1. Introduction

At SixtyOne Counselling, we take your privacy and the security of your personal data incredibly seriously. This policy outlines how we collect, store, process, and protect your personal information, clinical notes, and financial data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

​

 

2. The Data Controller and Data Processor

• Data Controller: SixtyOne Counselling is the Data Controller of your records. This means we determine how and why your information is collected and used.

• Data Processor: We utilise Halaxy, a secure, cloud-based practice management system, as our Data Processor to host and manage our clinical records and scheduling.

​​

 

3. What Information We Collect and Why

To provide you with safe, effective, and professional healthcare services, we must collect and process the following information:

• Personal Details: Your name, date of birth, address, phone number, and email address (used for communication, billing, and identity verification).

• Clinical Records: Detailed clinical notes, medical histories, referral letters, and treatment plans (collected to provide continuity of care and meet our professional regulatory standards).

• Financial Details: Payment card information, transaction histories, and invoice data (processed securely to facilitate payments for services rendered).

​​

 

4. How Your Data is Protected and Stored

All your data is handled with bank-grade security protocols:

• Data Transmissions: All information sent between our devices and the database is secured using 256-bit encryption.

• UK Data Residency: In accordance with the UK GDPR, all of your personal and clinical data is stored in secure, designated European data centres managed by Amazon Web Services (AWS) and is never transferred outside the UK/EEA without compliant safeguards.

• Strict Access Control: Access to your records is strictly restricted to authorised clinical and administrative staff who are bound by confidentiality agreements. We maintain digital audit logs tracking every time a file is accessed.

​​

 

5. How Your Financial and Card Details are Handled

To guarantee maximum financial security, we operate a zero-visibility policy for payment card details:

• Tokenisation: When you provide your debit or credit card details (via our online booking system, intake forms, or patient portal), the data is immediately sent to a secure, tier-one payment gateway (such as Stripe or Airwallex).

• No Direct Storage: The payment provider encrypts and tokenises your card details. SixtyOnce Counselling and Halaxy do not store, and cannot view or access, your full credit card number or CVV code.

• Immutable Security: Because your details are securely tokenised, they cannot be modified if they change. If you need to update a card or change an expiry date, the old token must be completely deleted and a new card registered from scratch.

​​

 

6. Data Sharing and Third Parties

• Commercial Opt-Out: While some cloud software platforms reserve the right to aggregate and de-identify data for external research, SixtyOne Counselling maintains strict clinical boundaries. We do not participate in or permit the commercial aggregation of your individual clinical information by third parties.

• Legal Exceptions: We will never share your data with third parties unless:

  • You explicitly consent or request us to do so (e.g., writing a letter to your GP or insurer).

  • We are legally compelled to do so by a court order or regulatory body.

  • There is an immediate, serious risk of harm to yourself or others.

​​

 

7. Data Retention

In line with UK medical record retention guidelines and legal obligations, clinical notes are securely archived and retained for a minimum period of 7 years following your last appointment (or, in the case of minors, until the individual reaches the age of 25). Once this retention period expires, records are permanently and securely destroyed.

​

 

8. Your Legal Rights

Under the UK GDPR, you hold several rights regarding your data, including:

• The right to request a copy of the personal and clinical data we hold about you (Subject Access Request).

• The right to request the correction of any inaccurate or incomplete information.

• The right to lodge a formal complaint with the Information Commissioner’s Office (ICO) if you believe your data has been mishandled.

​

​

​

​

1. What are cookies?
Cookies are small fragments of data stored on your browser when you visit our website. They help the website remember your actions and preferences over time. 

​

2. How we use cookies
Because this website is hosted on the Wix platform, it utilises Wix's default system cookies. As we do not run external marketing trackers or analytics pixels, we only employ cookies for the following operational purposes: 

• Essential & Security: To provide a safe and stable environment, verify your identity, prevent fraud, and ensure the website loads reliably.

• Functional: To remember your choices and preferences (such as language or cookie consent selections). 

​​

3. The cookies we deploy
Our site relies on standard Wix-deployed cookies, which include:

• XSRF-TOKEN & hs: Essential cookies used strictly for security purposes.

• SSR-caching: Used to track system performance and speed up site loading.

• bSession: Used for system effectiveness measurement.

• consent-policy: Stores your choices made on our cookie banner.

​​

4. Managing your preferences
When you first visit our site, a cookie consent banner will appear allowing you to accept or decline cookies. You can also alter your browser settings to block or delete cookies entirely at any time, though this may impact how our website functions.