Privacy Notice

Last updated: 22 September 2026

I take your privacy very seriously. This notice explains what information I collect, how I use and protect it, and the rights you have over it.

On this page

Who I am

I’m George Hargreaves, a counsellor practising as Oak Therapy in Bristol. I’m responsible for deciding how personal information is used in my practice. In data protection terms, this makes me the data controller.

You can contact me about this notice or your personal information using any of the details below, or through the contact form on this website.

Controller: George Hargreaves, trading as Oak Therapy

Postal address: Please email or call using the relevant contact details and I’ll provide you with a postal address.

Email: george@oaktherapy.co.uk

Phone: 07586944043

ICO registration number: ZC249308

BACP membership number: 397719

Information I collect

If you contact me, I may collect your name, contact details and anything you choose to tell me in your enquiry. If we work together, I may also collect information needed to arrange and provide counselling, including relevant information about your circumstances and wellbeing, brief session notes, appointment details, and payment and invoicing records.

Information about your health or mental health is given additional protection under data protection law. I ask for and record only what I need for my work with you and the running of my practice.

My website is hosted by Squarespace. When you visit it, Squarespace may process technical information, such as your IP address, device information and details of your visit. If you use the contact form, the information you submit is processed through the website so that I can receive and respond to it.

Why I use your information

I use personal information to respond to enquiries; arrange and provide counselling; keep appropriate clinical and administrative records; manage payments; and meet my legal and professional responsibilities. In limited circumstances, I may also use or share information where necessary to protect someone’s safety or deal with a legal claim.

For ordinary personal information, my lawful bases under UK GDPR are generally:

  • Contract: to take steps at your request before we agree to work together, and to provide counselling once we have an agreement.

  • Legitimate interests: to respond to other enquiries and run my practice responsibly, where your rights do not override those interests.

  • Legal obligation: to keep records or disclose information where the law requires it.

  • Vital interests: in exceptional circumstances where using information is necessary to protect someone’s life.

Counselling may involve information about health and other sensitive matters. As well as an ordinary lawful basis, processing this information requires a separate condition under Article 9 of UK GDPR.

I do not sell personal information or use counselling information for unrelated marketing.

Confidentiality and sharing

What you tell me in counselling is confidential. I may discuss my work in professional supervision to support safe practice, while protecting your identity as far as possible and sharing only what is needed.

I may need to share information if there is a serious concern about your safety or someone else’s, if the law requires disclosure, or where it is necessary in connection with a legal claim. Where possible and appropriate, I will discuss this with you first. My counselling agreement explains the limits of confidentiality in more detail.

Services that help me run the practice may also handle some information. These include Squarespace for the website and contact form; Jotform for securely collecting client details; my email and communications providers; Zoom, Google Meet or WhatsApp if we agree to meet online; and Stripe or my bank for payments. The information each provider handles depends on how you contact or pay me. Their own privacy notices explain how they use information for their purposes.

Records and security

I keep counselling notes and related client files in encrypted files on my computer. Jotform is used to securely collect initial client details. Once I have transferred this information to my own records, I delete the submission from Jotform.

I use access controls and other reasonable safeguards to protect personal information. I do not record online counselling sessions as a routine part of my practice.

Please bear in mind that ordinary email and messaging services may be less suitable for sharing detailed sensitive information. We can agree on a practical way to communicate about appointments and other matters.

How long I keep information

  • Counselling records: I keep these for seven years after our work ends, unless a legal or other compelling reason requires a different period.

  • Enquiries that do not lead to counselling: If you contact me about counselling, I may keep your contact details, correspondence and brief notes relating to your enquiry or initial consultation. If you do not go on to begin counselling with me, I will normally keep this information for 12 months after our last contact, after which it will be securely deleted. I may retain information for longer where there is a specific legal, safeguarding or professional reason to do so.

  • Financial records: I keep records needed for tax purposes for at least five years after the 31 January tax-return deadline for the tax year they relate to. The date therefore depends on when a payment was made. I may need to keep records longer if HMRC requires it or a matter remains unresolved.

Information is securely deleted when it is no longer needed, subject to any legal or professional reason for keeping it longer.

Website cookies and analytics

Squarespace uses cookies and similar technologies to operate the website and may provide me with basic information about site visits. I do not currently use or intend to add Google Analytics or advertising trackers.

Information processed outside the UK

Some of the services I use may process information outside the UK. Where an international transfer is involved, it must be covered by an applicable legal mechanism or safeguard. You can contact me for information about the transfers and safeguards relevant to the services I use.

Your rights

Depending on the circumstances, you may have the right to access your personal information, correct it, ask for it to be erased, restrict its use, object to its use, or receive it in a portable format. These rights have limits; for example, I may need to retain some information to meet a legal obligation.

If you wish to exercise a right or ask how I use your information, please contact me using the details above.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. I would welcome the chance to address any concern directly first.

Changes to this notice

I may update this notice if my practice, the services I use or legal requirements change. The date at the top shows when it was last updated.