​​

​

1. Introduction 

At Heartspace, I take your privacy seriously. I am committed to handling your personal information respectfully, securely and confidentially, in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

This Privacy Notice explains what personal information I collect, why I use it, how I store and protect it, when I may share it, how long I retain it and what rights you have in relation to your information. 

​

Who is responsible for your information? 

Cerian Lye-Owens, practising as Heartspace, is responsible for the personal information collected and used in connection with my counselling practice. ​

If you have any questions about this notice or how your information is handled, you can contact me using the details below. 

Data controller details 

• Name: Cerian Lye-Owens, trading as Heartspace 

• Postal address: Heartspace at  Hartham Park, Corsham, Wiltshire, SN13 0RP 

• Email: cerian.lyeowens@outlook.com 

• ICO registration: ZB420058 

 

2. What personal information I collect and how I collect it 

The personal information I collect depends on how you interact with Heartspace and whether you are making an enquiry, attending an initial consultation or working with me as a client. 

Enquiries and initial contact 

When you contact me to enquire about counselling or other services, I may collect your name, email address, telephone number and any information you choose to include in your message. This information may be provided through my website, email, Calendly, therapist directories or other communication channels. 

I use this information to respond to your enquiry, communicate with you and arrange an initial conversation or appointment where appropriate. 

Client information and counselling records 

If you become a client, I collect information needed to establish and manage our work together. This may include contact details, date of birth, relevant health information, information about medication or medical conditions, emergency contact details, GP details where relevant, and information you share during counselling. 

I may also create and maintain counselling records, including relevant session notes, information recorded about our work together, agreed actions and, where necessary, records relating to risk or safeguarding concerns. I may retain relevant written or creative material from our work where appropriate. 

I also keep separate paper process notes for my own reflective practice and may retain paper resources created during sessions. These are stored securely and destroyed when counselling ends. 

Information received from other people 

On occasion, I may receive personal information about a client from another person, such as a family member or another professional. Where this happens, I consider whether the information is relevant to the counselling work, the client’s wellbeing or a risk or safeguarding concern. Where appropriate, I record relevant information in the general notes within the client’s record in Kiku. I handle this information confidentially and in accordance with my professional and legal responsibilities. 

Appointments and communications 

I collect information needed to arrange and manage appointments, including booking details, appointment dates and relevant communications by email, text, telephone or video call. 

Payments and business records 

I keep records needed to manage payments and the administration of my practice. These may include payment dates, amounts, payment references and accounting records. 

Mailing list and website information 

If you subscribe to my mailing list, I collect your email address and your subscription preference so that I can send you updates about Heartspace, workshops and relevant services. 

When you visit my website, certain information may also be collected through cookies or similar technologies, as explained in the Cookies and website data section of this Privacy Notice. 

I collect personal information directly from you in most cases. Some information may also be generated through the administration of our work together or provided by third-party services you use to contact me, book appointments or make payments. 

 

3. Initial enquiries and arranging counselling 

Initial enquiries 

You may contact me about counselling through several routes, including: 

• My website: Through the contact form on my Wix website. 

• BACP: Through the BACP therapist directory, where enquiries may be sent to me. 

• Counselling Directory: Through my profile on the Counselling Directory website. 

• Direct email: By emailing me directly. 

• Calendly: Through my appointment-booking link, which is available on my website and directory profiles. 

Depending on how you contact me, I may receive your name, email address, telephone number, details of your enquiry and any other information you choose to provide. 

I use this information to respond to your enquiry, provide information about my services, arrange an initial consultation and, where appropriate, discuss starting counselling. 

The information may be held in the system through which you contacted me, in my email account or in my practice-management system, Kiku, where relevant. I take appropriate steps to protect your personal information when handling it across these systems. 

If you enquire about counselling but do not proceed, I will securely delete your enquiry information within one month of the enquiry, unless there is a legitimate reason to retain specific information for longer. 

I will review enquiries that are at least one month old as part of my regular administration and delete the relevant information from the systems in which it is held, where applicable. 

Please avoid including detailed or highly sensitive personal information in an initial enquiry unless it is necessary for your enquiry. 

Initial consultations booked through Calendly 

I offer a free 20-minute initial consultation by telephone, which can be booked through my Calendly booking link on my website and directory profiles. 

When booking, you will be asked to provide your name, email address and telephone number and to acknowledge Calendly’s Participant Terms and Privacy Notice before confirming your appointment. 

I use this information to arrange your consultation and contact you by telephone. During the call, you will have the opportunity to talk about the support you are looking for, ask questions and consider whether working together would be appropriate. 

Calendly processes the information submitted through its booking form and information needed to manage the booking. Calendly also uses cookies and similar technologies in accordance with its own privacy and cookie policies. You can read more in Calendly’s Privacy Notice. 

Please avoid including detailed or highly sensitive personal information in your booking. 

Once you book your consultation, I receive a booking notification by email through Gmail. The appointment is added to my Google Calendar, which is linked to my Kiku practice-management calendar. I use a Google account dedicated to Heartspace to manage relevant practice activities. These systems help me manage my availability and appointments. 

Your booking information may therefore be processed by Calendly, Gmail, Google Calendar and Kiku as part of arranging and managing your consultation. 

Arranging counselling and becoming a client 

If you decide you would like to work with me, I will contact you by email to explain the next steps. I will send you a form through Kiku, my practice-management system, asking for your name, email address and availability for sessions. I receive an email notification when you return this form. 

I will check your availability against mine and email you to offer a suitable session time.

Once you have confirmed the appointment, I will send you a welcome email explaining that you will receive an invitation to Kiku, where you will be asked to complete an initial contact information form, a Privacy Notice acknowledgement form and a Counselling Agreement.

Once you have completed the forms, Kiku sends me an email notification through Outlook. I access and review the completed forms within Kiku and do not routinely copy the information into separate records. Links to the completed forms remain within your client record in Kiku and can be accessed through my secure account. 

I use this information to establish our counselling agreement, maintain appropriate client records and manage the professional relationship. 

 

4. Information held during counselling 

If we begin working together, I will hold information needed to arrange and provide counselling and manage the professional relationship. This may include your contact details, relevant information you share during sessions, appointment records, communications, payment records and counselling notes. 

I keep separate paper process notes for reflective practice. These are stored securely in a locked filing cabinet and securely destroyed when counselling ends. They are separate from the client record held in Kiku, which includes relevant counselling records, agreements and administrative information. The client record is retained in accordance with the retention periods set out in Section 9. 

I take steps to protect the confidentiality and security of the information I hold. Information may be shared in limited circumstances, for example for supervision, safeguarding, where required by law, or with service providers who help me operate my practice. Further details are provided in the sections on confidentiality and information sharing. 

Emails, texts and other communications 

I retain relevant emails and text messages relating to enquiries, appointment arrangements, cancellations and the counselling relationship. I use email to communicate with clients about appointments and administrative matters. I use text messages only where necessary, such as when I need to cancel a session at short notice and have not received a response to email. 

Where a telephone call is necessary, including in circumstances involving concerns about risk, I will make an appropriate record of relevant information. 

I review electronic communications and delete those that I no longer need, while retaining relevant records in accordance with my record-retention arrangements and professional responsibilities. Information that forms part of the counselling record may need to be retained for the applicable retention period. 

Payments and financial records 

Payment for counselling sessions is made by bank transfer to my Mettle business account. I ask clients to use their name as the payment reference so that I can identify incoming payments. 

Mettle notifies me when a payment is received and provides information including the payer’s name, the date and time of the transfer, the amount paid and confirmation that the transfer has been made. 

I manually update the relevant session in Kiku to confirm that payment has been received. Kiku then sends the client a branded receipt. 

I use FreeAgent accounting software to maintain my business financial records. My accountant has access to FreeAgent to assist with preparing my tax returns and meeting my accounting and tax obligations. 

I use payment and financial information to manage session payments, issue receipts, maintain appropriate business records and meet my legal, accounting and tax responsibilities. 

​

5. Confidentiality, supervision and information sharing 

I treat the personal information you share with me as confidential and take care to protect your privacy throughout our work together. 

Supervision 

Supervision is an essential part of my professional practice. I attend regular supervision, usually monthly, to reflect on my counselling work, consider different perspectives and ensure I am working ethically and providing appropriate support to my clients. 

As explained during our contracting process, I discuss aspects of my counselling work with my supervisor. I take care to protect your identity and avoid sharing identifying details wherever possible. 

Where a specific risk or safeguarding concern arises, I may seek additional guidance from my supervisor to support my professional judgement and decision-making. This may involve sharing relevant details about your circumstances where necessary to understand the concern and consider appropriate next steps. 

Risk, safeguarding and other disclosures 

Where concerns arise about risk or safeguarding, I aim to discuss these with you openly and collaboratively wherever it is appropriate and safe to do so. 

There may be circumstances in which I need to share relevant information with an appropriate professional, service or authority without your agreement. Depending on the circumstances, this may also include contacting a parent or carer of a young person. This may be necessary where there is a serious risk of harm, a safeguarding concern or a legal obligation to disclose information. 

Where possible and appropriate, I will explain the reasons for any proposed disclosure and discuss the next steps with you. However, I may need to act without discussing the matter with you first if doing so could increase the risk of harm or would otherwise be inappropriate or unlawful. 

I aim to share only the information necessary for the relevant purpose and handle it in accordance with my professional and legal responsibilities. 

Service providers 

I use third-party services to support the operation and administration of my practice, including systems for managing appointments, communications, client records, video calls and payments. These providers may process personal information on my behalf to deliver their services. I take reasonable steps to consider their privacy and security arrangements and to ensure that personal information is handled in accordance with applicable data protection requirements. 

Transition to Konfidens 

I currently use Kiku as my practice management system to manage client records, session notes, appointments and related practice administration. I plan to migrate to Konfidens on 20 November 2026. Once the migration has taken place, Konfidens will replace Kiku as my practice management system. Relevant client and practice information will be transferred as part of this process so that I can continue to manage my counselling practice. I will continue to handle your information in accordance with this Privacy Notice and applicable data protection requirements. 

Konfidens – Practice Management System 

Following my planned migration from Kiku, I will use Konfidens as my practice management system to manage client records, session notes, appointment information and related practice administration data. I am the Data Controller for client records, and Konfidens will act as my Data Processor. 

Konfidens uses Amazon Web Services infrastructure, with client data stored on encrypted servers in Frankfurt, Germany. It also uses selected third-party providers to support its services, including video consultations, appointment reminders and transactional communications. Konfidens publishes a list of its subprocessors, including their purposes and processing locations, and states that appropriate safeguards are in place for any international transfers where required. 

 

 

6. International data transfers 

Some of the third-party services I use to operate my practice may process personal data outside the United Kingdom. Where this occurs, I take steps to ensure that any international transfers are carried out in accordance with applicable data protection law and that appropriate safeguards are in place where required. 

I use third-party providers to support practice management, communications, website hosting, scheduling and financial administration. Further information about how these providers process personal data, including any international transfers and applicable safeguards, is available in their privacy notices and data protection documentation. 

 

7. How I store and protect your information 

Paper records 

I keep paper reflective process notes and any paper resources created with clients during sessions in a locked filing cabinet. I access these only when needed for professional purposes, such as preparing for sessions, attending supervision or taking relevant materials to a client session at my therapy practice. 

I take care to keep these materials secure and confidential when accessing or transporting them, and to prevent unauthorised access. These paper materials are securely destroyed when counselling ends. 

Electronic records and security 

I use electronic systems to manage my counselling practice, including client record and appointment management systems, email, online booking tools, website hosting, calendar management and video-call services. These currently include Kiku, Outlook, Wix, Calendly, Google services and Google Meet. I currently use Google Meet for online counselling sessions. 

I take reasonable steps to protect electronic records and prevent unauthorised access to personal information. My computer and phone are protected by password or PIN access, and I use the security features available within the services I use to manage my practice. Kiku also provides two-factor authentication to help protect access to client information. 

I consider the security and privacy arrangements of the services I use to manage my practice. These providers may process personal information on my behalf to provide their services, in accordance with their applicable terms and privacy arrangements. 

Client records are normally stored within my practice management system, Kiku. Where necessary, I may download or export records, for example, to respond to a client's request for a copy of their information. Any downloaded or exported records will be handled securely and in accordance with my confidentiality and data protection responsibilities. 

Clinical executor arrangements 

In the event of my death or permanent inability to practise, I have made arrangements for a clinical executor to oversee the appropriate management of my clinical records and contact existing clients where appropriate. The clinical executor will be expected to maintain confidentiality and handle records securely, in accordance with applicable professional and data protection requirements. Records will be retained, transferred or securely disposed of as appropriate, taking account of applicable legal and professional obligations. 

 

8. How I use your information and the lawful basis for doing so 

Data protection law requires me to have a lawful basis for collecting and using your personal information. Where I process health information or other special category data, I must also meet an additional condition under data protection law. 

The lawful basis I rely on depends on the purpose for which I use your information. 

Purpose 

Article 6 — lawful basis 

Article 9 — condition for health information 

Responding to enquiries before you become a client 

Article 6(1)(b): taking steps at your request before entering into a contract. 

 

Article 9(2)(h), together with the relevant condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, where the processing meets the requirements for health or social care. 

 

Providing counselling and maintaining client records 

Article 6(1)(b): processing necessary to provide the counselling services agreed with you. 

Article 9(2)(h), together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, where applicable. 

 

Clinical supervision and reflective practice 

Article 6(1)(b), where processing is necessary to provide the counselling services agreed with you. 

 

Article 9(2)(h), together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, where applicable. 

 

Managing appointments and communications 

Article 6(1)(b), where processing is necessary to arrange and provide our agreed services. 

Where health information is included, the relevant Article 9 condition will also apply. 

Invoices, payments and financial records 

Article 6(1)(c): compliance with legal obligations, including applicable tax and accounting requirements. 

Not normally applicable to routine financial records. 

​

Safeguarding, serious risks and emergencies 

Depending on the circumstances, Article 6(1)(c): legal obligation; Article 6(1)(d): vital interests; or Article 6(1)(f): legitimate interests. 

Depending on the circumstances, this may include Article 9(2)(c): vital interests where the legal requirements are met; Article 9(2)(g), together with the relevant condition in Schedule 1, Part 2 of the Data Protection Act 2018; or Article 9(2)(h) where applicable. 

​

Establishing, exercising or defending legal claims 

Article 6(1)(f): legitimate interests, where appropriate. 

Article 9(2)(f): processing necessary for the establishment, exercise or defence of legal claims, where applicable. 

 

Mailing-list updates 

Article 6(1)(a): consent, where I rely on consent to send optional marketing emails. 

Not normally applicable. 

​

Non-essential website cookies 

Consent, where required under applicable data protection and electronic privacy rules. 

Not normally applicable. 

​

I take care to collect and use only the information needed for the relevant purpose. Where I rely on consent for a particular activity, you can withdraw that consent at any time. This does not affect the lawfulness of processing carried out before consent was withdrawn. 

Your data protection rights, including the circumstances in which you can request access to or deletion of your information, are explained in the Your data protection rights section of this Privacy Notice. 

 

9. How long I keep your information 

I keep personal information only for as long as it is needed for the purposes for which it was collected, taking account of my professional responsibilities and applicable legal requirements. 

Enquiries that do not lead to counselling 

If you enquire about counselling but decide not to proceed, I aim to securely delete your enquiry information within one month, unless there is a legitimate reason to retain it for longer. 

Counselling records 

When counselling ends, I archive your client record in my practice management system. I retain counselling records for at least seven years after the final session for adult clients. Where counselling takes place with a client who is under 18, I retain their records until they reach the age of 25. These retention periods take account of my professional responsibilities and the requirements of my professional indemnity insurance. 

Paper reflective process notes and session resources 

I keep paper reflective process notes and any paper resources created with clients during sessions securely in a locked filing cabinet. These materials are separate from the client record retained in Kiku and are securely destroyed when counselling ends. 

Financial and business records 

I retain payment and accounting records for the periods required to meet my legal, accounting and tax obligations. These records may need to be kept for a different period from counselling records. 

I review the information I hold and securely delete or destroy it when the applicable retention period has ended and there is no longer a justified reason to keep it. 

 

10. Cookies and website data 

My website is hosted using Wix. Wix uses essential cookies and similar technologies to support the website’s core functions, including security and network management. 

My website has a cookie banner that allows visitors to manage their preferences for essential, marketing, functional and analytics cookies. Essential cookies are required for the website to function. I ask visitors for consent before using non-essential cookies, including marketing, functional and analytics cookies. Visitors can accept, decline or manage their cookie preferences through the cookie consent banner on my website. 

I do not currently have any marketing integrations or custom tracking code configured on my website. However, Wix and any website features or apps in use may use cookies or similar technologies. The cookies used may depend on the features enabled on the website. 

You can also manage or block cookies through your browser settings. Please be aware that blocking essential cookies may affect how some parts of the website work. 

 

11. Your data protection rights 

You have rights in relation to the personal information I hold about you. Depending on the circumstances and the applicable legal requirements, these may include the right to: 

• Access your information: ask for a copy of the personal information I hold about you. 

• Correct your information: ask me to correct information that is inaccurate or incomplete. 

• Request deletion: ask me to delete your personal information where the legal conditions for erasure are met. 

• Restrict processing: ask me to limit how I use your information in certain circumstances. 

• Object to processing: object to certain uses of your information where the law provides this right. 

• Request data portability: ask to receive certain information you have provided to me in a reusable format, or have it transferred to another organisation, where the legal conditions are met. 

• Withdraw consent: where I rely on your consent to process particular information, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn. 

These rights are subject to certain conditions and exceptions. For example, I may need to retain some information to meet legal or professional obligations, or to establish, exercise or defend legal claims. A request to delete information does not automatically mean that all records can be deleted. 

If you would like to exercise any of these rights, please contact me at cerian.lyeowens@outlook.com. I may need to verify your identity before responding. I will respond within the timeframe required by data protection law. 

You also have the right to raise a concern with the Information Commissioner's Office (ICO) if you believe your personal information has not been handled appropriately. Information about how to contact the ICO is available at ico.org.uk.  

 

12. Complaints and contact details 

If you have any questions about this Privacy Notice or how I handle your personal information, or if you wish to exercise your data protection rights or raise a concern, please contact me: 

Cerian Lye-Owens, trading as Heartspace 

Email: cerian.lyeowens@outlook.com 

I will consider your concern and aim to resolve it appropriately. 

You also have the right to raise a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how I have handled your personal information. You can find guidance and contact details at https://ico.org.uk/.