Your privacy matters. This policy explains how Hillcrest Counselling collects, uses, stores and protects your personal information.

Last updated: 2 August 2026

1. Who I am

Hillcrest Counselling is run by Megan Johnson, a registered member of the British Association for Counselling and Psychotherapy.

For data-protection purposes, I am the data controller for the personal information collected through this website and as part of my counselling practice.

You can contact me at:

Email: hillcrestcounselling@gmail.com
Telephone: 07563 445156

2. Information I collect

I may collect personal information when you:

• contact me through my website, email or telephone;

• arrange an introductory call;

• begin counselling with me;

• attend counselling sessions; or

• make a payment.

This information may include your name, email address, telephone number, availability, emergency-contact details and payment information.

During counselling, you may choose to share information about your health, wellbeing, relationships, personal circumstances or experiences. This may be considered sensitive or special-category personal data.

I aim to collect only the information needed to provide a safe and professional counselling service.

3. Information collected through this website

This website is hosted by Squarespace.

When you visit the website, Squarespace may collect information such as:

• your IP address;

• browser and device information;

• the pages you visit;

• the date and time of your visit; and

• information collected through cookies.

If you submit a contact form, the information you enter will be sent to me so that I can respond to your enquiry.

Please avoid sharing detailed, highly sensitive or urgent information through the website contact form.

4. How I use your information

I may use your personal information to:

• respond to enquiries;

• arrange introductory calls and counselling sessions;

• provide counselling;

• maintain appropriate client and appointment records;

• manage payments and accounts;

• communicate with you about your sessions;

• maintain the safety, security and professional standards of my practice;

• meet legal, ethical, insurance and regulatory responsibilities; and

• respond to concerns, complaints or legal claims.

I will not use your information for marketing unless you have clearly agreed to this.

5. My lawful reasons for using your information

Depending on the circumstances, I may process your personal information because:

• it is necessary to take steps requested by you before beginning counselling;

• it is necessary to provide the counselling service we have agreed;

• I have a legitimate professional or business reason to use it;

• I need to meet a legal or regulatory obligation; or

• you have given your consent.

Information concerning your health, wellbeing or personal experiences requires additional protection. Where applicable, I process this information with your explicit consent and where necessary for the establishment, exercise or defence of legal claims.

You can withdraw your consent by contacting me. This will not affect information that was processed lawfully before your consent was withdrawn, and I may still need to retain some information where there is another lawful reason to do so.

6. Confidentiality and sharing information

Your information will be treated confidentially and will not normally be shared without your knowledge.

There may be limited circumstances in which information needs to be shared, including:

• where there is a serious concern about your safety or another person’s safety;

• where there is a safeguarding concern involving a child or vulnerable adult;

• where disclosure is required by law or a court order;

• where necessary to prevent or report a serious crime; or

• where information is required to respond to a formal complaint or legal claim.

I attend professional clinical supervision as part of ethical counselling practice. I may discuss aspects of my client work in supervision, but identifying information will be avoided wherever possible. My supervisor is also required to maintain confidentiality.

I may also use trusted service providers to support the running of my practice, including:

• Squarespace for website hosting and contact forms;

• Google for email services;

• Google Meet for online counselling sessions;

• payment or banking providers; and

• professional advisers, insurers or regulatory organisations where necessary.

These providers may process limited personal information while delivering their services.

7. International data transfers

Some technology providers may process or store information outside the United Kingdom.

Where this happens, I take reasonable steps to use reputable providers and ensure that appropriate data-protection safeguards are in place.

8. How I protect your information

I take reasonable steps to keep your personal information secure.

These may include:

• password-protected devices and accounts;

• appropriate security settings;

• secure storage systems;

• limiting access to personal information;

• separating identifying details from counselling notes where appropriate; and

• securely deleting or destroying information when it is no longer required.

Although reasonable precautions are taken, no email, website or online system can be guaranteed to be completely secure.

9. How long I keep your information

I keep personal information only for as long as it is needed for the purpose for which it was collected.

As a general guide:

• enquiries that do not lead to counselling will usually be deleted within 12 months;

• client records will usually be retained for seven years after counselling ends;

• appointment and communication records will be retained only while they remain necessary;

• financial and payment records will be retained for the period required by HM Revenue and Customs; and

• information relating to a complaint, safeguarding concern or legal matter may be retained for longer where necessary.

• Information will then be securely deleted, destroyed or anonymised.

10. Cookies

This website uses cookies and similar technologies to operate securely and understand how visitors use the site.

Some cookies are essential for the website to function. Other cookies, including certain analytics cookies, will only be used according to the choices you make through the website’s cookie banner.

You can review or change your cookie preferences by selecting Cookie Settings in the website footer.

11. Your rights

Depending on the circumstances, you may have the right to:

• ask for a copy of the personal information I hold about you;

• ask me to correct inaccurate or incomplete information;

• ask for your information to be deleted;

• ask me to restrict how your information is used;

• object to certain uses of your information;

• receive certain information in a portable format; and

• withdraw your consent.

These rights do not apply in every situation. For example, I may need to retain information to meet a legal obligation or respond to a complaint or legal claim.

To make a request, please contact me using the details at the beginning of this policy. I may need to confirm your identity before responding.

12. Complaints

Please contact me first if you have any questions or concerns about how your personal information has been handled. I will do my best to address your concerns.

You also have the right to complain to the Information Commissioner’s Office, the UK’s independent data-protection regulator.

You can find further information through the ICO website.

13. Changes to this policy

I may update this privacy policy if my services, working practices or legal responsibilities change.

The date at the top of this page will show when the policy was last updated.