Last updated: 21 September 2026
Who is responsible?
Millie Hobbins, trading as MIHO Counselling, is the data controller for this sole practice in Romsey, Hampshire. Contact mihocounselling@gmail.com with privacy questions or requests. ICO registration number: ZB998397.
Information collected and why
I receive information directly from you when you enquire by email or telephone, book or attend counselling. This may include your name and contact details, appointment and payment information, relevant counselling notes, and medical or emergency contact information where needed for safe care. In family work, information may also be provided by another participant; I will explain the information-sharing arrangements before we begin.
Please avoid detailed sensitive information in an initial enquiry. I ask only for information relevant to your enquiry or care. If you do not wish to provide information needed for safe counselling, we will discuss whether I can provide the service.
Legal reasons for using information
Under UK GDPR Article 6, I use information to take steps at your request before entering a counselling agreement and to perform that agreement. I rely on legal obligation where record-keeping or disclosure is required by law, and legitimate interests where necessary and proportionate to manage enquiries, protect the practice and maintain appropriate records.
Counselling can involve health information and other special-category data. For confidential counselling care, the relevant additional condition is Article 9(2)(h), health or social care, together with the duty of confidentiality and the applicable Data Protection Act 2018 requirements. Where necessary, other conditions may apply, including establishing or defending legal claims. Where I rely on explicit consent for a particular use, I will ask separately and explain how to withdraw it. Withdrawal does not affect earlier lawful processing.
Confidentiality and service providers
I work alone. My session notes are coded with client numbers and kept separately from the identifying client details and number key. Coded records remain personal data and are treated confidentially.
I use Google Gmail for email and Google Meet for video sessions. Bookings are arranged by email or telephone, and payments by bank transfer. Google, banking providers and the website hosting provider process information needed to deliver their services. This website is hosted through OpenAI Sites using Cloudflare infrastructure.
Clinical supervision supports safe and ethical care. Identifying details are avoided wherever possible. Relevant information may also be shared with your consent, to address serious harm or safeguarding concerns, or where required or otherwise justified by law. See confidentiality and professional standards.
Service providers may process information outside the UK. Google describes its international processing and safeguards, including the UK Extension to the EU–US Data Privacy Framework and contractual safeguards, in its data transfer information. Hosting information is available in OpenAI’s privacy policy and Cloudflare’s privacy policy.
How long information is kept
Counselling records are normally retained for seven years after the final session, then securely deleted or destroyed. If a specific legal requirement or ongoing legal claim requires longer retention, only the necessary information is retained for that purpose.
Enquiries that do not lead to counselling are normally deleted six months after the last contact, unless an ongoing complaint or legal matter requires retention. Payment and accounting records are kept for the period required by applicable tax and accounting obligations. Hosting providers manage their own operational logs under their published retention arrangements.
Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy of relevant information. You can object to processing based on legitimate interests. These rights have legal conditions and exceptions; I will explain if a request cannot be fulfilled. Requests can be sent to mihocounselling@gmail.com.
Children also have privacy rights. Requests relating to family counselling are considered with respect for each person’s confidentiality, the child’s understanding and applicable legal requirements.
The practice does not use automated decision-making or profiling to make counselling decisions about you.
Website, enquiry form, maps and cookies
The website enquiry form does not send information to a website database. It uses the information entered to prepare an email in your own email application, which you choose whether to send. Please do not enter detailed medical or highly sensitive information.
The contact page includes an embedded Google Map. Loading or interacting with the map may allow Google to receive technical information and use cookies or similar storage under its own privacy terms. The site itself does not use advertising trackers or analytics scripts. The hosting and access service may process technical information, such as IP addresses and security logs, and use storage or cookies necessary to provide or secure access.
If optional analytics or advertising technologies are introduced, this notice and any required consent controls will be updated before they are used.
Questions and complaints
Please contact me with any concerns. You may also complain to the Information Commissioner’s Office, the UK data protection regulator. This notice will be updated if the practice’s information-handling arrangements change.