Legal & Security

One Step Counselling and Therapies C.I.C. ("we", "us", "our") is a not-for-profit Community Interest Company registered in England and Wales. We operate the BookCounselling.com platform. Our registered address is 7C The Parade, Neath, SA11 1RB. Contact: hello@onestepcounselling.org.

We are the Data Controller for the personal data you provide to us, and we are committed to handling that data responsibly under UK GDPR and the Data Protection Act 2018.

• Full name, email address, phone number and date of birth
• GP details and emergency contact information
• Health information relevant to your counselling (provided voluntarily)
• Session booking details, payment records and payment status
• Completed intake forms and wellbeing assessment responses
• Counsellor session notes (stored securely, accessible only to your counsellor and, where required, admin)
• Technical data: IP address, browser type, device type, pages visited
• Communications sent to or from us by email or through the platform

We use your data only for the following purposes:

• To provide, manage and improve our counselling services
• To schedule, confirm and manage your appointments
• To process payments securely via Stripe
• To send you relevant forms and session communications
• To enable counsellors to deliver safe and appropriate therapy
• To comply with our legal and safeguarding obligations
• To respond to your enquiries and complaints

We do not sell, rent or trade your personal data to third parties. We do not use your data for marketing without your explicit consent.

• Contract performance — to deliver the services you have booked
• Legal obligation — to comply with UK law and safeguarding duties
• Legitimate interests — to operate and improve our platform safely
• Consent — where you have given us specific permission (e.g. receiving newsletters)

Client records, including session notes and personal data, are retained for a minimum of 7 years following the end of your engagement with us, in line with professional counselling standards and insurance requirements. After this period, data is securely deleted.

Under UK GDPR you have the right to:

• Access the personal data we hold about you (Subject Access Request)
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where consent is the basis of processing
• Lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113

• Stripe — payment processing (PCI-DSS compliant)
• Daily.co — encrypted video call infrastructure
• Base44 / Supabase — secure cloud platform and database hosting
• Email delivery providers — for booking confirmations and platform notifications

All third-party processors are bound by data processing agreements and comply with UK GDPR.

For any data protection queries, to exercise your rights, or to make a complaint, contact us at: hello@onestepcounselling.org

Last updated: March 2026