Privacy Policy

At Awaken Discovery, I am committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how I collect, use, store, share, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to:

• Clients and prospective clients
• Website visitors
• Individuals engaging with my content, services, products, or online spaces

1. Data Controller

Awaken Discovery is operated by Allyson Donoghue, who is the Data Controller responsible for your personal data.
Email: awakendiscoverytherapy@gmail.com

2. Personal Information I Collect

I collect personal data that you provide when you contact me, book a session, complete forms, engage in therapy, or interact with my services. This may include:

• Name, email address, telephone number
• Emergency contact details or next of kin information
• GP or healthcare provider contact details
• Relevant health, medical, and wellbeing information
• Counselling and psychotherapy notes, assessments, and correspondence
• Session records and professional observations
• Payment and invoicing details, where applicable

Some of this information is classed as special category data under UK GDPR (for example, health and medical information). Because this data is particularly sensitive, it is subject to enhanced legal protection. I take additional care to ensure it is processed lawfully, confidentially, and securely, and only where necessary for the provision of care.

3. Lawful Basis for Processing

Under UK GDPR, I rely on the following lawful bases to process your personal data:

• Contract – to provide counselling and psychotherapy services agreed with you
• Consent – for processing certain sensitive information and for sending non-essential communications or marketing materials (explicit opt-in only)
• Legal obligation – to meet safeguarding duties, insurance requirements, or professional record-keeping obligations
• Vital interests – where processing is necessary to protect your life or the life of another person in an emergency
• Legitimate interests – for managing, maintaining, and improving my services, where this does not override your rights

Personal data is generally processed under Article 6(1)(b) UK GDPR (performance of a contract).
Special category data (including health-related information) is processed under Article 9(2)(h) UK GDPR, which permits processing for the provision of health or social care, and in line with professional confidentiality and ethical obligations (including those of BACP and NCPS), and/or explicit consent where required.

4. How I Use Your Information

Your personal data is used to:

• Provide safe, ethical, and effective counselling and psychotherapy services
• Communicate with you regarding appointments, changes, or relevant information
• Maintain accurate, lawful, and confidential client records
• Meet professional, ethical, and insurance requirements
• Monitor and improve my services
• Share service updates, events, or promotions, where you have opted in

You may withdraw consent for non-essential communications at any time by contacting me directly.

5. Disclosure and Sharing of Information

I do not sell your personal data.
Your information may be shared only:

• With your explicit consent
• Where required by law, such as safeguarding concerns or court orders
• With professional advisors, insurers, supervisors, or secure service providers (for example, secure email, booking, or record-keeping platforms), strictly for the purpose of delivering services and always under confidentiality and data protection obligations

All third parties are required to handle your data lawfully and securely.

6. Transfers Outside the UK

Some systems I use (including Google, Microsoft, and Apple) may store or process data outside the UK.
Where data is transferred internationally, I ensure appropriate safeguards are in place, such as UK-approved Standard Contractual Clauses (SCCs) or equivalent legal protections, to ensure your data remains protected in line with UK GDPR standards.

7. Data Security and Storage

I take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, or destruction.
Data is stored:

• Electronically on secure, password-protected systems with encryption and, where available, two-factor authentication
• In paper format within locked and secure storage

Data Retention
In line with professional and insurance guidance:

• Client records are retained for 7 years after the end of therapy
• For clients under 18, records are retained until the 25th birthday

After these periods, data is securely destroyed.

8. Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access a copy of the personal data I hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data (in certain circumstances)
• Request restriction of processing
• Object to processing, where applicable
• Data portability, where legally relevant
• Withdraw consent at any time, where consent is the lawful basis
• Lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data is not being handled lawfully

ICO website: www.ico.org.uk
Telephone: 0303 123 1113

9. Cookies and Website Data

My website may use cookies to improve functionality, performance, and user experience.
Where applicable, cookie use is managed through a cookie banner or settings tool. You may control cookies through your browser settings.

10. Changes to This Privacy Policy

I reserve the right to update this Privacy Policy at any time to reflect legal, professional, or operational changes.
Any significant updates will be published on my website. Continued use of my services indicates acceptance of the revised policy.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
Email: awakendiscoverytherapy@gmail.com