Understand our commitment to data
David Gould Therapy · Last updated: 1 November 2026
I am David Gould, a counsellor in private practice, trading as David Gould Counselling from Oxford, England.
I am the “data controller” for the personal information you share with me. This means I decide how and why it is used. I am registered with the Information Commissioner’s Office (ICO), registration number ZC124541.
Contact: info@davidgouldtherapy.com
This policy explains what I collect, why I collect it, who else can see it, how long I keep it, and your rights under the UK GDPR and the Data Protection Act 2018. It should be read alongside my counselling agreement.
Contact and identity details: name, phone number, email address, postal address, and (where relevant) date of birth.
Emergency and medical contacts: the name and contact details of your GP and an emergency contact, if you choose to provide them.
Clinical information (“special category data”): what you tell me in sessions, your reasons for seeking counselling, relevant health and personal history, and my session notes.
Administrative records: appointment dates and times, cancellations, invoices and payment records.
Communications: emails, texts or messages between us related to the entering into a counselling agreement and the making or amendment of appointments.
I only collect what I need to work with you safely and professionally.
Mostly directly from you: through enquiries, assessment, sessions, and correspondence. I do not obtain information about you from other sources without your express request and consent.
To assess your needs, provide counselling, and manage our contract (including initial enquiries, intake forms, scheduling, and clinical notes):
a) Standard Personal Data Legal Basis: UK GDPR Article 6(1)(b) (performance of a contract or taking pre-contractual steps at your request) and Article 6(1)(f) (legitimate interests in conducting a professional practice).
b) Special Category Health Data Legal Basis: UK GDPR Article 9(2)(h) (provision of health care by a health professional under a professional duty of confidentiality).
To keep accurate records and meet my professional obligations (BACP Ethical Framework, insurer requirements). Legal basis: legitimate interests (Article 6(1)(f)) and, for special category data, Article 9(2)(h).
To invoice you and keep financial records. Legal basis: contract and legal obligation (Article 6(1)(b) and (c)).
To protect you or others in an emergency, or to comply with the law. Legal basis: legal obligation, or vital interests (Article 6(1)(c) and (d)).
For clinical supervision. Legal basis: legitimate interests, with special category data processed under Article 9(2)(h). See section 6.
I do not use your information for marketing, and I do not sell it.
I use the following providers to store and manage information. They act as my “processors” and may only handle data on my instructions.
Apple Calendar (Apple, Inc) – appointment scheduling. Calendar entries are minimal and contain a coded client number and the session date and time only. Apple does not provide end-to-end encryption of this data. Privacy policy: apple.com/legal/privacy.
Cal.com - appointment booking & scheduling. All information is entered by the client and is used for booking confirmation and calendar entries. Information held: name, email address, telephone number, meeting date and time, any further information supplied. You do not need to describe why you are seeking therapy when you book.
I am the data controller and Cal.com acts as my data processor, handling your information only to arrange and deliver the service you have asked for. Booking records are kept for 7 years and then deleted from Cal.com and my other systems. Cal.com, Inc. is based in the United States, so information may be processed outside the UK. Cal.com’s privacy policy is at https://cal.com/privacy.
Jotform (Jotform Inc.) – online intake and clinical assessment forms. All data is entered by clients. Data is stored in the EU. Form responses are transferred to Standard Notes and deleted from Jotform when no longer needed. Health data collected prior to contract formation is processed under Article 9(2)(h), Article 6(1)(b) and/or Article 6(1)(f) of UK GDPR. Information held: Full name, email address, telephone numbers, client and emergency contact details, contact preferences, intake forms. Privacy policy: jotform.com/privacy.
Jitsi Meet (8x8, Inc.) – online video sessions. Video and audio are encrypted in transit. The service processes technical data such as IP addresses, call duration and in-call chat messages. You do not need to open an account. I do not record sessions. Please join from a private space, using a device you trust. Information held: None. Privacy policy: 8x8.com/terms-and-conditions/privacy-policy.
Psycounts (Psycounts Ltd) - Practice administration and accounts, scheduling and invoicing. Psycounts Ltd is a UK company. The app is password protected. Psycounts processes data primarily in the UK and encrypts data both in transit and at rest where appropriate. Information held: Full name, email addresses, session dates, fees invoiced and paid. Privacy policy: psycounts.co.uk/policies-and-legal-docs.
Standard Notes (a subsidiary of Proton AG) – session notes. Notes are end-to-end encrypted on my device before they are synced, so the provider cannot read their contents. I use initials rather than full names in notes. The app is password protected. Health data is processed under Article 9(2)(h), Article 6(1)(b) and/or Article 6(1)(f) of UK GDPR. Data is held on EU servers. Information held: counselling agreement, assessments, clinical notes. Privacy policy: standardnotes.com/legal/privacy.
Stripe Payments UK Ltd – secure payments for sessions. I do not have access to full card details. Information held: none. I do not share any client information with Stripe.
I am the data controller and Stripe is data processor, handling this information in order to fulfil our contract. For fraud prevention and regulatory compliance, Stripe acts as an independent data controller. Stripe may transfer data outside the UK, including to the Republic of Ireland and the USA. Stripe privacy policy: https://stripe.com/gb/legal/privacy-center
WhatsApp (WhatsApp LLC, a subsidiary of Meta) – messages about appointments. I use WhatsApp only for non-clinical scheduling, and only with your permission. I use initials only to identify users and delete message threads at the end of our work. Clients are asked not to send clinical or sensitive details via WhatsApp. The content of messages and calls is end-to-end encrypted. WhatsApp metadata (phone numbers, device identifiers, IP addresses, timestamp of contact) is transmitted to Meta servers in the US without end-to-end encryption. If you prefer not to share metadata with Meta, please use standard email or SMS. Privacy policy: whatsapp.com/legal/privacy-policy-uk.
Artificial Intelligence (AI): I never use AI for any aspect of my clinical work. Wherever possible, third-party AI options are turned off.
I will not share your information with anyone else without your consent, except as follows.
Clinical supervision. I discuss my work with a supervisor, as required by the BACP. I share only what is needed, and anonymise or use first names/initials. My supervisor is bound by the same rules of client confidentiality.
Legal duty to disclose. I may have to disclose information where the law requires it, for example under a court order, or in relation to terrorism, money laundering, or safeguarding of children.
Serious risk of harm. Where I believe you or someone else is at serious risk, I may need to contact your GP, emergency services or another appropriate person. Where possible, I will discuss this with you first.
Insurers and regulators. If a complaint or claim is made, relevant records may be shared with my professional indemnity insurer or the BACP, under confidentiality.
Professional executor. If I become unable to work or die, a trusted colleague, bound by the same confidentiality, will contact clients and securely handle or delete records.
Some providers store or process data outside the UK, including in the EU and United States. Where this happens, I rely on appropriate safeguards (such as the UK’s adequacy regulations, the UK–US data bridge where the provider is certified, or an International Data Transfer Agreement or Addendum). Where possible, the content is encrypted so the provider cannot read it.
Devices are password or biometric protected.
Session notes are held in an end-to-end encrypted app, with a strong unique passphrase and two-factor authentication where available.
Any paper records are kept in a locked cabinet. Hand-written session notes are shredded after use.
I do not use shared or public devices for client records. Any data stored locally is kept in a password-protected, encrypted container.
Software is kept up to date.
If a data breach is likely to put your rights at risk, I will tell you and report it to the ICO within 72 hours where required.
Session notes and clinical records: 7 years after our work ends.
Contact details: deleted from email and telephone records when no longer needed, normally at the end of our work.
Financial records: 7 years, as required for tax purposes.
Emails and messages: deleted at the end of our work, except anything forming part of the clinical record.
After this period, all records are securely deleted or shredded.
You have the right to:
be informed about how your data is used (this policy);
access a copy of your information (free of charge, usually within one month);
have inaccurate information corrected;
ask for your information to be erased, although I may need to keep clinical records for the legal and professional reasons above;
restrict or object to certain processing;
ask for your information in a portable format, where this applies;
withdraw consent where I am relying on it, without affecting earlier processing.
To use any of these rights, contact me using the details in section 1. I may ask you to confirm your identity first. I will respond within one month.
If you are unhappy with how I handle your information, please contact me first at info@davidgouldtherapy.com so that I can try to put things right. I will acknowledge your complaint within five working days and provide a substantive response within one month.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
This website does not use cookies or analytics. If you choose to contact us via our form, your details are only used to respond to your enquiry and are never shared.
Please be aware that standard email and text messaging are not fully secure. If you prefer another method of contact, tell me. I will keep emails brief and avoid sensitive detail where possible.
I review this policy at least once a year and when my practice changes. The date at the top shows when it was last updated.