Data Controller: Katey Korzenietz

Email: katey@spacetobeme.com

Website: www.spacetobeme.com

1. Introduction

I am committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how I collect, protect, and manage your personal data. As a sole trader, I, Katey Korzenietz, am the Data Controller for all information held by Space to Be Me.

2. Why I Collect Your Data (Legal Basis)

I process your data under the following legal bases:

• Contract & Legitimate Interests: To manage your enquiries and provide counselling.
• Special Category Data: Because I provide counselling, some data I hold relates to your mental health. I process this sensitive information under Article 9(2)(h) of the UK GDPR to provide you with professional therapeutic support.

3. What Information I Collect

I collect information from you when you enquire about services or attend sessions. This includes:

• Personal Data: Name, address, phone number, email, and emergency contact details.
• Sensitive Data: Relevant medical history, mental health details, and anonymised session notes.
• Digital Data: Emails, text messages, and (if applicable) WhatsApp communications or website cookies.

4. Confidentiality and its Limits

Your information is kept strictly confidential. However, I may be legally or ethically required to share information without your consent in the following circumstances:

• If I believe there is a serious risk of harm to yourself or others.
• If I am required to do so by a court of law.
• If I become aware of activities related to terrorism, money laundering, or the abuse of a child or vulnerable adult.

5. Data Storage and Security

• Paper Records: Any handwritten notes are anonymised (using a code rather than your name) and stored in a secure, locked cabinet.
• Digital Records: All electronic devices are password-protected.
• Third-Party Platforms: Email and digital communications are processed via providers like Google, Microsoft, or Ionos. Video sessions (Zoom, Teams, etc.) are subject to their own privacy policies.
• WhatsApp: If you choose to contact me via WhatsApp, please note that while messages are encrypted, the platform may have access to your metadata.

6. Retention (How long I keep your data)

I keep your clinical records for 7 years after our therapeutic relationship ends. This is to comply with professional insurance requirements and legal limitations for claims. After 7 years, all paper and digital records are securely destroyed.

7. Your Rights

Under the UK GDPR, you have the following rights:

• Right of Access: You can request a copy of the data I hold about you. This is provided free of charge and will be sent to you within 30 days.
• Right to Rectification: You can ask me to correct any inaccurate information.
• Right to Erasure: You can request that I delete your data (subject to my 7-year legal/insurance requirement to keep records).
• Right to Complain: Please contact me directly with any concerns, or the ICO (www.ico.org.uk).