Privacy policy
Last updated: 4 August 2026
This Privacy and Cookie Policy explains how Oriana Lauria Therapy ("I", "me", "we", "my practice") collects, uses, stores, and protects your personal data when you visit the website orianalauriatherapy.com (the "Site") or engage with me as a counselling client. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
I take the confidentiality of client information extremely seriously, in line with my professional and ethical obligations as a member of BACP.
--
1. Who I Am (Data Controller)
I am the data controller for the personal data described in this policy.
- Name: Oriana Lauria
- Email: contact@orianalauriatherapy.com
- ICO Registration Number: ZC017153
If you have any questions about this policy or how your data is handled, please contact me using the details above.
---
2. What Personal Data I Collect
Depending on how you interact with me, I may collect:
a) General enquiry/website data
- Name, email address, and (optionally) phone number entered via the Site's enquiry form.
- Any personal information you choose to share in the free-text field of the enquiry form — for example, a brief description of what's bringing you to counselling. This may include details about your mental health or personal circumstances, which is treated as special category data (see below) even at enquiry stage, before you become a client.
- Content of any follow-up messages sent via email
- Technical data (IP address, browser type, device information) collected automatically via the Site
b) Client data (if you become a client)
- Contact and identifying details (name, address, date of birth, emergency contact)
- Session notes and clinical records
- Information about your mental health, wellbeing, relationships, and personal history shared in sessions
- GP or referring clinician details (where relevant)
- Payment and invoicing information
Information in category (b), and any sensitive information volunteered in an enquiry form under category (a), relating to your health and mental/emotional wellbeing is classed as "special category data" under Article 9 of UK GDPR, and is treated with additional care and stricter safeguards, as set out below.
Enquiry form submissions are delivered to me via Squarespace and stored either within the Squarespace platform and/or forwarded to my email inbox, both of which are password-protected.
---
3. Lawful Basis for Processing
I rely on the following lawful bases:
| Data type | Lawful basis (Article 6) | Special category basis (Article 9, where relevant) |
| Enquiry/contact data (name, email, phone) | Legitimate interests (responding to enquiries) | — |
| Personal details volunteered in enquiry form free-text | Legitimate interests / consent (you choose to share this) | Explicit consent (Article 9(2)(a)) — by voluntarily including this information, you consent to my processing it in order to respond to your enquiry |
| Contract/session administration | Performance of a contract (our counselling agreement) | — |
| Clinical/session notes | Performance of a contract | Explicit consent (Article 9(2)(a)) and/or provision of health/social care (Article 9(2)(h)) |
| Website analytics | Consent (via cookie banner) | — |
| Marketing emails (if applicable) | Consent | — |
Where I rely on consent, you may withdraw it at any time. Withdrawing consent for clinical data processing may affect my ability to continue providing counselling to you, and this will be discussed with you directly.
---
4. How I Use Your Data
I use your personal data to:
- Respond to enquiries and arrange initial consultations
- Provide, manage, and record counselling sessions
- Maintain accurate clinical records in line with professional body requirements
- Process payments and invoicing
- Meet legal, regulatory, insurance, and safeguarding obligations
- Communicate with your GP or other professionals, only with your explicit consent, except where I am legally required to share information (e.g. safeguarding risk to you or others)
- Understand how visitors use my Site (via analytics, with your consent)
I do not use your clinical data for automated decision-making or profiling.
---
5. Confidentiality and Sharing of Information
Client sessions are confidential. I will not share identifiable information about you with third parties except:
- With your explicit written consent
- Where I am required by law (e.g. court order)
- Where there is a serious risk of harm to you or another person (safeguarding duty), consistent with my professional body's ethical framework
- With my clinical supervisor, for the purposes of supervision — supervision discussions are anonymised where possible and my supervisor is bound by the same confidentiality standards
Third-party service providers who may process data on my behalf (as data processors) include:
- Squarespace — website hosting and forms provider
- Google Analytics — website usage analytics
These providers only process data under my instruction and are contractually required to keep it secure.
---
6. International Data Transfers
Some third-party providers (including Squarespace and Google) may store or process data on servers located outside the UK, including in the United States. Where this occurs, I ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement (IDTA) or adequacy regulations, and that the provider is certified under an approved data protection framework (e.g. the UK-US Data Bridge).
---
7. Data Retention
- Clinical/session records are retained for 7 years after the end of therapy, in line with guidance from BACP and my professional indemnity insurer.
- Enquiry data from people who do not become clients is deleted after 12 months.
- Financial records are retained for 6 years in line with HMRC requirements.
- Website analytics data is retained according to Google Analytics' default retention settings (currently 14 months, unless configured otherwise).
After the relevant retention period, data is securely deleted or anonymised.
---
8. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data I hold about you
- Rectify inaccurate or incomplete data
- Erasure ("right to be forgotten"), though this may be limited where I have a legal or professional obligation to retain records
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability for data processed by consent or contract
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled
ICO contact details:
Website: [ico.org.uk](https://ico.org.uk)
Helpline: 0303 123 1113
To exercise any of these rights, contact me at contact@orianalauriatherapy.com. I will respond within one month, as required by law.
---
9. Data Security
I take appropriate technical and organisational measures to protect your data, including:
- Password-protected and/or encrypted storage of clinical records
- Secure, GDPR-compliant third-party platforms
- Limiting access to your data to myself (and, in anonymised form, my clinical supervisor)
- Secure disposal of paper and electronic records at the end of the retention period
---
10. Children's Data
I do not currently offer counselling services to individuals under the age of 18, and this Site is not directed at children. If I become aware that a child's data has been submitted without appropriate consent, I will delete it promptly.
---
11. Changes to This Policy
I may update this policy from time to time to reflect changes in law or practice. The "Last updated" date at the top of this page will indicate the most recent revision. Significant changes affecting current clients will be communicated directly.
---
Cookie Policy
What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help the site function properly, remember preferences, and/or gather information about how visitors use the site.
Cookies Used on This Site
As this Site is built on Squarespace, the following categories of cookies may be used:
| Category | Purpose | Examples | Consent required? |
| Strictly necessary | Essential for the Site to function (e.g. security, load balancing, form submission) | Squarespace session cookies (`crumb`, `SS_MID`, etc.) | No — these cannot be switched off |
| Analytics/performance | Understand how visitors use the Site, to improve content and navigation | Google Analytics (`_ga`, `_gid`, `_gat`) | Yes |
| Functional | Remember preferences (e.g. cookie consent choice itself) | Squarespace preference cookies | No (necessary to remember your choice) |
A full, automatically-updated list of cookies set via Squarespace can be found in Squarespace's own [Cookie Policy](https://www.squarespace.com/privacy/cookies) and [Google's cookie information](https://policies.google.com/technologies/cookies).
## Managing Your Cookie Preferences
Under PECR, I am required to obtain your consent before setting any non-essential (e.g. analytics) cookies. When you first visit the Site, you will be shown a cookie banner where you can:
- Accept all cookies
- Reject non-essential cookies
- Adjust your preferences at any time via [link to cookie settings, if Squarespace consent banner is enabled]
You can also control or delete cookies through your browser settings:
- [Chrome](https://support.google.com/chrome/answer/95647)
- [Safari](https://support.apple.com/en-gb/guide/safari/sfri11471/mac)
- [Firefox](https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop)
Note that blocking or deleting cookies may affect the functionality of the Site.
## Google Analytics Opt-Out
If you would like to opt out of Google Analytics entirely, you can install the [Google Analytics Opt-out Browser Add-on](https://tools.google.com/dlpage/gaoptout).
---