Privacy Notice
Last updated: 19 August 2026
I take your privacy, confidentiality and the security of your personal information seriously.
This Privacy Notice explains how I collect, use, store and protect personal information when you visit this website, contact me about therapy or become a client.
I process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, and other applicable UK data-protection legislation.
Who is responsible for your information?
The data controller is:
Stanka Krnacova, MA DipHIP, UKCP
UKCP Registered Psychotherapist
Certified Relational Life Therapy Couples Therapist
33 Gay Street
Bath
BA1 2NT
Email: info@psychotherapyandcounsellingbath.com
Telephone: 07897 601897
As the data controller, I am responsible for deciding how and why your personal information is collected and used.
ICO registration number:
What information I may collect
Depending on how you contact me and whether you become a client, I may collect information including:
your name and contact details;
telephone number and email address;
information contained in an enquiry or contact form;
appointment and attendance information;
information provided during consultations and therapy;
relevant personal, relationship and family history;
information about health, mental health, sexuality, relationships or other sensitive areas where relevant to the therapeutic work;
therapy notes and clinical records;
correspondence between us;
payment, invoice and accounting information;
information needed for safeguarding or risk management;
technical information generated when you use this website, such as IP address, device information and website activity where cookies or analytics have been accepted.
In couples therapy, information may sometimes be provided about you by your partner as part of the therapeutic process. Each partner remains entitled to appropriate protection of their own personal information.
Because psychotherapy can involve information about health, sexuality and other sensitive areas, some information I process may constitute special category data under UK data-protection law. The UK GDPR requires both an Article 6 lawful basis and an appropriate Article 9 condition when special category information is processed.
Why I use your information
I use personal information only where it is relevant and necessary for purposes including:
responding to enquiries;
deciding whether my services may be appropriate for you;
arranging and managing appointments;
providing couples therapy, psychotherapy and Couples Intensives;
maintaining appropriate clinical records;
communicating with you about your therapy;
managing payments, invoices and accounting;
maintaining professional, ethical and safeguarding standards;
obtaining professional supervision while protecting client identity wherever reasonably possible;
responding appropriately where there is a serious concern about safety or safeguarding;
complying with legal, regulatory, insurance or professional obligations;
maintaining the security and effective operation of this website.
I do not sell client information to third parties.
My lawful bases for processing
For ordinary personal data, the lawful bases I may rely on include:
Contract and steps before entering into a contract — where processing is necessary to respond to an enquiry, arrange therapy and provide the professional service you have requested.
Legal obligation — where I am required to retain or disclose information in order to meet a legal obligation, for example certain financial or safeguarding requirements.
Legitimate interests — where necessary for the reasonable administration, security and protection of my private practice, provided those interests do not override your rights and interests.
Vital interests — in exceptional circumstances where using information is necessary to protect somebody’s life.
Where information is classed as special category data, I will also identify an appropriate Article 9 condition. For information necessary to provide confidential psychotherapeutic care, this may include the health or social care condition under Article 9(2)(h) where the legal requirements for that condition are met. ICO guidance confirms that this condition can apply to confidential care where the processing is necessary for health or social care and the person processing it owes an appropriate professional or legal duty of confidentiality.
In other circumstances another lawful condition, such as explicit consent, vital interests or the establishment, exercise or defence of legal claims, may apply where legally appropriate.
Confidentiality
Psychotherapy is confidential.
I handle information disclosed during therapy with care and in accordance with my professional responsibilities as a UKCP Registered Psychotherapist.
There are circumstances where confidentiality may need to be limited, for example where:
there is a serious concern about the safety of you or another person;
safeguarding obligations arise;
disclosure is required by law or a court;
information is required for the establishment, exercise or defence of a legal claim.
Where reasonably possible and appropriate, I would aim to discuss a necessary disclosure with you beforehand.
UKCP expects registered therapists to explain confidentiality arrangements and how information held about clients is used and stored.
Couples therapy and information about partners
Couples work sometimes creates particular confidentiality considerations because information relates to more than one person.
Information disclosed in a couples session may form part of the clinical record for the couples work. If either partner later makes a request for access to personal information, I must also consider the privacy and confidentiality rights of the other partner and of any third parties.
Individual meetings that form part of couples therapy remain part of the overall couples-therapy process. I will explain any specific arrangements concerning individual conversations and confidentiality before such meetings take place.
Professional supervision
Clinical supervision is an important part of responsible psychotherapy practice.
I may discuss aspects of my therapeutic work with a professional supervisor to support safe, ethical and effective practice.
Where possible, identifying information is minimised and clients are not routinely identified by full name.
My supervisor is also bound by professional confidentiality requirements.
How your information is stored and protected
I take reasonable organisational and technical measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
Information may be stored using secure electronic systems and, where applicable, securely stored paper records.
Services currently used in running the practice may include:
Squarespace for website hosting and enquiry forms;
Google Workspace/Gmail for practice email;
Microsoft OneDrive for secure electronic file storage;
Zoom where online consultations or therapy sessions are provided;
Google Analytics and Google Ads where you have consented to the relevant website cookies;
professional accounting or payment services where required.
These organisations may act as data processors or independent controllers depending on the service involved.
I limit the information shared with service providers to what is reasonably necessary for the relevant purpose.
International transfers
Some technology providers I use may process or store information outside the United Kingdom.
Where personal data is transferred internationally, I take reasonable steps to ensure that an appropriate legal mechanism is in place, such as a UK adequacy regulation or approved contractual safeguards where required.
How long I keep information
I do not keep personal information for longer than is reasonably necessary for the purpose for which it was collected, taking account of professional, legal, insurance and regulatory considerations.
For adult client clinical records, my general retention period is seven years after the therapeutic work ends, unless there is a specific reason to retain information for longer or a different period is required.
Enquiries that do not proceed to therapy are retained only for a reasonable period needed to manage the enquiry and related administration.
Financial and accounting information is retained for the period required by relevant tax and accounting obligations.
At the end of the appropriate retention period, information is securely deleted or destroyed unless there is a documented reason why it needs to be retained for longer.
UKCP states that members will normally retain records for seven years as general best practice, while noting that individual UKCP colleges, organisational members and professional insurers may have different requirements.
Website, analytics and cookies
This website is hosted by Squarespace.
The website may use cookies and similar technologies for essential website functions, security, analytics and advertising measurement.
Where cookies are not strictly necessary, they should only be placed after you have given the appropriate consent.
I currently use services including Google Analytics and Google Ads to understand website use and measure advertising performance where the required cookie consent has been provided.
You can change or withdraw your cookie choices through the website's cookie settings.
ICO guidance requires website operators to explain what cookies do and, for non-essential cookies such as many analytics or advertising cookies, obtain active consent before they are set.
Contact forms and sensitive information
Please avoid including more sensitive personal or relationship information than is necessary when first contacting me through the website.
A brief description of what you are looking for is sufficient.
More detailed personal information can be discussed during an appropriate consultation rather than sent through the initial website enquiry form.
Sharing your information
I do not routinely disclose your personal information to other people or organisations.
Information may be shared where necessary with:
service providers acting on my behalf;
professional supervisors;
accountants or professional advisers where appropriate;
another healthcare or safeguarding professional where necessary and legally appropriate;
emergency services or safeguarding authorities where there is a serious safety concern;
legal advisers, insurers, courts or regulatory bodies where required;
other third parties where you have specifically authorised disclosure.
Any disclosure is limited to what is reasonably necessary in the circumstances.
Your data-protection rights
Depending on the circumstances and the lawful basis being relied upon, you may have rights including:
the right to be informed about how your information is used;
the right to request access to personal information held about you;
the right to request correction of inaccurate information;
the right to request erasure in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to object to certain types of processing;
the right to data portability where applicable;
rights relating to automated decision-making where applicable;
the right to withdraw consent where processing is based on consent.
These rights are not absolute and may be limited in some circumstances, including where information must be retained for legal, professional or third-party confidentiality reasons.
Your right to object
Where I process your personal information on the basis of legitimate interests, you have the right to object to that processing.
You can contact me using the details at the top of this notice if you want to exercise a data-protection right.
Requests for access to information
You may ask for a copy of personal information I hold about you.
Where records also contain information about another person — which can arise particularly in couples therapy — I may need to consider that person's privacy and confidentiality before information can be disclosed.
I may ask for information necessary to confirm your identity before responding to a request.
Changes to this Privacy Notice
I may update this Privacy Notice from time to time to reflect changes in my practice, technology, professional guidance or data-protection requirements.
The most recent revision date will appear at the top of this page.
Questions or concerns
If you have questions about how your personal information is used, or you wish to exercise your data-protection rights, please contact:
Stanka Krnacova
info@psychotherapyandcounsellingbath.com
07897 601897
If you are unhappy with how your data-protection concern has been handled, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. The ICO requires this right to be included in privacy information provided to individuals.