Lily Hannigan Counselling and Psychotherapy

Last updated: May 2026

Who I am

Lily Hannigan Counselling and Psychotherapy is a private counselling and psychotherapy practice based in Scotland. I provide individual therapy for adults online and in person.

For the purposes of UK data protection law, I am the data controller of the personal information you share with me.

Contact details

Lily Hannigan Counselling and Psychotherapy
2nd Floor, 86–92 Causewayside
Edinburgh, EH9 1PY
Email: lily@lilyhannigantherapy.co.uk

I am registered with the Information Commissioner’s Office (ICO), registration reference: ZC090301.

What information I collect

I may collect and store personal information that you provide when contacting me or working with me.

This may include:

• your name and contact details (such as email address and phone number)

• information shared through my website contact form

• appointment and administrative information

• emergency contact details

• brief factual session notes

• pseudonymised process notes relating to therapeutic work

• payment information relevant to invoicing or bank transfer records

You may choose to share personal or sensitive information when contacting me through the website. This is entirely your choice and not required in order to make an enquiry.

In the course of therapy, I may process what UK data protection law describes as special category data, including information relating to mental health, medical history, medication, identity, relationships, or life experiences.

How I collect information

I collect information:

• when you contact me through my website

• when we communicate by email or in session

• during the process of assessment and therapy

• through administrative arrangements such as appointments and payment

My website is hosted by Squarespace and includes a contact form. I also use Google Workspace (including Gmail, Google Docs and Google Meet) as part of my practice administration and online work.

Why I collect your information

I collect and use personal information in order to:

• respond to enquiries

• assess suitability for therapy

• provide counselling and psychotherapy

• arrange appointments and communicate with you

• maintain brief clinical records

• fulfil professional, ethical and insurance obligations

• undertake clinical supervision

• manage safeguarding concerns and risk

• comply with legal obligations

• maintain financial records for accounting purposes

Lawful basis for processing

Under UK GDPR, I process personal information on the following lawful bases:

• Legitimate interests – for running a safe and effective therapy practice.

• Contract – where processing is necessary to provide therapy services.

• Legal obligation – where I am required to retain records or respond to legal requirements.

• Vital interests – where there is serious concern about safety or risk of harm.

Where I process special category data (such as health-related information), I do so because it is necessary for the provision of therapeutic support and health-related care, alongside my professional obligations.

Confidentiality and its limits

Therapy is confidential. However, confidentiality is not absolute.

There may be circumstances where I may need to share information, including:

• where there is a serious risk of harm to you or someone else

• safeguarding concerns

• where disclosure is required by law or court order

• where necessary for insurance, legal, or professional requirements

• in exceptional circumstances involving emergency contacts

• with a GP or healthcare professional with your consent

Where possible, I would aim to discuss this with you first.

Clinical supervision

As part of ethical and professional practice, I receive clinical supervision.

In supervision, aspects of therapeutic work may be discussed to support safe and effective practice. I take reasonable steps to minimise identifying information.

How your information is stored

I take reasonable steps to keep your information secure.

Information may be stored using password-protected systems and devices, including Google Workspace and Apple Notes. Therapy notes are kept securely and process notes are pseudonymised where possible.

No method of electronic storage is entirely risk-free, but I take reasonable technical and organisational steps to protect your information.

Sharing your information

I do not sell your information or share it for marketing purposes.

I may share limited information with trusted service providers where necessary to run my practice (for example, website hosting or secure email systems). These providers process information according to their own privacy and security standards.

International transfers

Some of the services I use, including Squarespace and Google services, may process or store data outside the UK.

Where this happens, I take reasonable steps to ensure appropriate safeguards are in place in line with UK data protection law.

How long I keep information

I retain information only for as long as reasonably necessary.

• Enquiry information where therapy does not go ahead: up to 12 months

• Therapy records and notes: 7 years after therapy ends

• Financial/payment records: 6 years for accounting and legal purposes

Information may be securely deleted sooner where appropriate.

Your rights

Under UK data protection law, you have rights regarding your personal information, including the right to:

• request access to your personal information

• request correction of inaccurate information

• request restriction of processing in some circumstances

• object to certain types of processing

• request erasure where legally applicable

Please note that some records relating to therapy may need to be retained for professional, insurance, or legal reasons.

To make a request about your information, please contact:

lily@lilyhannigantherapy.co.uk

Website analytics and cookies

My website may use cookies and analytics tools to understand website usage and improve functionality.

Non-essential analytics cookies will only be used with your consent. Please see my Cookie Policy for more information.

Concerns or complaints

If you have concerns about how your information is handled, you are welcome to contact me in the first instance.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO): https://ico.org.uk

Changes to this policy

I may update this Privacy Policy from time to time. The most current version will always be available on my website.