Data Protection and Privacy Policy
Last updated: 5 November 2026
This Privacy Policy explains how I collect, use, store and protect your personal information in connection with my counselling and psychotherapy practice.
My practice is established in Spain. I process personal data in accordance with the EU General Data Protection Regulation (EU GDPR) and applicable Spanish data-protection legislation. Where applicable to my provision of services to clients in the United Kingdom, I also comply with the UK General Data Protection Regulation (UK GDPR) and associated data-protection legislation.
For the purposes of data-protection law, I, Dr Sarah Quinley, am the Data Controller of the personal information you share with me.
You can contact me about your personal data at:
Email: truevoicecounselling@pm.me
Website: truevoicecounselling.com
1. Lawful basis for processing
I process personal information only where there is a lawful basis for doing so.
Depending on the purpose and type of information, the lawful bases I rely upon may include:
Contract: Processing necessary to arrange, provide and manage our counselling and psychotherapy sessions, including appointment scheduling and payment administration.
Legitimate interests: Processing necessary for appropriate professional administration, maintaining business records, managing enquiries, protecting the security of my practice and supporting professional accountability, where these interests are not overridden by your rights and interests.
Legal obligations: Processing necessary to comply with applicable legal, tax, accounting or other statutory obligations.
Consent: Where you have freely and explicitly agreed to optional processing, such as retaining photographs of therapeutic materials or contacting a third party on your behalf, where consent is the appropriate legal basis.
Some information you share during therapy, including information about your physical or mental health, constitutes special-category personal data under the GDPR.
In addition to an Article 6 lawful basis, processing this information requires a valid condition under Article 9 of the GDPR. Where I rely on your explicit consent for this processing, I will seek that consent separately and clearly. You may withdraw consent at any time. However, if I cannot lawfully process information necessary for the provision of therapy, this may affect my ability to continue working with you.
I do not treat the act of requesting therapy or providing contact details as blanket consent to every form of data processing.
2. What information do I collect?
I collect only information that is relevant and necessary for the administration and provision of my services, professional responsibilities and legal obligations.
Contact details
This may include your name, email address, telephone number, postal address and preferred method of contact.
Personal and background information
This may include information you choose to share about your circumstances, relationships, personal history and reasons for seeking therapy.
Health and wellbeing information
Where relevant to our work, this may include information about your physical or mental health, previous or current diagnoses, medication, treatment, healthcare providers and other relevant personal circumstances.
Emergency and location information
For online therapy, I may collect your current location, usual country of residence and emergency contact details. This information helps me understand where you are during sessions and identify appropriate local emergency arrangements if necessary.
Correspondence
I may retain relevant emails and messages relating to enquiries, appointments, payments and our therapeutic work.
Session notes
I maintain brief professional notes relating to our work together. These may include relevant themes, reflections, therapeutic progress and matters requiring follow-up.
Where possible, notes are pseudonymised and identifying information is stored separately. Pseudonymised information remains personal data where it can be linked back to an identifiable person.
Therapeutic materials
Where relevant, we may create written, visual or other therapeutic materials during sessions. I will only retain photographs or copies of these materials where this is appropriate and where you have given the necessary permission.
Technical and payment information
Information may also be processed through the digital services used to provide therapy and administer payments. This may include payment confirmations, transaction references, technical information and limited service-related metadata.
3. How do I use your information?
I use personal information for the following purposes:
To respond to enquiries and assess whether my service is appropriate for your needs.
To arrange, provide and manage counselling and psychotherapy sessions.
To communicate with you about appointments, scheduling and practical matters.
To maintain appropriate professional records and reflect on the therapeutic work.
To support professional supervision and accountability.
To administer payments, invoices and financial records.
To manage safeguarding concerns and respond appropriately to serious risks.
To comply with applicable legal, regulatory and professional obligations.
To protect the security and proper functioning of my practice.
I do not use your therapeutic information for advertising or marketing purposes.
4. When and how is your information shared?
Your personal information is treated as confidential. I do not sell your data or share it for marketing purposes.
Information may be shared in the following circumstances:
Clinical supervision
I receive regular professional supervision. Relevant aspects of our work may be discussed with my supervisor to support ethical and effective practice. I aim to use pseudonymised or appropriately de-identified information wherever possible and share only what is necessary for the supervisory purpose.
With your permission
Where appropriate, I may share relevant information with a third party, such as a GP, healthcare professional or referring practitioner, with your explicit agreement where required.
Serious risk or legal obligation
There may be circumstances where disclosure is necessary to respond to a serious risk of harm, safeguarding concern or legal requirement. Where possible and appropriate, I will discuss this with you before making a disclosure.
Professional contingency arrangements (Therapeutic Will)
I maintain a professional contingency arrangement in case of my death or incapacity. A designated professional may need access to limited information to contact clients, communicate necessary arrangements and support appropriate continuity or closure of the practice.
Any access to client information will be restricted to what is necessary for this purpose. Records will not automatically be destroyed if there are legal or professional obligations requiring their retention.
Service providers
I use third-party providers to support the operation of my practice. These may include video-conferencing, email, payment processing, banking, secure storage and backup services.
Depending on their role, these providers may process information on my behalf or act as independent data controllers. I take reasonable steps to select appropriate providers and ensure that relevant data-protection and confidentiality arrangements are in place.
5. Data security
I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration,