Privacy Policy

 

Section A — Privacy & Data Protection (GDPR)

​

1. Who I am

Data Controller: Maria Howell, trading as Maria Howell Therapy & Counselling, a French sole trader (Entreprise Individuelle / EI).

Business address: Bureau 326, 78 Avenue des Champs-Élysées, France.

SIRET: 9 3 0 5 2 2 0 1 6

Email: maria.therapy@outlook.com

​

I am responsible for the personal information I collect and how it is used and protected in accordance with applicable data protection legislation, including the General Data Protection Regulation (UK: GDPR/France: RGPD).

​

2. What information I collect

Depending on whether you make an enquiry or become a client, I may collect:

• Enquiries: Your name and contact details, including email address and telephone number.

• Client records: Your name, contact details, relevant personal information you choose to share, and details of an emergency contact and healthcare provider where appropriate.

• Payment and invoicing information: Information necessary to process payments, issue invoices and meet French accounting and tax obligations.

• Therapy records: Relevant professional records necessary to support safe, ethical and effective therapeutic work.

I aim to keep records proportionate and limited to what is necessary. Session notes are kept in accordance with professional and legal obligations, with identifying information minimised wherever possible.

​

3. Why I collect and use your information

Your information is used solely for purposes connected with providing and managing your therapy, including:

• Arranging appointments and communicating with you.

• Maintaining appropriate professional records and supporting your care.

• Managing payments and invoicing.

• Meeting applicable legal, accounting and professional obligations.

• Addressing safeguarding or serious safety concerns where necessary.

I do not sell your personal information or use your therapy records for advertising.

 

4. Legal basis for processing

I process your personal information where necessary to provide the services you request, meet legal obligations, and pursue legitimate professional interests such as maintaining appropriate records and ensuring safe practice.

Information concerning your health or therapy may constitute special category personal data under GDPR. Where applicable, I rely on the relevant legal conditions for processing this information, including your explicit consent where required and any applicable healthcare or professional-services provisions.

​

5. How your information is stored and shared

I use third-party platforms to provide and administer my services, including:

• Google Meet and WhatsApp: Online therapy sessions and communications, where agreed.

• Carepatron: Client administration and management of relevant client records.

• VosFactures: Invoicing and payment-related records.

These providers process information in accordance with their own privacy policies and applicable data protection arrangements.

I take reasonable steps to protect your information from unauthorised access, loss or disclosure, including the use of password-protected devices and appropriate security measures.

Your information may be processed or transferred outside the European Economic Area, depending on the services used and their data-processing arrangements. Where applicable, appropriate safeguards are required for such transfers.

​

6. How long I retain your information

Client records are retained for the period necessary to meet professional, legal and accounting obligations.

My current retention policy is to retain client records for seven years after the end of therapy, after which they will be securely deleted, subject to any applicable legal requirements or circumstances requiring longer retention.

Financial and invoicing records may be retained for different periods where required by French law.

​

7. Your data protection rights

Under applicable data protection legislation, you may have the right to:

• Request access to your personal information.

• Request correction of inaccurate or incomplete information.

• Request deletion or restriction of processing, where applicable.

• Object to certain processing or withdraw consent where consent is the legal basis.

These rights are subject to legal and professional exceptions. For example, I may be required to retain certain records, and not all professional records can be altered or deleted on request.

To exercise your rights, please contact me at maria.therapy@outlook.com.

You also have the right to lodge a complaint with the CNIL (France's data protection authority): www.cnil.fr 

​

Section B — Confidentiality & Client Safety

​

1. Confidentiality

Confidentiality is central to our therapeutic relationship. Information you share during therapy is treated as confidential and is not disclosed to others without your consent, except where there is a lawful or ethically justified reason to do so.

Circumstances in which confidentiality may need to be limited include:

• Where there is a serious and imminent risk of harm to you or another identifiable person.

• Where safeguarding concerns arise involving a child or vulnerable adult.

• Where disclosure is required or authorised by law, including certain legal proceedings or valid court orders.

• Where there is a legal duty to report or prevent certain offences, subject to the applicable law.

Where possible and appropriate, I will discuss any proposed disclosure with you beforehand. Only information necessary for the relevant purpose will be shared.

​

2. Supervision and professional support

I attend regular professional supervision to maintain ethical, safe and effective practice, in accordance with BACP requirements.

Client material discussed in supervision is anonymised wherever possible, and identifying information is not shared unless there is a lawful and ethically justified reason.

​

3. Online sessions and your safety

Sessions may take place remotely using platforms such as Google Meet or WhatsApp, or through an integrated platform if you access my services via another provider.

You are responsible for ensuring that you have a reasonably safe and private environment for your sessions.

As remote therapy can limit my ability to respond to emergencies, please ensure that I have your current location or address, particularly if you are travelling or attending from a different location than usual.

In the event of an emergency, my ability to arrange assistance may be limited by your location and the local emergency services available. We will discuss appropriate arrangements where necessary.

​

4. Continuity of care

In accordance with BACP's Ethical Framework, I have appointed a trusted person to contact clients in the event of my death or an illness that prevents me from communicating with them.

This person is authorised to access the minimum personal information necessary to contact you and support you in making alternative arrangements for your care.

They will not routinely access your therapy notes or clinical records.

​

5. Concerns and complaints

If you have any concerns about your therapy or the way your information is handled, or that any information in this document is incomplete, incorrect or outdated, please contact me at maria.therapy@outlook.com

I welcome the opportunity to discuss concerns and will make reasonable efforts to address them or signpost you to an appropriate source of support.

You may also contact the CNIL regarding data protection concerns or the relevant governing body regarding professional conduct concerns.