Privacy & data protection
Privacy Notice
A clear explanation of what personal information I collect, why I use it, how I protect it and the choices you have.
Who is responsible for your data
Lilian Pilgrim, trading as SomaSoul Counselling
I am the independent data controller for the personal information described in this notice. I am registered with the Information Commissioner's Office under reference ZB280635.
This notice explains data protection. Therapeutic confidentiality is also addressed in the counselling agreement and within the professional and ethical framework that governs my practice.
Counselling and privacy enquiriestherapy@lilianpilgrim.co.uk
Workshop and group enquiriesworkshops@lilianpilgrim.co.uk
Telephone+44 7485 284509
What I may collect
Only the information needed for the relationship or service you choose.
The information involved depends on whether you make an enquiry, begin counselling, book a Family Constellation session, register interest in a workshop or simply use the website.
Enquiries
Your name, contact details, preferred way to be contacted and the information you choose to include in an email, form, telephone call or initial consultation.
This will usually come directly from you. If a GP, therapist or trusted person contacts me on your behalf, I may receive your name, contact details and a brief reason for the referral. I will make this notice available to you and check that you wish to continue.
Counselling and individual sessions
Contact and administrative information, the agreement between us, appointment and payment records, and relevant correspondence.
I do not routinely create clinical or process notes of counselling or Family Constellation sessions.
Workshops and groups
Your first name, email address, the workshop or group selected, preferred location and a record of your consent to receive relevant updates. If you later book, I may also hold booking, attendance and payment information.
Website and administration
Technical information needed to operate and protect the website, form submissions, scheduling information and records required for accounting, security or legal obligations.
Sensitive information
What you share in an enquiry or therapeutic conversation may include information about health, relationships, sexuality, beliefs, racial or ethnic origin, or other private aspects of your life. I ask only for information that is relevant, and you do not need to disclose more than feels appropriate at the stage you are in.
Do you have to provide information?
You decide whether to contact me or register workshop interest. If you choose to begin a service, I need enough contact, scheduling and payment information to manage it, together with any information reasonably needed to work safely and professionally. If this information is not provided, I may be unable to offer or continue the service. Workshop email registration is entirely optional.
Why I use information
A specific purpose and a lawful basis.
I do not sell personal information. I do not use counselling information for advertising, and workshop email consent is not treated as consent to receive general counselling marketing.
To respond and consider working together
To reply to enquiries, arrange an initial call and take steps you request before entering into an agreement.
Lawful basis: steps before a contract and legitimate interests in managing enquiries safely.
To provide counselling or a booked service
To arrange and deliver sessions, communicate about appointments, receive payment and maintain the professional relationship.
Lawful basis: performance of a contract. For special category information, the additional condition is your explicit consent initially. If limited information later needs to be retained in connection with a complaint or legal claim, the applicable legal-claims condition may be used.
To send workshop or group updates
To contact you only about the workshop or group interests you selected. Registering interest is not a booking.
Lawful basis: consent. You can withdraw it at any time by using the unsubscribe link or contacting me.
To meet legal, ethical and safety responsibilities
To maintain financial records, protect the website, respond to legal claims and act when disclosure is required by law or necessary to protect life.
Lawful basis: legal obligation, legitimate interests or vital interests, depending on the circumstances.
Sharing and confidentiality
Information is not shared casually.
I may use trusted providers to support the practical running of the service. These may include website and email hosting, scheduling and video-call platforms, banking and accounting services, encrypted devices and backups, and Mailchimp for workshop or group email registrations.
These providers receive only the information needed for their function and act under their own data protection obligations or under arrangements requiring them to protect personal data.
- IONOS — website hosting and business email; this may involve website data, contact details and messages.
- Wordfence (Defiant, Inc.) — website firewall and security monitoring; this may involve IP addresses, browser or device information, requested URLs and security-event logs.
- Calendly — initial-call and appointment scheduling; this may involve your name, email address and booking details.
- Google Meet or WhatsApp — online video or voice sessions and related communication, where agreed with you. Depending on the service used, this may involve your name, email address or telephone number, account information, messages and technical connection data.
I do not make audio recordings, video recordings or transcripts of counselling or Family Constellation sessions. - Intuit Mailchimp — workshop and group interest emails; this involves the name, email address, selected interests, preferred location and consent record you submit.
- Banking and accounting providers — payments are arranged separately from the website. These providers may process payment references, invoices and records that I must keep for accounting or tax purposes.
Professional supervision is an important part of ethical practice. Client material is discussed without identifying details wherever possible. Identifying information would only be used when necessary and ethically justified.
How long I keep information
Not forever, and not without a reason.
Retention periods may occasionally be extended where information is needed for an active complaint, legal claim, safeguarding matter or another legal requirement.
| Information | Usual retention | Reason |
|---|---|---|
| Enquiries that do not become a service | Up to 6 months after the last contact | To answer follow-up questions and manage enquiries responsibly. |
| Counselling or individual-session agreements and administrative correspondence | Usually up to 3 years after the work ends | To respond to questions or complaints connected with the service. This period is reviewed against professional and data-protection requirements. |
| Clinical or process notes | Not applicable | I do not routinely create clinical or process notes of sessions. |
| Workshop or group interest registrations | While you remain subscribed and the selected offering is active; reviewed at least annually | To send the updates you requested. Inactive records will normally be deleted or anonymised after 24 months without a relevant update. |
| Workshop booking and attendance administration | Usually up to 3 years after the event | To manage the event and respond to related queries or claims. |
| Invoices, payments and tax records | For the period required by HMRC, normally at least 5 years after the relevant Self Assessment deadline | To meet accounting and tax obligations. |
| Website security logs | Normally up to 30 days | To detect, investigate and block malicious or suspicious activity. |
| Unsubscribe or suppression record | As long as needed to respect your choice | To avoid sending email after you have opted out. |
Security and location
Reasonable safeguards, proportionate to the information held.
Information is stored electronically using password-protected accounts, secured devices and reputable service providers. Access is limited to what is needed for the work and administration of the practice.
Some providers, including scheduling and email-marketing services, may process information outside the United Kingdom. Where this occurs, I take reasonable steps to use providers that rely on recognised safeguards such as UK adequacy regulations, approved contractual clauses or the UK International Data Transfer Agreement or Addendum.
No method of electronic storage or communication can be guaranteed completely secure. If a personal data breach creates a risk to you, I will take appropriate steps and notify you or the ICO where required.
Website, cookies and external services
What may happen when you use the website.
The website uses cookies or similar technologies only where needed for security, forms, accessibility and basic operation. At the date of this notice, I do not use Google Analytics, advertising pixels or behavioural profiling on this website.
If you choose the readable-font option, the website stores that preference in your browser so it can remember your choice. It is not used for analytics, advertising or profiling.
This website does not take payments or collect debit-card, credit-card or online-banking details. If you become a client or book a service, payment arrangements are provided separately.
When you use or follow a link to Calendly, Mailchimp, Google Meet, WhatsApp, a social media platform or another external service, that organisation also processes information under its own privacy notice. You can review its privacy information before using the service.
I do not use automated decision-making to decide whether you can access counselling, a session, workshop or group.
Your information, your rights
You can ask questions and exercise your data protection rights.
Depending on the information and the reason it is processed, you may have the right to:
- ask for a copy of your personal information;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased in certain circumstances;
- ask for processing to be restricted;
- object to processing based on legitimate interests;
- ask for portable data where the legal conditions apply;
- withdraw consent at any time, without affecting earlier lawful processing;
- complain to the Information Commissioner's Office.
I will normally respond to a valid rights request within one month. I may need to confirm your identity before releasing or changing personal information.
Questions or concerns
Please contact me first if something does not feel clear or correct.
I will take your concern seriously and try to resolve it. You also have the right to contact the UK Information Commissioner's Office.
ICO helpline: 0303 123 1113
Website: ico.org.uk