal or professional obligation.
These periods are minimum retention periods and do not mean that every record will automatically be destroyed immediately when the minimum period expires.
At the end of the applicable retention period, records will be reviewed and securely destroyed or permanently deleted where there is no continuing lawful reason to retain them.
Where records are retained beyond the usual retention period, the reason for doing so will be considered and, where appropriate, documented.
10BEnquiry and prospective-client information
Information provided by people who contact Awaken Discovery but do not become clients will normally be retained only for as long as reasonably necessary to respond to the enquiry, manage the relationship and deal with any resulting administrative, legal or professional requirements.
10CFinancial and business records
Financial, payment, accounting and business records are retained for the period required by applicable legal, tax, accounting, insurance or other regulatory requirements.
10DDigital information and AI services
Awaken Discovery does not intentionally use general-purpose AI systems as a repository for clinical records.
Where AI-assisted tools are used for non-clinical purposes, personal information will not be retained within those tools unnecessarily. Any personal information processed through an AI-enabled service will be subject to the same principles of necessity, data minimisation, security and retention described in this Privacy Notice.
Where a third-party service has its own retention arrangements, these will be considered when determining whether and how that service is appropriate for Awaken Discovery's purposes.
10ESecure disposal
When personal information is no longer required, it will be securely destroyed, permanently deleted or otherwise disposed of in a manner appropriate to the sensitivity of the information.
The destruction of clinical records will not take place where there is a known or reasonably anticipated complaint, claim, safeguarding matter, legal requirement, regulatory requirement, insurance requirement or other legitimate reason for continued retention.
Retention periods and this Privacy Notice will be reviewed periodically to ensure that they remain appropriate and consistent with applicable professional, insurance and data-protection requirements.
11Your Data Protection Rights
Under UK GDPR, you have the right to:
- Access a copy of your personal data
- Request correction of inaccurate or incomplete data
- Request erasure of your data (in certain circumstances)
- Request restriction of processing
- Object to processing, where applicable
- Request data portability (where relevant)
- Withdraw consent at any time
You also have the right to lodge a complaint with the Information Commissioner's Office.
Website: www.ico.org.uk
Telephone: 0303 123 1113
If you are dissatisfied with how your personal information has been handled, I encourage you to contact me first so that I have the opportunity to investigate and resolve your concerns.
Data protection enquiries, requests and complaints can be submitted:
- By email to awakendiscoverytherapy@gmail.com
- Via the Contact Form on the Awaken Discovery website
I will acknowledge receipt of your complaint within 30 calendar days and aim to provide a response as promptly as reasonably possible.
If you remain dissatisfied following my response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Submit a data rights request
To exercise any of the rights above — access, correction, erasure, restriction, objection, portability or withdrawal of consent — please complete the form below. I'll respond within the time frame required by UK GDPR (usually within one month).
11AData Rights Requests and Complaints
Individuals may exercise their UK GDPR rights or raise concerns regarding privacy, confidentiality or data protection by contacting Awaken Discovery using the details provided in this policy.
Requests may include:
- Access to personal data
- Correction of inaccurate information
- Deletion requests where applicable
- Restriction of processing
- Withdrawal of consent
- Objections to processing
Requests will normally be responded to within one calendar month in accordance with UK GDPR requirements.
Subject Access Requests should be submitted in writing using the contact details provided within this policy.
Identity verification may be required before information is disclosed.
12International Users
If you are accessing services from outside the UK, you may have additional rights under your local data protection laws. These rights will be respected where applicable.
14Data Breaches
In the unlikely event of a data breach, appropriate steps will be taken to assess, contain and resolve the issue.
Where required, this will be reported to relevant authorities and affected individuals in line with legal obligations.
15Changes to This Privacy Policy
I may update this Privacy Policy to reflect legal, professional or operational changes. Any significant updates will be published on my website.
16Complaints Procedure
Awaken Discovery is committed to handling concerns fairly, respectfully and transparently.
If you have a complaint relating to privacy, confidentiality or the handling of your personal data, the process below explains what to expect.
Submit your complaint
Please provide:
- Your name
- Contact details
- Details of your concern
- Relevant dates
- Any supporting information
Complaints can be submitted by email or through the website contact form.
Acknowledgement
Your complaint will be acknowledged within 30 calendar days of receipt.
Investigation
The concern will be reviewed and, where necessary, further information may be requested.
Outcome
A written response outlining the findings and any actions taken will be provided.
Escalation
If you remain dissatisfied, you may contact the Information Commissioner's Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
The ICO is the UK's independent authority responsible for upholding information rights and data protection law.
17Contact
If you have any questions, concerns, requests, data protection enquiries or complaints regarding this Privacy Policy or your personal data, please contact:
Data protection and privacy enquiries:
awakendiscoverytherapy@gmail.com
Website contact form:
awakendiscovery.co.uk/contact
Last updated: August 2026
Next review date: June 2027
This Privacy Policy should be read alongside the Awaken Discovery Terms & Conditions and Disclaimer.