Client Privacy Notice

How I collect, use and protect your personal information

Last updated: 22 July 2026

This notice applies when you work with me as a private client. If another organisation refers you, its privacy notice may also apply. I will explain how responsibility for your information is shared in that situation.

1. Who I am

Change Work with Rachel is operated by Rachel Andrews, a sole trader based in Lowestoft, Suffolk. I am the data controller for personal information I decide to collect and use in my private practice.

Privacy enquiries: changeworkwithrachel@gmail.com

ICO registration number: ZC204895

2. Information I may collect

I collect only information that is reasonably needed to work with you safely and provide the service you have requested. This may include:

  • your name, address, email address and telephone number;
  • your signed client agreement and appointment information;
  • your GP’s contact details and an emergency contact, where appropriate;
  • information you choose to share about your circumstances, wellbeing, health, relationships and experiences;
  • brief session notes; and
  • limited payment information, such as confirmation that a payment has been received. My accounts record private-client income as a monthly total and do not identify individual clients.

Some of this information may be ‘special category data’ under data-protection law because it concerns matters such as health, sexual life, sexual orientation, ethnicity, religion or beliefs.

3. Why I use your information

I use your information to:

  • decide with you whether my service is suitable for your needs;
  • enter into and fulfil our client agreement;
  • contact you and arrange sessions;
  • provide continuity and work with you safely;
  • keep appropriate professional records;
  • receive anonymised or non-identifying professional supervision;
  • respond to a serious safeguarding concern or an emergency; and
  • meet legal, regulatory, insurance and professional obligations.

4. Lawful reasons for using your information

For ordinary personal information, I normally rely on one or more of the following lawful bases:

  • contract — to take steps at your request and provide the service agreed with you;
  • legitimate interests — to run a safe, responsible practice, maintain appropriate records and protect or establish legal rights; and
  • legal obligation or vital interests — where the law requires action or where using information is necessary to protect someone’s life.

Where I use special category information, I also need an additional legal condition. I will generally rely on your explicit consent for its use in our work. In limited circumstances, another condition may apply—for example, where information is necessary to protect vital interests, establish or defend legal claims, or meet a lawful safeguarding requirement.

You may withdraw consent at any time by emailing me. This will not make earlier use of your information unlawful, and I may still need to retain or use limited information where another lawful basis applies.

5. Confidentiality and sharing

I treat what you tell me as confidential. I do not sell your information and I do not use client details for marketing.

I may discuss my work in professional supervision, but I do not use your name or intentionally share identifying details.

I would only share identifiable information without your agreement when there is a serious safeguarding concern, an immediate risk of serious harm, or a legal requirement to do so. Depending on the circumstances, this could involve your GP, emergency services or another appropriate authority. Where it is safe and lawful, I will try to discuss this with you first.

I may also share the minimum information necessary with professional advisers, insurers or legal representatives if required to deal with a complaint or legal claim.

6. How your information is protected

Your main client file is kept on paper in a locked filing cabinet. Session notes are identified by a client code rather than your name. Identifying information is kept separately from coded notes as far as practicable.

I do not maintain a digital client-record system. Limited contact and appointment information may temporarily appear in email, Calendly, Google Calendar, my telephone or banking records while it is needed for administration. I minimise this information and delete it when it is no longer required, subject to provider backup periods and any legal obligation to retain it.

7. How long I keep information

At the end of our work, I normally destroy your paper contact details, GP details and client agreement, and delete your telephone number and unnecessary electronic correspondence, unless there is a specific legal, insurance or professional reason to retain something for longer.

Coded session notes are normally kept for at least seven years after our work ends. They may be retained for longer where this is reasonably necessary for professional, insurance or legal-claims purposes. Retention will be reviewed periodically, and records will be securely destroyed when they are no longer needed.

8. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • ask whether I hold personal information about you and receive a copy;
  • ask for inaccurate or incomplete information to be corrected;
  • ask for information to be erased or its use restricted;
  • object to certain uses of your information;
  • ask for certain information to be transferred; and
  • withdraw consent where consent is the basis relied upon.

These rights are not absolute. For example, I may need to retain information to meet a legal obligation or establish, exercise or defend legal claims. To make a request, email changeworkwithrachel@gmail.com.

9. Questions or complaints

Please contact me first at changeworkwithrachel@gmail.com if you have a privacy question or concern, so I can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk or 0303 123 1113.

10. Changes to this notice

I may update this notice if my services, working practices or legal obligations change. The date at the beginning shows when it was last revised. I will tell current clients about any significant change that affects how their information is used.