Data Retention Policy

Last updated: October 2026 This Data Retention Policy explains how Maria Apiafi Counselling & Psychotherapy retains and securely disposes of personal information collected in connection with my counselling and psychotherapy practice. I retain personal information only for as long as there is a professional, legal, regulatory or legitimate practice reason for doing so. Different types of information may therefore be kept for different periods. My approach to data retention takes account of UK data protection law, my professional responsibilities as a counsellor and psychotherapist, and relevant insurance and record-keeping requirements. Personal information is not kept indefinitely. When the relevant retention period has ended and there is no continuing lawful reason to retain the information, it will be securely deleted or destroyed.

I keep different types of personal information for different periods, depending on why the information was collected and any professional, legal, insurance or record-keeping requirements that apply. Counselling and psychotherapy records Clinical records relating to adult clients, including assessment information, therapeutic agreements, relevant correspondence and brief session notes, are normally retained for seven years after our work together ends. Records may be retained for longer where there is a particular legal, safeguarding, insurance or professional reason to do so. Initial enquiries where therapy does not begin If you contact me about therapy but we do not go on to work together, I will normally retain your enquiry and related correspondence for up to 12 months after our last contact, unless there is a reason to retain it for longer. Financial and payment records Information required for accounting, taxation and financial record-keeping, including invoices and payment records, will be retained for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year, or for any longer period required by law. Complaints, safeguarding and legal matters Information relating to a complaint, safeguarding concern, serious risk, insurance matter or legal claim may need to be retained for longer than the usual periods above. Where this is necessary, I will retain only the information required and keep it for as long as there is a lawful or professional reason to do so.

I take appropriate steps to protect the personal information I hold against unauthorised access, accidental loss, disclosure, alteration or destruction. Electronic records are stored using password-protected systems and devices, with access restricted to me. Where information is backed up, appropriate security measures are used to protect the backup. I take care to keep the amount of personal information I record to what is necessary and appropriate for the provision of counselling and psychotherapy and my professional responsibilities. When information reaches the end of its retention period and there is no continuing lawful, professional or insurance reason to retain it, electronic records will be securely deleted and any paper records containing personal information will be securely destroyed. Where information is held by a service provider on my behalf, deletion may also be subject to that provider's secure deletion and backup procedures.

The retention periods set out in this policy are my usual retention periods. In some circumstances, it may be necessary or appropriate to keep particular information for longer. This may apply where there is an ongoing or anticipated complaint, legal claim, safeguarding concern, insurance matter or other professional or regulatory requirement relating to the information. I may also need to retain information where I am required to do so by law, or where retaining it is necessary for the establishment, exercise or defence of legal claims. Where information is retained beyond its usual retention period, I will keep only what is necessary and will review whether there remains a lawful and appropriate reason for continuing to retain it. Once that reason no longer applies, the information will be securely deleted or destroyed in accordance with this policy.

I will review this Data Retention Policy periodically and may update it to reflect changes in my practice, professional guidance, insurance requirements or applicable data protection law. When I make changes, I will update the “Last updated” date at the top of this page. If you have any questions about how long I retain your personal information, or about the deletion of information I hold about you, please contact me: Maria Apiafi Counselling & Psychotherapy Email: maria@apiaficounselling.co.uk Website: apiaficounselling.co.uk Further information about how I collect, use, store and protect personal information, including your data protection rights, is available in my Privacy Policy.