Privacy policy

Last updated 13 November 2026

Your privacy matters. This policy describes what information I collect through this website, and in the course of my work, why, how it's protected and your rights.

1. Who I am

This website is run by Sarah Smith, integrative psychotherapeutic counsellor and coach, practicing under the name 'Live and Be' in the UK and online. I am the data controller for personal information collected through this website and in therapy or coaching. You can contact me about privacy through the direct enquiry form.

2. What this website collects

Cookies. When you browse this public website, I may collect basic technical data such as IP address, generic geographical locations, browser types and page interaction analytics. This data is only used in the private admin area of the website, by me.

Enquiry and booking forms. When you submit a form, I receive the details you choose to give: your name, email address, phone number, and your message. Because messages may include data about your health or well-being, which is 'special category' data, I only process it with your explicit consent, which you give by ticking the box on the form.

Security Information. When you submit an enquiry through the form 'Direct Enquiry' or enter the 'Client Portal', your details are held under the strict privacy policy of a third party encrypted practice management space or the Counselling Directory.

Practice Management. Secure encrypted messaging for enquiries and clients, backed up on secure encrypted servers based in UK and Europe.

Email. Email is stored on a secure encrypted GDPR compliant platform.

If you choose to message me via any of the following methods, your phone number is shared with me, and your message is carried under the privacy policy terms of the third party provider.

Whatsap. Although WhatsApp is end to end encrypted, Meta collects certain data about you such as your phone number.

SMS. If you choose to SMS me, your data is stored on a third party iCloud.

Signal. Signal is encrypted end to end and is stored on a personal device.

Please keep messages brief, about appointments/admin and we can talk about your personal details on the phone or in a session.

Video. Online sessions take place on an encrypted video service. I do not offer online via Whatsapp or FaceTime.

What information I collect

By making an enquiry about any of my services or by working with me, I may collect: contact information (your name, email address, telephone number, address and date of birth); emergency contact details (information about a person you nominate); health and personal information (physical or mental health details, personal circumstances, experiences, wellbeing, and reasons for seeking support); clinical or service information (assessment details, brief notes, session dates, attendance, and relevant correspondence); administrative and financial information (appointment arrangements, cancellations, payment dates, and minimal identifying information for accounting); and website information (limited technical details such as IP address, browser information, and basic cookies).

3. Why I use your information and the legal basis

I use your information to: respond to enquiries; arrange appointments and provide services, maintain appropriate clinical and administrative records; communicate with you; manage payments; meet legal, professional, and insurance obligations; and address safeguarding concerns to protect safety and wellbeing. 

Under Article 6 UK GDPR, the lawful basis depends on the purpose (e.g., performing a contract, complying with a legal obligation, or pursuing legitimate interests in managing my practice). For processing health information (special-category data), I rely on Article 9(2)(h) concerning the provision of health or social care, subject to the Data Protection Act 2018 and the strict duty of professional confidentiality.

4. How information is stored and protected

I use electronic systems and appropriate security measures to manage clinical records, client communications and practice administration. These include a practice management system, email, payment services and accountancy tools. Technical and organisational measures are implemented to protect personal information against unauthorised access, loss, or disclosure. If external providers process or transfer data outside the UK such as financial institutions or website hosting, I take all measures to ensure that what is in my control is as secure as possible. The client portal acts as my data processor when our work (appointments, messages etc) is processed securely within the practice management platform. This ensures continuity of safety of our communications, keeping it secure and safe.

5. Confidentiality Limits and Safeguarding

Confidentiality is very important, and disclosures are only made under specific, lawful circumstances: where there is a serious and immediate risk of harm to you or another person; where disclosure is required by law; where safeguarding concerns arise; where necessary to obtain professional/emergency support; or within professional supervision (which is strictly anonymised or minimised) under the same confidentiality ethics.

For emergencies, call 999. For urgent mental health support in England, contact NHS 111 and select the mental health option. Samaritans can be contacted on 116 123.

6. AI Use

I am conservative in my use of AI tools. I do not use automatic transcription, recording software or screenshotting tools during our live sessions and I request you don't either unless we have discussed this first and mutually agreed to it. I also ask that recordings, screenshots, or transcripts are not shared on social media. I may use administrative AI tools to help structure notes or administration forms, however, I do not input client-identifying data to or train AI models, use AI for supervision or run clinical work through AI. This protects the boundaries of our working relationship and my professional integrity.

7. How long I keep your information

I retain personal information only as long as necessary: clinical and service records are normally held for 5 years after your final session (meeting professional and insurance requirements); contact/appointment details are held for as long as needed to manage our work; unsuccessful enquiries are held for up to 12 months; and financial records are retained for tax/accounting legal timelines. Data is deleted when no longer required.

8. Your data protection rights

Under data protection law, you have rights including Access, Rectification, Erasure, Restriction, Objection, Data Portability, and Withdrawal of Consent. These rights are not absolute; clinical or financial records may be retained where there is a legitimate legal or insurance reason. You can exercise your rights by contacting me via the client portal or my website contact form.

9. Personal data breaches and complaints

Please contact me directly to discuss any concerns. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator, at www.ico.org or by calling 0303 123 1113.

I may update this policy and, when I do, I will date it accordingly.