Privacy policy

Last Updated: 11 August 2026

Counselling asks you to share things you may not have told anyone. We take that seriously. This policy explains what we record, why, who sees it, how long we keep it, and what rights you have over it. It applies to everyone using our counselling service in the United Kingdom.

If you also use our physiotherapy, personal training or other services, those are covered by a separate policy at healthbyscience.co.uk/privacy. Your counselling record is kept separately from any other record we hold about you.

1. Who we are

Health by Science Ltd is a Social Enterprise and Community Interest Company registered in Scotland (company number SC557048). Our counselling service trades as Health by Science Counselling Service. We act as the data controller for the personal information we hold about you, meaning we are responsible for ensuring it is processed lawfully, fairly and transparently.

Address: 98 Giles Street, Leith, Edinburgh, EH6 6BZ
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002

Data Protection Officer: Stuart Maytham, Co-Director. You can contact our DPO about anything in this policy, or to exercise any of your rights, at hello@healthbyscience.co.uk.

We are registered with the Information Commissioner’s Office under registration number ZA320594.

A note on your counsellor. Whether you see our counselling lead or a counsellor completing their training on supervised placement, they work as part of our service. Health by Science is the controller of your record, not your counsellor personally. Your counsellor does not keep their own separate copy of your notes.

2. Information we collect

Your enquiry. When you enquire through the form on our website or by telephone, we collect your name, contact details, and what you have told us about what you are looking for. We use Typeform for our enquiry form. Typeform is a Spanish company, and its servers are in the United States. See Section 6.

Your free introductory call. If you take up the free 15-minute call, we make brief notes about what you are looking for and which of our services would suit, so we can allocate you appropriately.

Booking appointments. We use Acuity Scheduling to manage our calendar. Acuity holds your contact details and appointment history so we can send reminders and manage your bookings.

Your initial consultation form. Before your first session you complete a form covering your contact details, date of birth, household, an emergency contact, your GP, medication, any mental health diagnosis, previous therapy, what brings you to counselling, and questions about your safety including whether you are currently having thoughts of harming yourself. This is the most sensitive information we hold about you and it forms the core of your counselling record.

Session notes. Your counsellor keeps brief written notes of each session, recorded against a client reference number. Notes are factual and short.

Risk records. If a concern arises about your safety or someone else’s, we record it on a risk reporting form and pass it to our Designated Safeguarding Lead. This record includes your name.

Closure records. When your counselling ends we complete a closure record noting the reason, the number of sessions and whether onward referral was needed.

Caseload records. Counsellors on placement submit a monthly summary of their caseload to our counselling lead. This uses your client reference number rather than your name, and records whether you attended and a brief description of what you are working on.

Online sessions. We use Google Meet for counselling by video call. We do not record sessions.

Payments. We use Stripe to process payments. Stripe holds your name, payment amount and transaction reference. We do not see or store your card details.

Accounts and invoicing. We use QuickBooks (Intuit) for our financial records. Your name and payment references may appear on invoices.

Marketing emails. We use Brevo (Sendinblue SAS, France) to manage our email lists, and only if you have asked to hear from us. See Section 3a.

Website analytics. We use Google Analytics 4 to understand how people use our site. Google Analytics 4 does not store IP addresses. This only happens if you consent to non-essential cookies. See Section 9.

2a. Things we do not do

Some of the tools we use elsewhere in Health by Science are not used for counselling at all. We think you should know that explicitly rather than have to infer it.

• We do not record counselling sessions, by audio, video or transcript.
• We do not use AI note-taking for counselling. Our physiotherapy service uses an AI tool called Heidi to assist with clinical notes. It is not used in counselling. Your counsellor writes their own notes.
• We do not use AI for clinical reasoning about your counselling. Our physiotherapy and coaching staff may use AI tools to help with programme planning. Nothing from your counselling record is put into any AI tool.
• We do not use WhatsApp for counselling. No appointment reminders, no messages, nothing.
• We do not use the Everfit app for counselling.
• We do not use live chat or enquiry messaging tools for counselling. Enquiries reach us by form or telephone only.
• We do not share your story or use testimonials from counselling clients.

3. How we use your information

Providing counselling: to understand what you are bringing, to work with you safely, and to keep a record of the work.
Deciding which service suits you: to assess whether counselling with us is appropriate and whether you are best seen by our counselling lead or by a counsellor on placement.
Keeping people safe: to act where there is a serious concern about your safety or someone else’s.
Clinical supervision: to support the quality and safety of the work, as explained in Section 4.
Supporting trainee counsellors: where your counsellor is completing their training, to allow their training provider to oversee their practice.
Administration: booking, reminders, payment and record keeping.
Marketing: only to people who have asked to hear from us. See Section 3a.

Our lawful bases for processing

For personal data generally (UK GDPR Article 6):

• Contract (Article 6(1)(b)), to provide the counselling you have booked
• Legitimate interests (Article 6(1)(f)), for enquiry management, clinical supervision, service quality, keeping records for our own protection and yours in the event of a complaint or claim, and marketing to people who have used our services
• Vital interests (Article 6(1)(d)), where urgent action is needed to protect someone’s life
• Consent (Article 6(1)(a)), for non-essential cookies and website analytics

For health information, which is “special category” data and needs an additional basis (UK GDPR Article 9):

• Health and social care purposes (Article 9(2)(h), with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018), for your counselling record, supervision, and communication between people involved in your care. This is our main basis. It applies because your information is handled by practitioners working under a professional duty of confidentiality.
• Safeguarding of children and individuals at risk (Schedule 1 Part 2 paragraph 18 of the Data Protection Act 2018), where we need to share information to protect a child or an adult at risk.
• Vital interests (Article 9(2)(c)), where there is a serious and immediate risk to life and you are not able to give consent.
• Legal claims (Article 9(2)(f)), where information is needed to establish, exercise or defend a legal claim.

A note on why we do not rely on consent for your record. We are sometimes asked why we do not simply ask you to consent to us keeping notes. Consent has to be freely given and freely withdrawn, and we cannot provide counselling safely without a record, so treating it as a choice would be misleading. We rely on the bases above instead, and we tell you plainly what we keep and why.

3a. Marketing communications

We may occasionally email people who have enquired about or used our services. We ask you directly whether you want this, and we only send to people who say yes. If you say no, we keep a record of that so we do not contact you by mistake.

Lawful basis. Our legitimate interests in communicating with people who have engaged with our services (Article 6(1)(f)), together with the soft opt-in under Regulation 22 of the Privacy and Electronic Communications Regulations.

How to stop. Every marketing email contains an unsubscribe link. You can also email hello@healthbyscience.co.uk. We action opt-outs immediately, you do not need to give a reason, and we will not ask for one.

What we will not do. We will never sell or share your email address. We will never reference counselling, your reasons for attending, or anything about your health in a marketing email. Nothing we send will identify you as a counselling client.

Confirmations are different. Booking confirmations, payment receipts and appointment reminders are service messages, not marketing, and you will continue to receive them.

4. Who sees your information, and when

We do not sell your data. Access is limited to the people below.

Your counsellor. The person you see.

Your counsellor’s clinical supervisor. Every counsellor, qualified or in training, discusses their work regularly with a clinical supervisor. This is a professional requirement and it exists to keep the work safe. Your counsellor will discuss their work with you in supervision. They keep identifying details to a minimum where they can, but supervision is not anonymous in every case, and where your counsellor is on placement their supervisor works within our service and will normally know who they are seeing. Supervisors are bound by the same duty of confidentiality.

Our Designated Safeguarding Lead. Where a concern about safety is raised, it is recorded and passed to a named senior person within Health by Science so that it is handled properly.

Your counsellor’s training provider, where your counsellor is completing their training. Physis Scotland oversees its students’ practice and may see information about the work. Physis acts as an independent controller for that oversight, under its own privacy policy, and we will tell you who to contact there if you want to exercise rights over what they hold.

Administrative staff, for booking and payment only. They do not have access to session notes.

Enquiries to our main contact address. If you contact us at hello@healthbyscience.co.uk, that address is monitored by our directors so that enquiries are answered promptly. Your counselling record itself is held separately, and directors do not have access to your session notes.

Outside our service, only in the circumstances in Section 4a.

Our processors:

• Scheduling and forms: Acuity Scheduling (Squarespace, USA), booking and reminders; Typeform (Spain, US servers), enquiry forms
• Sessions and records: Google (Meet, Drive, Workspace), video calls and document storage, under our Google Cloud Data Processing Addendum
• Payments: Stripe Payments Europe Ltd (UK and EEA)
• Accounting: Intuit / QuickBooks (USA), financial records and invoicing
• Marketing email: Brevo / Sendinblue SAS (France)
• Website analytics: Google Analytics 4, subject to your cookie consent

Only authorised Health by Science staff who have completed data protection training may access your information, and access to counselling records is restricted to those who need it.

4a. The limits of confidentiality

What you bring to counselling is confidential, and there are limits to that. We would rather you knew them before you start than discovered them later.

We may need to pass information outside our service where:

• We are seriously concerned about your safety, or someone else’s. This can include contacting your GP, emergency services, social work, or the emergency contact you have given us.
• A child or an adult at risk may be being harmed. We have a duty to report this and we will.
• The law requires it. This includes a court order, and certain obligations relating to terrorism, money laundering and drug trafficking.

How we handle it. Except where doing so would increase risk, or where the law prevents it, your counsellor will talk to you before passing anything on. They will tell you what they intend to share, with whom and why. We would far rather do this with you than about you.

5. Keeping your data safe

Encryption: your data is encrypted in transit (SSL/TLS) and at rest.
Access controls: counselling records are held separately from other Health by Science records, with access restricted to those who need it. Our staff sign in through Google Workspace, and we are in the process of making two-step verification mandatory on all staff accounts.
No personal devices: counsellors record notes only in our systems. They do not keep client information on personal devices, personal email accounts or paper records taken off site.
Staff and trainees: everyone completes data protection training before accessing client data. Where a role requires membership of the Protecting Vulnerable Groups scheme, we obtain it before that person works with clients.
Regular reviews: we review our systems and our data protection documentation at least annually with an external data protection consultant.
Breach notification: if a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to you, we will also contact you directly and without undue delay.

6. International data transfers

Some of our service providers are based outside the UK. Where that happens we put safeguards in place under Chapter V of the UK GDPR, which usually means the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses with the UK International Data Transfer Addendum.

No transfer arises for: Google Workspace, Google Drive and Google Meet (configured to European servers), Brevo (France) and Stripe (UK and EEA).

Safeguards in place for: Acuity Scheduling, QuickBooks, Google Analytics and Typeform. Typeform is a Spanish company but its servers are in the United States, and our agreement with Typeform includes the UK International Data Transfer Addendum.

Your session notes and consultation form are held in Google Workspace on European servers. They are not copied into any system outside the UK or EEA.

7. Your rights

You have the following rights over your personal data. To exercise any of them, email hello@healthbyscience.co.uk. We will respond within one month.

• Right of access (Subject Access Request): request a copy of the information we hold about you, together with details of how it is used, who it has been shared with and how long it is kept. Counselling notes sometimes refer to other people, and we may need to remove or redact information that identifies someone else before we release them.
• Right to rectification: ask us to correct inaccurate or incomplete information. Where a note records your counsellor’s professional opinion at the time, we can add your comment to the record rather than change what was written.
• Right to erasure: ask us to delete your information. This is not absolute. Where we need to keep a record to meet our professional obligations, or to defend a potential complaint or claim, we may keep it and restrict its use instead. We will always explain what we have done and why.
• Right to data portability: request a digital copy of your data to take elsewhere.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to object: you can object to processing based on our legitimate interests, on grounds relating to your particular situation. For direct marketing this right is absolute.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before you withdrew it.

Automated decision-making. We do not make any decision about you, your care or your suitability for our service by automated means. Every decision about your counselling is made by a person.

8. Data retention

• Counselling records, including your consultation form, session notes and closure record: 7 years from the date of your last session, then securely destroyed.
• Risk and safeguarding records: retained with your counselling record, and for longer where there is an ongoing safeguarding reason to do so.
• Enquiry and contact records where you do not go on to have counselling: 2 years from the date of last contact.
• Caseload summaries submitted by counsellors on placement: retained for the duration of the placement plus one year, and identify you only by reference number.
• Marketing lists: until you opt out or ask us to remove you. If you opt out we keep a suppression record so that we do not contact you again by mistake.
• Financial records: 7 years in line with HMRC requirements.

If you would like more detail about how long we keep any particular information, please contact us at hello@healthbyscience.co.uk.

9. Cookies

We use cookies to help our website run smoothly. Some are essential. Others are performance or targeting cookies, including Google Analytics 4, which help us understand how people use our site.

You will be asked to consent to non-essential cookies when you first visit our website, and you can change your preferences at any time using the cookie settings link on our site.

10. Changes to this policy

If we make significant changes to how we handle your data, we will let you know by email or a notice on our website. The date at the top of this policy will always reflect when it was last updated.

Contact us

If you have any questions about your privacy or wish to exercise your rights, please get in touch:

Data Protection Officer: Stuart Maytham
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002
Address: Health by Science Ltd CIC, 98 Giles Street, Leith, Edinburgh, EH6 6BZ

If you are unhappy with how we have handled your personal information, please tell us at hello@healthbyscience.co.uk. We will acknowledge your complaint within 30 days and respond to it as quickly as we can.

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk | Helpline: 0303 123 1113