Privacy Policy — Peaches of Chelsea

Who We Are

Peaches of Chelsea is a child and adolescent counselling practice. Counselling is provided by Parin Somaiya, BACP Registered Member (Membership No. 01025684, Register No. 413924).

Practice Name: Peaches of Chelsea
Practitioner: Parin Somaiya, MBACP
Email: contact@peachesofchelsea.com
Website: www.peachesofchelsea.com
Data Controller: Peaches of Chelsea Ltd., a company registered in England and Wales (company number 16547477), registered office 66 Paul Street, London, EC2A 4NE
Practice location: Online. Our clients are based in the United Kingdom. Parin Somaiya may work remotely from outside the UK, accessing our UK/EU-hosted systems over encrypted connections (see section 6).

If you have any questions about this policy or how your data is handled, please contact us at contact@peachesofchelsea.com.

What Personal Data We Collect

We collect and process the following categories of personal data:

Contact information — name, email address, telephone number, and postal address of the parent or guardian
Child's information — name, date of birth, age, school, and GP details
Health and clinical information — presenting concerns, relevant medical history, previous therapeutic support, and clinical session notes
Emergency contact details — name and telephone number of an additional trusted adult
Records of payments made (date, amount, what the payment was for) — we do not collect or store card details, which are handled directly by our payment processor
Communications — emails, messages, and correspondence between you and Peaches of Chelsea

Special Category Data: Health and clinical information relating to children is considered Special Category Data under UK GDPR. This data is handled with the highest level of care, stored securely, and accessed only by Parin Somaiya (and, in anonymised form, her clinical supervisor — see section 5).

How We Collect Your Data

We collect personal data in the following ways:

When you complete the enquiry form on our website (provided by Microsoft Forms). We ask you to keep this to the basics — please do not include sensitive detail about your child there; we will talk properly on the introductory call
When you book a session or introductory call via our website or booking system
When you complete and return a parental consent form
Through email, telephone, or written communication with us
During the course of therapy sessions — clinical notes are recorded by the practitioner

Why We Use Your Data & Our Legal Basis

Under UK GDPR, every use of your personal data must have a "lawful basis" — a specific legal justification that permits us to use that data. This is a core requirement of UK data protection law and one of the six grounds under Article 6 of UK GDPR (with additional grounds under Article 9 for sensitive information such as health data). Below is each way we use your data, and the lawful basis under which we do so:

To provide therapy services — lawful basis: Contract and Legitimate Interests (clinical records are necessary to deliver safe, consistent therapeutic care)
To communicate with you about sessions — lawful basis: Contract
To process payments — lawful basis: Contract
To act on safeguarding concerns — lawful basis: Legitimate Interests and, where necessary, Vital Interests (protecting a child or another person from serious harm), together with the safeguarding condition in Schedule 1 of the Data Protection Act 2018
To deliver digital resources purchased or downloaded — lawful basis: Contract
To maintain clinical records — lawful basis: Legitimate Interests (good practice guidance from BACP requires practitioners to keep clinical records)

Health information (Special Category Data). Because counselling records contain information about a child's health and wellbeing, we also need a condition under Article 9 of UK GDPR. We rely on your explicit consent, given through the parental consent form before therapy begins (and, where they are able to understand and agree, the young person's own consent). This is supported by the condition for the provision of health care by a professional bound by a duty of confidentiality — Parin Somaiya is bound by the BACP Ethical Framework and the common-law duty of confidence. Where information must be shared to protect a child from serious harm, we rely on the safeguarding condition in Schedule 1 of the Data Protection Act 2018. Withdrawing consent does not affect processing that has already taken place, and some records may need to be kept for the periods set out in section 7.

Confidentiality & Its Limits

Confidentiality is central to the therapeutic relationship. Everything shared within sessions is treated with the strictest professional confidence.

However, confidentiality has limits. Parin Somaiya has a professional and legal duty to act if information is shared that suggests a child or young person is at risk of serious harm — to themselves or others. In such circumstances, information may need to be shared with appropriate authorities. Where possible and safe to do so, this will be discussed with the parent or guardian first.

Clinical session notes are kept securely and are not shared with third parties except in the following limited circumstances:

Where there is a serious risk of harm to the child or another person
Where disclosure is required by law or court order
Where you have given explicit written consent for specific information to be shared (e.g. with a school or GP)
In clinical supervision — notes may be discussed in anonymised form with Parin Somaiya's clinical supervisor, as required by BACP ethical practice

Your child's own confidentiality. Children and young people have the same right to confidentiality over their personal data as adults. Even where a parent or guardian has arranged and consented to the counselling, what a child shares in sessions is held in confidence and is not automatically shared with parents. Parin will agree with you and your child at the outset what will and will not be shared, and will always tell you if a safeguarding concern arises. Young people aged 16 and over, and younger children who are able to understand what counselling involves, may also give their own consent and exercise their own data protection rights.

How We Store & Protect Your Data

Your personal data is stored securely using the following measures:

Clinical notes and client records are stored in an encrypted, password-protected system accessible only by Parin Somaiya, with two-factor authentication
Email, calendar and video are provided by Proton (Switzerland — a country the UK recognises as providing adequate data protection). Stored messages, calendar entries and files are protected by Proton's zero-access encryption, meaning Proton itself cannot read them
Where Parin Somaiya works remotely from outside the UK, your records remain stored on our UK/EU-hosted systems and are accessed only over encrypted connections from devices protected by passcode, disk encryption and automatic locking. Under the ICO's guidance, access to our own systems by our own practitioner is not an international transfer of your data
Online sessions are conducted via Proton Meet — a Swiss-based, end-to-end encrypted video platform with strict GDPR compliance
Paper documents (if any) are stored in a locked, secure location
Payment information is processed by Stripe — we do not see or store your card details
Enquiries received through our website form are transferred into our client records and then deleted from Microsoft Forms

⚠️ Data Breach: In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR.

How Long We Keep Your Data

We retain personal data for the following periods in line with BACP guidance and legal requirements:

Clinical records (children): Retained until the child's 25th birthday (or 26th if treatment ended after age 17), or for 8 years from the last contact — whichever is longer. This is in line with NHS and professional guidance for child health records.
Adult client records: Retained for 7 years from the date of last contact
Financial records: Retained for 6 years in line with HMRC requirements
General enquiry correspondence: Retained for 2 years from last contact

After these periods, all personal data is securely deleted or destroyed.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — you may request a copy of the personal data we hold about you
Right to rectification — you may ask us to correct inaccurate or incomplete data
Right to erasure — you may ask us to delete your data in certain circumstances (note: clinical records may need to be retained for legal or professional reasons)
Right to restrict processing — you may ask us to limit how we use your data in certain circumstances
Right to data portability — you may request your data in a portable format
Right to object — you may object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent (including consent to counselling), you may withdraw at any time

To exercise any of these rights, please contact us at contact@peachesofchelsea.com. We will respond within one month.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Cookies

Our website does not set any cookies of its own, and we do not use analytics, advertising or tracking cookies. Because we set no non-essential cookies, no cookie consent banner is shown.

When you choose to open our enquiry form, it is loaded from Microsoft Forms, which may set its own cookies needed to make the form work. These are governed by Microsoft's privacy statement (see section 10). You can control cookies through your browser settings.

Third-Party Services

We use the following third-party services to operate our practice. Each has its own privacy policy and data protection measures:

Vercel (website hosting, United States — the site itself holds no client data; standard server logs only, covered by Vercel's UK/EU standard contractual clauses) — vercel.com/legal/privacy-policy
Proton (professional email via Proton Mail; appointment scheduling via Proton Calendar; encrypted video sessions via Proton Meet — Swiss-based, end-to-end encrypted; Switzerland holds UK adequacy status) — proton.me/legal/privacy
Stripe (payment processing — Stripe Payments UK Ltd) — stripe.com/privacy
Microsoft Forms (enquiry form on our website — contact details and a short note only; entries are moved to our records and deleted from Forms. Microsoft's contracting entity for UK users is Microsoft Ireland Operations Ltd, and any onward transfer is covered by Microsoft's standard contractual clauses) — microsoft.com/privacy

We do not sell, rent or share your personal data with any third parties for marketing purposes.

Changes to This Policy

We review this Privacy Policy annually and whenever our working practices change significantly. Any material changes will be posted on this page with an updated date. Where changes significantly affect how we use your data, we will notify active clients by email.

This policy was last reviewed: September 2026

Contact Us

For any questions, concerns or requests relating to this Privacy Policy or your personal data, please contact us at contact@peachesofchelsea.com.