Privacy Policy

Hope & Bloom Privacy Policy & Data Protection Notice

Effective date: 26 August 2026

1. Introduction

Hope & Bloom Counselling and Psychotherapy is committed to protecting your privacy and handling your personal information fairly, lawfully and securely.

This Privacy Policy explains how Hope & Bloom collects, uses, stores and protects personal information when you:

contact or enquire about our services;
attend an initial consultation;
receive counselling or psychotherapy;
communicate with Hope & Bloom by telephone, email or other electronic means;
use our website; or
otherwise engage with our services.

Hope & Bloom provides counselling and psychotherapy to adults, children and young people. As part of providing these services, it may be necessary to process personal and sensitive information about you or, where appropriate, a child or young person for whom you have parental responsibility.

Hope & Bloom complies with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 (DUAA).

The DUAA introduced changes to UK data protection law in stages, with all of its data-protection provisions now in force as of June 2026.

This Privacy Policy explains how those requirements are applied within Hope & Bloom.

2. Data Controller

The data controller for Hope & Bloom Counselling and Psychotherapy is:

Hollie Baynham
Hope & Bloom Counselling and Psychotherapy
Bridge House
Riverside North
Bewdley
DY12 1AB

Email: [insert business email address]

As the data controller, I am responsible for deciding how and why your personal information is processed and for ensuring that appropriate measures are in place to protect it.

3. Information We Collect

The information collected will depend on the nature of your contact with Hope & Bloom and the services you receive.

3.1 Information provided when making an enquiry

When you contact Hope & Bloom, we may collect:

your name;
telephone number;
email address;
preferred method of contact;
information about the reason for your enquiry;
availability and appointment information; and
other information you choose to provide.

You are encouraged to avoid providing unnecessary sensitive personal information when making an initial enquiry.

3.2 Information collected when providing counselling or psychotherapy

Where you become a client, we may collect information necessary to provide safe and appropriate counselling or psychotherapy, including:

name and contact details;
date of birth or age, where relevant;
relevant personal and family circumstances;
information about your emotional wellbeing;
information about physical or mental health;
relevant medical information;
information relating to neurodevelopmental needs where relevant;
information concerning trauma, attachment, relationships, education or other circumstances discussed during therapy;
safeguarding information;
information relevant to risk assessment and management;
counselling records and session notes; and
information relating to appointments and attendance.

You are not required to provide information that is not necessary for the provision of counselling. However, some information may be necessary to enable Hope & Bloom to provide an appropriate and safe service.

3.3 Children and young people

Where counselling is provided to a child or young person, information may include:

the child's or young person's name, age and contact details;
information provided by a parent or person with parental responsibility;
relevant educational information;
information about additional or special educational needs where relevant;
information concerning emotional wellbeing, mental health, relationships or family circumstances;
safeguarding information; and
counselling and session records.

Information will be handled with appropriate consideration of the child's or young person's rights, confidentiality, understanding and best interests.

4. Special Category Data

Counselling and psychotherapy can involve the processing of information concerning a person's physical or mental health.

Health information is classed as special category data under UK data protection law and requires additional protection.

Where Hope & Bloom processes special category data, an appropriate lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9 will apply.

Where relevant, Hope & Bloom may also rely on conditions contained within the Data Protection Act 2018 for processing special category information in connection with the provision of counselling and related services.

Information is collected and processed only where it is relevant and necessary for the purpose for which it is being used.

5. How We Use Your Information

Hope & Bloom may use your personal information to:

respond to enquiries;
arrange an initial consultation;
provide counselling and psychotherapy;
assess your needs and provide appropriate support;
communicate with you about appointments;
maintain appropriate counselling and professional records;
manage safeguarding and risk;
communicate with parents, carers, schools or other professionals where appropriate and lawful;
provide reports or progress information where agreed and appropriate;
manage payments, invoices and accounts;
meet professional, legal, insurance and regulatory requirements;
deal with complaints or concerns;
maintain the security of our systems;
operate and maintain our website;
manage and improve our services where this can be done lawfully; and
comply with legal obligations or lawful requests from relevant authorities.

Your information will not be used for purposes that are incompatible with the purpose for which it was collected unless there is an appropriate lawful basis to do so.

6. Lawful Bases for Processing

UK data protection law requires Hope & Bloom to have a lawful basis for processing personal information.

Depending on the circumstances, Hope & Bloom may rely on:

Contract – where processing is necessary to provide agreed services or take steps before entering into an agreement;
Legitimate interests – where processing is necessary for legitimate professional or business purposes and those interests are not overridden by your rights;
Legal obligation – where processing is necessary to comply with a legal requirement;
Consent – where consent is the appropriate lawful basis;
Vital interests – where processing is necessary to protect someone's life in an emergency; or
another lawful basis permitted under UK data protection legislation where appropriate.

Where special category data is processed, an additional Article 9 condition will also apply.

The specific lawful basis used will depend on the purpose and circumstances of the processing.

7. Confidentiality

Confidentiality is a fundamental part of counselling and psychotherapy.

Information shared during counselling will normally remain confidential and will not be shared with other people without an appropriate lawful basis.

There are circumstances in which information may need to be shared without your consent. These may include:

concerns about serious risk to your safety or the safety of another person;
safeguarding concerns involving a child or vulnerable person;
where disclosure is required by law;
where disclosure is required by a court or other lawful authority;
where necessary to prevent or detect serious crime;
where necessary to protect someone's vital interests; or
where disclosure is necessary to meet professional, legal, insurance or regulatory requirements.

Where reasonably possible and appropriate, Hope & Bloom will discuss information-sharing with you before information is disclosed.

However, this may not always be possible where doing so could increase risk or conflict with a legal or safeguarding requirement.

8. Children and Young People

When working with children and young people, Hope & Bloom recognises that confidentiality, consent, parental responsibility, safeguarding and the young person's own rights may need to be considered together.

Parents or carers may provide information about a child or young person and, where appropriate, may receive information about aspects of the counselling process.

However, a parent or person with parental responsibility does not automatically have an unrestricted right to access all information shared by a young person during counselling.

Information-sharing will be considered on a case-by-case basis, taking account of the young person's age, understanding, confidentiality, safeguarding, parental responsibility and applicable legal and professional requirements.

Where information needs to be shared with a school, parent/carer, health professional or other organisation, this will be done only where there is an appropriate lawful basis and where the information-sharing is necessary and proportionate.

9. Sharing Information With Other Professionals and Organisations

In some circumstances, Hope & Bloom may need to share relevant information with other organisations or professionals.

This may include:

parents or carers;
schools and education settings;
health or social care professionals;
safeguarding services;
emergency services;
professional supervisors;
insurers;
accountants or financial service providers;
legal or regulatory authorities; or
technology and service providers supporting the operation of Hope & Bloom.

Only information that is relevant and necessary will normally be shared.

Where another organisation processes personal information on behalf of Hope & Bloom, appropriate safeguards and contractual arrangements will be used where required.

Hope & Bloom does not sell personal information to third parties.

10. Professional Supervision

As a professional counsellor and psychotherapist, Hope & Bloom may discuss aspects of therapeutic work within professional supervision.

Where client work is discussed for supervision purposes, reasonable steps will be taken to protect confidentiality and avoid identifying information wherever possible.

Supervision is used to support safe, ethical and effective professional practice.

11. Counselling Records and Retention

Hope & Bloom keeps appropriate records relating to counselling and psychotherapy.

Records may include:

initial assessment information;
counselling agreements;
relevant correspondence;
session notes;
safeguarding and risk information;
appointment information; and
other information necessary to provide a safe and appropriate service.

Records are retained only for as long as necessary, taking account of professional, legal, insurance, safeguarding and record-keeping requirements.

For clients who are under 18, Hope & Bloom's current retention policy is to retain counselling records for five years after the client's 18th birthday, unless there is a lawful reason for retaining information for longer.

Other records, such as financial and accounting records, may be retained for different periods where required by law.

At the end of the applicable retention period, information will be securely deleted or destroyed.

12. Data Security

Hope & Bloom takes reasonable and appropriate technical and organisational measures to protect personal information against:

unauthorised access;
accidental loss;
misuse;
alteration;
unauthorised disclosure; and
accidental or unlawful destruction.

Security measures may include secure devices, passwords, access controls, appropriate software security, secure storage and careful handling of confidential information.

No electronic system or method of communication can be guaranteed to be completely secure. However, appropriate steps are taken to reduce the risks associated with electronic communication and storage.

13. Email and Telephone Communication

Hope & Bloom may use email and telephone communication to:

respond to enquiries;
arrange consultations;
arrange or change appointments;
communicate relevant information about your counselling;
provide administrative information; and
deal with other matters relating to your service.

Please be aware that ordinary email and telephone communication may carry some risks, particularly if an email account, telephone or device is accessed by someone else.

Hope & Bloom will take reasonable steps to ensure communications are directed to the intended recipient.

If you contact Hope & Bloom by email, correspondence may be retained where necessary for the provision of services, administration, professional record keeping, safeguarding or legal purposes.

14. Website and Cookies

The Hope & Bloom website may use cookies and other technologies that store or access information on your device.

Some technologies may be necessary for the website to function. Others may be used for purposes such as analytics or understanding website usage.

Where consent is required, non-essential cookies or similar technologies will not be activated until appropriate consent has been provided.

You will be provided with information about relevant technologies and, where required, a choice about whether to allow them.

The Privacy and Electronic Communications Regulations (PECR) contain specific requirements relating to cookies and other storage and access technologies. The ICO's current guidance, updated in April 2026, confirms that organisations must provide clear information about these technologies and, unless an exemption applies, obtain consent before using them.

Continuing to browse a website does not, by itself, constitute valid consent to non-essential cookies.

15. Website Analytics

Where website analytics are used, they may collect information about how visitors interact with the Hope & Bloom website.

Any analytics or similar technologies will be used in accordance with applicable PECR and UK data protection requirements.

Where consent is required, appropriate consent will be obtained before non-essential analytics technologies are activated.

16. External Websites

The Hope & Bloom website may contain links to external websites, including professional organisations, services and resources.

Once you leave the Hope & Bloom website, the privacy practices of those organisations will apply.

Hope & Bloom is not responsible for the privacy, security or content of external websites.

You should review the privacy policy of any external website before providing personal information.

17. Your Data Protection Rights

Under UK data protection law, you may have the right to:

be informed about how your personal information is used;
request access to personal information held about you;
request correction of inaccurate or incomplete information;
request erasure of personal information in certain circumstances;
request restriction of processing in certain circumstances;
object to certain types of processing;
request data portability where the relevant legal requirements are met; and
withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exemptions.

For example, information may need to be retained where there is a legal, professional, safeguarding or other lawful requirement to do so.

18. Access to Your Information

You can request access to the personal information Hope & Bloom holds about you.

This is commonly known as a Subject Access Request (SAR).

Requests should be made using the contact details provided below.

Hope & Bloom may need to verify your identity before providing information.

Where a request is valid, it will normally be dealt with within the applicable statutory timeframe.

There may be circumstances where some information cannot be disclosed, including where a relevant legal exemption applies or where disclosure would involve another person's personal information.

19. Data Protection Complaints

If you have a concern about how Hope & Bloom has handled your personal information, please contact Hollie Baynham in the first instance.

You can raise a data protection complaint using the contact details below.

Hope & Bloom will acknowledge the complaint within the applicable timeframe, investigate it appropriately and provide a response.

Under current UK data protection law, organisations are required to provide a clear means of raising data protection complaints and to acknowledge complaints within 30 days. These requirements came into force in June 2026.

If you remain dissatisfied after contacting Hope & Bloom, you have the right to complain to the Information Commissioner's Office (ICO).

ICO website: Information Commissioner's Office

20. Personal Data Breaches

Hope & Bloom has procedures for responding to personal data breaches.

If a breach occurs, appropriate steps will be taken to:

contain the breach;
assess the nature and seriousness of the incident;
reduce any potential harm;
keep appropriate records;
notify the ICO where legally required; and
notify affected individuals where legally required.

21. Data Protection and Confidentiality in Practice

Hope & Bloom aims to apply the principles of data protection throughout its practice.

This includes:

collecting only information that is relevant and necessary;
keeping information accurate where reasonably possible;
limiting access to personal information;
using appropriate security measures;
retaining information only for as long as necessary;
securely disposing of information when it is no longer required; and
regularly reviewing data protection and confidentiality arrangements.

22. Changes to This Privacy Policy

This Privacy Policy may be reviewed and updated from time to time to reflect:

changes in legislation;
changes to regulatory guidance;
changes to technology;
changes to Hope & Bloom's services; or
changes to how personal information is processed.

The latest version will be published on the Hope & Bloom website.

Last reviewed: 26 August 2026

23. Contact

If you have any questions about this Privacy Policy, how your information is handled, or your data protection rights, please contact: