top of page

PRIVACY POLICY

Ariana Ray - People Groups Change and Change in Business    |    Updated:  16 September 2026


This Privacy Policy explains how I collect, use, and store personal data in accordance with the Data (Use and Access) Act 2025 (UK, DUAA), the UK General Data Protection Regulation (UK GDPR, 2016), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the National Counselling and Psychotherapy Society (NCPS) Ethical Framework. NCPS Registration NCS24-00777.

WHO I AM

I am Ariana Ray trading as People Groups Change and Change in Business, providing counselling, consultation and courses, UK and online. For the purposes of UK DUAA and GDPR, I am the data controller of your personal information.
Contact:  ariana@peoplegroupschange.com    |  +44 (0) 7981275006

WHAT INFORMATION I COLLECT

As part of our work together, I may collect and store personal information including:
 

  • Full name

  • Contact details (email, phone number, address)

  • Emergency contact information

  • GP details (if relevant or required)

  • Brief digital session notes

  • Health, emotional, and lifestyle information relevant to counselling/ contractual work.

​

This information is collected via Email or phone correspondence and securely stored and recorded using client codes only, not personal information, on Excel on Computer passworded document which is UK DUAA and GDPR compliant.
 

  • Intake information Via Proton.me advanced encryption, UK DUAA and GDPR compliant and securely stored on Excel on Computer passworded document which is UK DUAA and GDPR compliant

  • Digital session notes - recorded using client codes only, no personal data recorded here (Notesnook – with end-to-end encryption, which is UK DUAA and GDPR compliant)

WHY I COLLECT YOUR DATA

Your data is collected for the following purposes:
 

  • To provide counselling, consultation or course sessions safely and ethically

  • To contact you regarding appointments or agreed matters

  • For clinical and treatment record-keeping

  • Where appropriate and only with your consent, to share occasional updates, resources, or relevant service offerings

​

The lawful basis for collecting and processing your data includes:
 

  • Contractual necessity – to fulfil our agreement to provide you with services

  • Legal obligation – to meet legal and insurance requirements

  • Legitimate interest – to provide professional and safe practice

  • Consent – for optional communications or specific uses beyond service provision

​

Health information is special category data under UK DUAA and GDPR. I process it under Article 9(2)(h) (provision of health or social care, as a member of a profession subject to an obligation of confidentiality) and, where applicable, your explicit consent under Article 9(2)(a).

DATA STORAGE AND SECURITY

Your personal data is stored securely using encrypted, password-protected digital systems and/or locked physical files. People Groups Change take all reasonable steps to prevent unauthorised access, loss, or misuse. In the unlikely event of a data breach likely to result in a risk to your rights, I will notify you and the Information Commissioner's Office (ICO) as required by law.
 

Brief notes taken between sessions are recorded using a dedicated note-taking application with zero-knowledge, end-to-end encryption. This means notes are encrypted on my device before any transfer takes place, and the service provider has no technical means of accessing their content, whether in storage or in transit. Client notes are further protected using a coded reference system rather than names, and no other client data like address or date of birth are kept on this application.
 

Client notes are kept for a minimum of 7 years following our last session, in accordance with legal, insurance, and NCPS professional guidelines. After this time, records are securely destroyed (deleted, when digital).

THIRD-PARTY SERVICES

I use UK UK DUAA and GDPR -compliant third-party services to run my practice, including email, secure video platform for online sessions, payment processing, and secure cloud storage. Any such services are reviewed to ensure they maintain appropriate data protection standards; their own privacy policies apply. Where a provider stores data outside the UK, transfers are protected by UK adequacy regulations or an International Data Transfer Agreement. I never sell your data, and I never share it for third-party marketing.

CONFIDENTIALITY AND ETHICAL OBLIGATIONS

Your information and sessions are treated as confidential. However, there are certain legal and ethical limits where I may be required to share information:
 

  • If you disclose intent to harm yourself or others

  • If there is a safeguarding concern involving a child or vulnerable adult

  • If required by a court order or legal obligation

  • If shared anonymously in professional supervision, which supports safe and ethical practice

​

In line with NCPS good practice, I maintain a clinical will: in the event of my sudden incapacity or death, a nominated professional colleague, bound by confidentiality, will access client records solely to inform clients and close the practice securely.

ARTIFICIAL INTELLIGENCE

I recognise the growing presence of Ai tools and the questions this raises for confidentiality in therapeutic work. My commitments to you are:
 

  • Sessions are never recorded, transcribed, or analysed by Ai tools. This would only ever occur with your explicit written consent to a clearly stated purpose.

  • People Groups Change do not enter identifiable client information into Ai tools such as chatbots, transcription services, or note-generation software.

  • Where Ai assists with general practice administration (for example, document formatting), no clinical records or identifiable client information are involved.

  • People Groups Change make no decisions about you by automated means, and no profiling takes place (UK GDPR Article 22).

YOUR RIGHTS

You have the right to:
 

  • Access any personal data I hold about you

  • Request correction of inaccurate or outdated information

  • Request deletion of your data, where applicable

  • Request restriction of, or object to, the processing of your data

  • Receive a copy of the data you have provided in a portable format

  • Withdraw consent at any time (where processing is based on consent)

​

To exercise your rights, please contact me in writing at: ariana@peoplegroupschange.com 
If you are unhappy with how your data has been handled, you have the right to complain directly to me, and I will acknowledge your complaint within 30 days and respond without undue delay (Data Protection Act 2018, section 164A). You may also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

POLICY UPDATES

This Privacy Policy is reviewed regularly and may be updated from time to time. 

bottom of page