Privacy Notice

1. Your Privacy

At 2 Be Therapy Services, I respect your privacy and take the confidentiality of your personal information seriously.

I comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the BACP Ethical Framework.

I am Elizabeth Morrison, professional known as Libby Morrison, and I am responsible for the personal information collected and held by my practice.

2. What information do I collect?

I may collect and keep:

Your name and contact details
Appointment dates and attendance
Clinical information you share during therapy and relevant session notes
Relevant emails, text messages and WhatsApp communications
Information relating to professional supervision where applicable
Other information necessary to provide services safely and professionally.

Some information, particularly health and wellbeing information, is classed as special category personal data.

3. How do I use your information?

I use your information to:

Arrange and manage appointments
Provide counselling, therapy and professional supervision
Maintain appropriate clinical and supervision records
Communicate with you
Manage payments and practice administration
Meet professional, insurance and legal obligations
Address safeguarding concerns or situations involving serious risk to harm.

I process your information in accordance with applicable data protection legislation and the relevant lawful bases for processing.

4. Confidentiality

What you share in counselling or supervision is treated as confidential.

Information will not routinely be shared without your permission. except where disclosure is required or justified by law, safeguarding responsibilities or serious concerns about safety.

Where appropriate and safe, I will discuss this with you beforehand. Only information necessary for the purpose will be shared. I may discuss aspects of my work in professional supervision. However, I do not share identifiable client information what my clinical supervisor or insurers. Any discussion of my work is anonymised so that you cannot be identified.

5. Communication

I may contact you by email, telephone, text or WhatsApp for appointments and other relevant matters.

I take reasonable steps to protect electronic communications, but these methods cannot be guaranteed to be completely private.

Routine administrative texts and emails are generally deleted after one month unless they contain information relevant to your therapy or another matter that needs to be retained.

6. Online records and data security

I currently use We Are Kiku (Kiku) to manage my practice and maintain clinical records, generate automatic appointment confirmation or changes, and payment reminders.

My account is scheduled to migrate to Konfidens on 4 December 2026.

Kiku has advised that the migration will be confidential and encrypted, and that its technical team will have no sight of client data during the process. Kiku has also advised that information will subsequently be stored on the encrypted Konfidens platform, with AWS servers located in Germany within the EEA.

Following migration, Konfidens will act as a data process for my clinical records. I will remain responsible for your information as the data controller.

Appointment related communications will come from Konfidens rather than Kiku.

I take reasonable steps to protect all records and use appropriate security measures.

Online therapy appointments - Zoom

I use Zoom to provide online therapy sessions. When you attend an appointment online, Zoom may process personal information such as your name, email address, meeting details and technical information necessary to provide the service.

I do not record therapy sessions.

Zoom's privacy information explains how it processes personal information:

https://www.zoom.com/en/trust/privacy/

7. Payments

I offer three payment methods:

Online payments, currently through Kiku and, following migration, through Adyen via Konfidens,
In person contactless payments using my phone through my Monzo Business account
BACs transfers to my Monzo Business account, available on request.

Relevant payment information may be processed by these providers. I retain payment information only as necessary for administration, accounting and legal or professional requirements.

8. Clinical Will and continuity arrangements

I have established a Clinical Will through ClinicalWill.app to ensure that appropriate arrangements are in place if I die or become incapacitated and unable to continue practising.

In these circumstances, a nominated trustee may be authorised to access limited contact information for the purpose of informing:

My counselling and therapy clients
Counsellors and other professionals receiving clinical supervision from me (supervisees)

The information accessible through the Clinical Will is restricted to:

Name
Telephone number
Email address.

The trustee will not have access to counselling or therapy notes, clinical records, supervision notes, case discussions or other confidential clinical documentations.

The information will only be used to notify clients and supervisees of my death or incapacity.

The trustee may also be asked to notify my clinical supervisor that I am no longer able to provide professional services.

All information will be handle confidentially, securely and in accordance with applicable data protection requirements.

9. Sharing your information

I do not sell your personal information or share it for marketing purposes.

Where necessary, information may be shared with or processed by:

Konfidens, for practice management and storage of clinical records
Adyen, for online card payments following migration.
Monzo Business, for in-person contactless payments and bank transfers
ClinicalWill.app, and an authorised trustee, solely for the limited continuity arrangements described in Section 8
Relevant authorities where disclosure is legally required or necessary for safeguarding.

I do not share identifiable client information with my professional supervisor or insurers. Where professional consultation or insurance-related advise is required, information is anonymised wherever possible.

10. How long do I keep records?

Clinical records are retained for seven years from your final therapy session, in accordance with the insurer's requirements.

If there is an outstanding complaint, legal or insurance matter, relevant records may be retained for longer until the matter is concluded.

Other administrative information is kept only as long as necessary.

11. Your data protection rights

You have rights under data protection legislation, which may include the right to:

Request access to your personal information
Request deletion or restriction where legally applicable
Object to certain types of processing
Request a copy of information in certain circumstances

These rights are subject to legal conditions, for example, I may need to retain clinical records to meet professional, insurance or legal obligations.

12. Concerns or complaints

If you have concerns about how your information is handled, please contact me in the first instance.

You can also raise a complaint with the Information Commissioner's Office (ICO):

https://ico.org.uk/

My practice is registered with the Information Commissioner's Office (ICO)

Updated on 31 October 2026