Privacy Policy

Malgorzata Miernik · Gosia Counselling & Psychotherapy

www.gosiacounselling.com · [email protected]

ICO Registration: ZA537944 · Last updated: May 2026

Your privacy and safety matter deeply to me. This policy explains how I collect, use, and

protect your personal information in accordance with the Data Protection Act 2018 and the UK

General Data Protection Regulation (UK GDPR). As a fully online practice working with clients

across the UK, Europe, and worldwide, I am committed to being transparent about how your

data is handled.

1. Who I Am — Data Controller

The person responsible for your data (the 'Data Controller') under UK GDPR is:

Malgorzata Miernik – Gosia Counselling & Psychotherapy

Norwich, NR1 1GJ, United Kingdom

Email: [email protected]

Website: www.gosiacounselling.com

ICO Registration Number: ZA537944

2. What Information Do I Collect?

When you begin working with me as a client, I will ask you to provide:

• Full name

• Email address

• Telephone number

• Date of birth

• General health information

• GP details

If you complete a contact form, survey, or sign up to my mailing list, I will collect your name and email

address for the purposes described below.

When you visit my website, it automatically collects certain technical information such as your IP address,

browser type, and pages visited. This is standard for all websites and is handled by Wix, my website host.

3. What Do I Use Your Information For?

I process your personal data for the following purposes. The legal basis for each is noted in italics.

To provide counselling and psychotherapy services

Legal basis:

Contract — Art. 6(1)(b) UK GDPR; explicit consent for health data — Art. 9(2)(a) UK GDPR

To schedule and manage appointments and notify you of any changes

Legal basis: Contract — Art. 6(1)(b) UK GDPR

To seek feedback on your experience and improve my service

Legal basis: Legitimate interests — Art. 6(1)(f) UK GDPR

To send updates, courses, and workshops (only if you have subscribed to my mailing list)

Legal basis: Consent — Art. 6(1)(a) UK GDPR. You may withdraw consent at any time.

To follow up with survey participants who have given their permission

Legal basis: Consent — Art. 6(1)(a) UK GDPR

To run Facebook and Instagram advertising to reach people who may benefit from my services

Legal basis: Legitimate interests — Art. 6(1)(f) UK GDPR

4. Third-Party Services I Use

I use a number of trusted third-party tools to run my practice and website. Each processes data on my behalf

and has its own privacy policy, linked below where relevant.

Wix — Website Hosting

My website is hosted by Wix.com. Wix processes technical data about your visit (IP address, browser type, pages

visited) as part of standard website hosting. Wix's privacy policy: wix.com/about/privacy

Zoom — Online Sessions

All counselling sessions are conducted online via Zoom. While I take every precaution to ensure security, please

use a private, secure internet connection for all sessions. Zoom's privacy policy: zoom.us/privacy

Calendly — Appointment Booking

I use Calendly to manage appointment scheduling. If you book through Calendly, their privacy policy applies to data

processed on their platform: calendly.com/privacy

Google Analytics — Website Analytics

My website uses Google Analytics to understand how visitors use the site. This data is anonymised and aggregated.

You can opt out via your browser settings or Google's opt-out tool. Google's privacy policy:

policies.google.com/privacy

SOMBA.io — Email Marketing & Newsletter

If you subscribe to my mailing list, your name and email address are stored securely in SOMBA.io, my email

marketing platform. You can unsubscribe at any time via the link in any email. Your data will be removed within 30

days of your request. I will never sell your data.

Meta Platforms — Facebook & Instagram Advertising

I run advertising on Facebook and Instagram and use the Meta Pixel on my website to measure how people find

me. This may involve processing of your data by Meta Platforms, Inc. You can manage your ad preferences in your

Facebook settings. Meta's privacy policy: facebook.com/privacy/policy

Social Media — Facebook, Instagram, LinkedIn

My website contains links to my social media profiles. Once you leave gosiacounselling.com, the privacy policy of

the relevant platform applies. I do not collect personal data through social media on your behalf.

AI Writing Tools — Claude (Anthropic)

I occasionally use AI tools to help create content such as social media posts, newsletters, and website copy. I do

not enter identifiable client data into these tools — any client feedback used is fully anonymised first. Anthropic's

privacy policy: anthropic.com/privacy | OpenAI's privacy policy: openai.com/privacy

5. Online Sessions & Confidentiality

All counselling sessions are conducted online via Zoom and are held in strict confidence. Brief session notes

are kept in accordance with the BACP Ethical Framework. When I discuss my work in clinical supervision, I

use only your first name — nothing that could identify you.

I will not share information about you with third parties except in these situations:

• Risk of serious harm — if I have reason to believe sharing information may prevent serious harm to you or

another person, including safeguarding adults or children.

• Legal compliance — where I am required to share information by law, such as cases involving terrorism,

fraud, or money laundering.

6. How Do I Keep Your Information Safe?

• Session notes and client records are stored securely in encrypted electronic storage on an external hard

drive and retained for 7 years as required by my insurance provider, after which they are permanently

deleted.

• Your contact details are stored electronically and deleted within one month of your last session.

• Emails and messages are deleted within one month of sending.

• Appointments managed through Calendly are subject to Calendly's own privacy policy.

• Mailing list data is stored and managed via SOMBA.io.

7. How Long Do I Keep Your Data?

I keep your data only for as long as necessary for the purpose it was collected, or as required by law or

professional standards:

• Session notes and clinical records — 7 years from the end of our work together (required by professional

insurance).

• Contact details and correspondence — deleted within one month of your last session.

• Mailing list data — deleted within 30 days of an unsubscribe request.

• Website analytics data — managed by Google Analytics per their data retention settings.

8. International Data Transfers

Some of the third-party services I use — including Zoom, Google, Meta, and AI tools — are based in the

United States and may transfer your data outside the UK/EEA. Where this happens, these companies

operate under appropriate safeguards such as Standard Contractual Clauses or the UK-US Data Bridge,

ensuring your data is protected to a standard equivalent to UK GDPR. You gave your consent to these

transfers when you submitted your data to me.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, please contact me at

[email protected].

• Access — request a copy of any personal information I hold about you.

• Rectification — ask me to correct inaccurate or incomplete information.

• Erasure — request deletion of your data, subject to my legal and professional obligations.

• Restriction — ask me to limit how I use your data in certain circumstances.

• Portability — receive your data in a structured, machine-readable format.

• Object — object to processing based on legitimate interests or for direct marketing.

• Withdraw consent — at any time, for any processing based on consent (please note that withdrawing

consent for counselling data would require ending our work together).

• Complain — lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303

123 1113.

10. Website & Cookies

My website is hosted on Wix and uses cookies to improve your experience. These include essential cookies

needed for the site to function, and analytics cookies via Google Analytics to understand how visitors use the

site. You can manage or disable cookies through your browser settings at any time.

The Meta Pixel is also installed on my website to help measure the effectiveness of my Facebook and

Instagram advertising. You can opt out of this tracking via your Facebook ad settings or a browser extension

such as uBlock Origin.

My website may contain links to third-party websites — once you leave gosiacounselling.com, I am not

responsible for those sites' privacy practices.

11. Changes to This Policy

I may update this policy from time to time to reflect changes in my practice, the tools I use, or legal

requirements. Any significant changes will be communicated to you as soon as possible. The current version

is always available on my website at www.gosiacounselling.com.

12. Contact Me

If you have any questions about this privacy policy or how I handle your data, please do not hesitate to get in

touch:

Malgorzata Miernik — Gosia Counselling & Psychotherapy

Email: [email protected]

Website: www.gosiacounselling.com

ICO Registration: ZA537944