Privacy notice

I’m Romilly Keen, an independent counsellor working online. I’m a member of the British Association for Counselling and Psychotherapy (BACP).

I’m the “data controller” for the personal information described here. This means I decide how it’s used and I’m responsible for looking after it. I’m registered with the Information Commissioner’s Office (ICO), registration number ZB699966.

If you have any questions about this notice or your information, please email me at romillykeen@gmail.com.

If you get in touch with me (by email, text, phone, my website or a directory such as Psychology Today), I collect your name, contact details and anything you choose to tell me in your message.

If you become a client, I also collect:

• your name and contact details
• your GP’s details and an emergency contact
• information about your health, wellbeing and personal circumstances that you share with me in sessions
• brief notes I write after each session
• records of appointments and payments

Information about your mental and physical health is “special category” data under data protection law. It needs extra protection, and I treat it with particular care.

When you visit my website, I don’t collect any personal information about you. I use anonymous statistics to see how the site is used, without cookies and without identifying you. See This website below for the details.

I only use your information to respond to you, to provide counselling, and to meet my professional and legal obligations. I never sell it or use it for marketing.

Data protection law requires me to have a lawful basis for each use:

For the legal detail: the lawful bases are UK GDPR Article 6(1)(b), (c) and (f); for health information, Article 9(2)(h) and (c), with the Data Protection Act 2018, Schedule 1.

I don’t use automated decision-making or profiling.

What you tell me in counselling stays confidential. I only share information:

• with my clinical supervisor, without details that identify you. My supervisor is also bound by confidentiality.
• when the law requires or allows it, for example if you or someone else is at serious risk of harm, a child or vulnerable adult is at risk, information about terrorism or serious crime is disclosed, or a court orders it. Where possible, I’ll talk to you first.
• with my professional insurer or legal adviser, only if needed to deal with a complaint or legal claim.
• with HMRC or my accountant, limited to payment records needed for tax.

I also use a small number of trusted services to run my practice. They process information only on my instructions:

• Zoom, for video sessions
• Google (Gmail), for email
• Sync.com, for secure cloud storage
• my bank, for payments
• Calendly, for booking an initial session
• my phone, for texts and calls

Some of these providers may store data outside the UK. Where they do, they use legal safeguards approved under UK law, such as the UK International Data Transfer Addendum.

I store records in password-protected digital files on secure, encrypted devices and in a locked cabinet. Session notes are kept to a minimum and stored separately from your identifying details. Only I have access to them.

After these periods, I delete or securely destroy the information.

This website doesn’t set any cookies of its own or store anything on your device, and it has no advertising. There’s no cookie banner because there’s nothing to opt in to.

To understand how the site is used, so I can improve it, I use anonymous statistics from PostHog, with data held in the EU. It records things like which pages are viewed, how long for and how far down, which buttons and links are clicked, the type of device and browser, and which website you came from. It never records what you type, and never records your screen.

Visits are counted without cookies. Your IP address is used briefly to create an anonymous code that changes every day, and is then discarded, so I can’t identify you or recognise you on a later visit. If you book through Calendly, only the fact that a booking was made is recorded, not your details. My lawful basis for this is my legitimate interest in understanding how the site is used.

The site is hosted by Cloudflare. Like any web host, it processes basic technical information, such as your IP address, to deliver pages to you and protect the site from attack. I don’t use this to identify you.

To make booking quick, each page loads Calendly’s booking tool in the background. When it does, Calendly sets a single short-lived security cookie (called __cf_bm) that protects its service from automated abuse. It lasts about 30 minutes and isn’t used to track you. Calendly may set further cookies only if you open the booking window, and its own privacy notice explains how it uses them.

Links to other sites, such as Instagram, Facebook and Psychology Today, are ordinary links. Nothing from those sites is loaded unless you click through to them.

You have the right to:

• ask for a copy of the personal information I hold about you
• ask me to correct information that is wrong or incomplete
• ask me to delete your information, or limit how I use it
• object to how I use your information
• ask for information you gave me to be transferred to you or someone else

Some rights have limits. For example, I may need to keep records for the periods above to meet professional or legal requirements, even if you ask me to delete them. If so, I’ll explain why.

To use any of these rights, email me at romillykeen@gmail.com. I’ll respond within one month. There’s usually no charge.

If you have any concern about how I handle your personal data, please email me at romillykeen@gmail.com. I’ll acknowledge your complaint within 30 days, look into it promptly, keep you updated and let you know the outcome.

If you’re not satisfied with my response, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

I review this notice regularly. If I make important changes, I’ll let current clients know. The date at the top shows when it was last updated.