Privacy Policy for Healing The Shadow Trainees and for clients and couples working with Healing The Shadow Trainees
Please note, if you are having individual sessions with Marianne Hill, or attending a group workshop or a weekend or evening CPD training there is a different privacy policy. You can view that privacy policy on the healingtheshadow.co.uk website.
If you are working with one of our qualified Healing The Shadow practitioners they work independently from Healing The Shadow and have their own independent privacy policies. Please check with your practitioner about their individual policy.
Effective Date: 06.10.2026
Contact Email: mariannehillshadowwork@gmail.com
Location: United Kingdom
Healing The Shadow
4 Sunnyside, Frome, BA11 1LD
Mariannehillshadowwork@gmail.com
ICO registration number: ZA390132
Last updated: 06.10.26 Version: [2.0]
1. Who we are and what this notice covers
Healing The Shadow is an organisation offering individual sessions, couples work, practitioner training, group workshops and CPD training for counsellors, psychotherapists and coaches. Healing The Shadow is the “data controller” for the personal information described here, which means Healing The Shadow decides what information is collected, why, and how it is looked after. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA390132
This notice explains what personal information we hold about you, where it is kept, which digital tools are involved, how long we keep it, what your rights are, and what to do if you are unhappy about how your information has been handled.
Being a small organisation we are not required to appoint a Data Protection Officer, and have not appointed one. Marianne Hill deals with all data protection matters personally. If you want to raise something, please go straight to Marianne: mariannehillshadowwork@gmail.com
2. The information we collect
Information you give us directly
- Your name, email address, phone number and postal address
- Emergency contact details
- Relevant medical and mental health history, current medication, and anything you tell us about your circumstances
- Your reasons for seeking this work/training and what you want from it
- Payment information (see section 5)
Information created during our work together
- Correspondence between us
- Any written reflections or materials you send us.
- For practice clients and practice couples: Session notes and a record of dates, attendance and themes
- For trainees: Notes of training sessions and a record of dates, attendance, themes, and your progress as a trainee.
Information collected automatically
- Basic website usage data (IP address, browser type, pages visited)
- Email engagement data if you subscribe to the Healing The Shadow mailing list.
Special category information
Some of what you tell us falls into a category the law treats as especially sensitive: information about your physical or mental health, your sexual orientation or sex life, your gender identity, your religious or philosophical beliefs, your racial or ethnic origin, and your political opinions. In work of this kind, some of this is unavoidable – it is often the substance of the work.
We collect and hold this information only with your explicit consent, which we ask for at the outset in writing, and which you can withdraw (see section 10).
3. Why we use your information, and our lawful basis
Data protection law requires us to have a valid reason (“lawful basis”) for everything we do with your information. Ours are set out below.
| What we use it for | Lawful basis (UK GDPR Art. 6) | Additional basis for special category information (Art. 9) |
| Arranging, delivering and following up sessions and training | Contract | Explicit consent (Art. 9(2)(a)) |
| Keeping session notes, training notes and records | Contract, and legitimate interests in maintaining a proper professional record | Explicit consent (Art. 9(2)(a)) |
| Taking work to clinical supervision | Legitimate interests – safe, ethical and competent practice | Explicit consent (Art. 9(2)(a)) |
| Taking payment and keeping financial records | Contract, and legal obligation | Not applicable |
| Responding to enquiries before you start sessions or training with us | Legitimate interests | Explicit consent, where sensitive information is volunteered |
| Sending newsletters and free resources | Consent | Not applicable |
| Acting where there is a serious risk of harm | Legal obligation, and vital interests | Vital interests (Art. 9(2)(c)), or substantial public interest – safeguarding (Art. 9(2)(g)) |
| Retaining records to defend a complaint, claim or insurance matter | Legitimate interests | Establishment, exercise or defence of legal claims (Art. 9(2)(f)) |
A note on consent and record retention. You can withdraw your consent at any time and, if you do, we will stop the processing that relies on it. Withdrawing consent does not, by itself, mean we delete your entire record immediately. We retain a limited record for the period set out in section 8 so that we can respond to any complaint, claim or professional or insurance matter that may arise. At that point the basis for keeping it is the establishment, exercise or defence of legal claims – not consent. We will tell you clearly if this applies to your request.
4. Where your records are kept
Most of the information we hold about you, whilst collected digitally, is held on paper in the longer term rather than digitally.
For trainees: Your confidential form containing sensitive information is initially submitted via google drive then printed out and deleted from Google Drive and stored in a high security filing cabinet away from your personal contact details.
Your training notes are kept in a different locked filing cabinet and are pseudonymised.
For practice clients and couples: Your confidential forms containing sensitive information are kept on Google Drive, where your trainee practitioner will have private access for the time you are working with us as a practice client or couple. There are no contact details or surnames kept with these forms. After you have finished your time as a practice client your form will be printed out, deleted from Google Drive and stored in a high security filing cabinet away from your contact details. Your registration form will be collected via email and at the end of your time working with us it will be printed out and kept in a separate filing cabinet to your sensitive confidential form.
For individual practice clients notes taken during your session(s) are kept in a separate filing cabinet and are pseudonymised.
For couples practice clients notes taken during your sessions are kept by your practitioner – please ask them about their privacy policy.
(Confidential information and practice client/couple and trainee session notes are filed under your first name or initials only, so a file on its own does not identify you. Because we hold the means of linking a first name to a full identity, these notes still count as your personal information in law, even though they would mean little to anyone else who found them. We do not describe them as fully anonymous, because they are not. The means of linking first name and your full identity are kept separately by Healing The Shadow from your session notes.)
If you are a practice client, practice couple or trainee and have agreed to a session being videoed, then videos are either: Videoed using a camcorder then uploaded to a laptop and deleted from the camcorder, then uploaded to Vimeo and securely, privately stored on Vimeo and deleted from the laptop.
Or, sessions are videoed by Healing The Shadow via Zoom and saved on a laptop and then uploaded to Vimeo and securely, privately stored on Vimeo and deleted from the laptop. All videos are deleted from Vimeo as soon as they have been watched by the trainee in question and their trainer.
5. The specific tools and providers involved
| Provider | What it is used for | What information is involved | Where data is processed |
| Google, for Gmail and Google Drive and Google Docs | Email, documents, scheduling | Names, contact details, correspondence, confidential forms | UK / EU / USA |
| Zoom | Online sessions | Name, email, connection data. | UK / EU / USA |
| MAILING LIST Mailchimp | Newsletter | Name, email, open and click data | UK / USA |
| Lloyds Bank | Bank transfers | Name, payment reference, amount | UK |
| WEBSITE PLATFORM WordPress | Website | Usage data | UK /USA |
| ACCOUNTANT | Accounts and tax return | Name, amounts paid, dates. No session content | UK |
| SUPERVISOR | Clinical supervision | Discussion, if necessary, of the work you are doing, using first name only. Discussed via zoom and not recorded, no AI used or notes made. | UK |
| CLINICAL EXECUTOR | Acting if Marianne Hill dies or cannot practise | Contact details and confidential forms and session records | UK |
No AI tools are used on client information. We do not use AI notetakers, transcription services, session-summary tools or general AI assistants to record, transcribe, summarise or analyse sessions, session notes or anything you tell us. We do not upload client material to any AI system.
Some of these services may also use information for their own purposes, such as security or improving their products. We don’t control how they do this, and their own privacy policies apply. We’re happy to direct you to them.
If this list changes, we will update this notice and note the change at the top. If a change is significant, we will tell you directly.
Transfers outside the UK
Some of the providers above process information outside the UK. Where that happens, the transfer is covered by one or more of the following safeguards, as permitted by UK data protection law:
- The UK’s adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it
- The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
6. Confidentiality, and its limits
What you bring to your training sessions with us or to practice client or practice couple sessions is treated as confidential. We will not discuss it with anyone else except in the circumstances set out below.
We may need to break confidentiality where:
- You give us your explicit consent – for example, to speak to a partner or family member as part of a Restoring Connection process.
- There is a serious risk of harm to you or to someone else. Where we can, we will discuss this with you first. Where a delay would increase the risk, we may have to act without discussing it first.
- We are legally required to do so – for example by a court order.
- There is a safeguarding concern about a child or an adult at risk requires us to make a referral.
Confidentiality is also necessarily shared, in a limited way, where:
- We take your work to supervision. Where we may discuss your progress as a trainee or your work as a practice client or practice couple with a supervisor. Your first names only will be used during these discussions.
- Information passes through the digital tools listed in section 5. These providers are contractually bound to protect it, but it is honest to say that “confidential” does not mean “seen by no one but us” in a technical sense.
- The company closes down in the case of the death or illness of the director, or for any other reason. In this case a clinical executor will act (see section 7).
- We need to take legal, insurance or professional advice about a complaint or claim.
If we do break confidentiality, We will keep the disclosure to the minimum necessary, record what we disclosed and why, and tell you unless doing so would create a risk.
7. If Marianne dies or becomes unable to practise
As the sole Director of Healing The Shadow Marianne Hill has a clinical will in place. It appoints Neil Croom, a fellow coach, counsellor and therapist, to the role of Clinical Executor to act on her behalf if she dies or becomes unable to practise.
Their role is to contact you if you are currently training or acting as a practice client or couple, so that you are not left without explanation, to help you find alternative support if you want it, and to take custody of your records. They are bound by confidentiality and data protection, and they will not read session content beyond what is necessary to identify who needs to be contacted.
The clinical executor will store all records securely and destroy them seven years after Marianne dies or stops practising. You will still be able to ask them for a copy of your own records during that time.
8. How long We keep your information
| Record | How long | Why |
| Client records, session notes and email or written communication | 7 years after your training/sessions with us end, or seven years after Marianne’s death if she dies while you are a trainee/practice client or practice couple. | Professional guidance, and the period during which a claim could be brought |
| Enquiries that do not become work | 7 years | So that I can pick up a conversation if you come back |
| Financial records | 6 years after the end of the tax year they relate to | HMRC requirement |
| Mailing list details | Until you unsubscribe. From time to time, I may check that you still want to hear from me. I remove addresses that no longer work. | Consent-based |
| Data protection complaint records | 3 years from the date the complaint is closed | So I can demonstrate how a complaint was handled |
At the end of the retention period, paper records are shredded and digital files are permanently deleted, including from any backup.
9. How we keep your information safe
- Devices are password-protected, and lock automatically when not in use.
- Your identifying information and contact details are stored separately from session notes.
- Your paper records of sessions are kept in a high security locked cabinet.
- Your contact information is kept in a different locked cabinet.
No system is completely secure. If there is a breach of your personal information that is likely to result in a risk to your rights and freedoms, I will report it to the ICO within 72 hours of becoming aware of it, and if the risk is high we will tell you directly, and tell you what has happened and what you can do.
10. Your rights
Under UK data protection law you have the right to:
- Be informed about how your information is used – this notice
- Access your information, and get a copy of it (a “subject access request”)
- Rectification – have inaccurate information corrected
- Erasure – ask us to delete your information, where that right applies
- Restrict processing – ask me to pause using your information while something is resolved
- Object to processing based on legitimate interests, and to direct marketing at any time
- Take your information elsewhere (known as “data portability”) – receive information you gave me in a format you can pass to another provider, where it is processed by automated means on the basis of consent or contract
- Withdraw consent at any time, without giving a reason, and without affecting anything done before you withdrew it
- Not be subject to a decision based solely on automated processing. We do not make any automated decisions about you and do not use profiling.
- Complain – both to us and to the ICO (see section 11)
Some of these rights are qualified rather than absolute. If we cannot act on a request in full, we will explain why, in plain terms.
To exercise a right, email us at mariannehillshadowwork@gmail.com or write to the address at the top of this notice. You can ask verbally if you prefer.
There is no charge. We will respond within one month. If your request is complex, or if you have made several requests, we may extend this by up to a further two months – We will tell you within the first month if that is the case, and why.
11. How to raise a concern or make a complaint
If you are unhappy about how we have handled your personal information, please tell us. You have a legal right to complain to us directly, and we have a legal duty to deal with it properly. This right is set out in section 164A of the Data Protection Act 2018, which came into force on 19 June 2026.
You do not have to use a form, use particular words, or explain the law – just tell us. We will treat it as a complaint, acknowledge it within 30 days and respond as promptly as we can.
How to complain
- Email: mariannehillshadowwork@gmail.com – putting “Data protection complaint” in the subject line helps us spot it quickly, but is not required
- Post: Marianne Hill, 4 Sunnyside, Frome BA11 1LD
- By phone or in a session: just tell Marianne. She will write down what you have said and send it to you so you can check we have understood it correctly.
- Complaint form: there is a form you can fill and submit, or print and post. Here is the link:https://docs.google.com/forms/d/e/1FAIpQLSe8WEJm2xMvGSfzAOHROfuIE6BNeW6mbq3EC-I8xVDSdloYCQ/viewform?usp=header Using the form is entirely optional.
What we will do
- Acknowledge the complaint within 30 days, and in practice usually within a few working days.
- Investigate it, proportionately to what you have raised.
- Keep you updated if it is going to take a while.
- Tell you the outcome, without undue delay – what we found, whether something went wrong, what we have done about it, and what we are changing.
- Keep a record and tell you about your right to go to the ICO whatever the outcome.
Going to the ICO
You can complain to the Information Commissioner’s Office at any time, and you do not need our permission. The ICO would normally expect you to have raised it with us first, so that we have had a chance to put it right – but that is a preference, not a barrier.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint
Raising a concern with us, or with the ICO, will not affect the work we do together or how we treat you.
12. Cookies and this website
This website has a separate privacy policy. Please see the policy for this website here: https://htsorganisation.co.uk/privacy-policy/
13. Changes to this notice
We review this notice at least once a year, and whenever we change a tool or the way we work. The version number and date at the top will tell you when it last changed. Where a change materially affects you, we will tell you directly.
Nothing in this notice restricts your legal rights.