Privacy Statement

Stepping Out Counselling, Psychotherapy and Coaching

Last updated: 16th October 2026

Your privacy matters

I understand that counselling and coaching involve sharing personal information, sometimes of a sensitive and deeply personal nature. I take your privacy, confidentiality and trust seriously.

This statement explains how I collect, use, store and protect your personal information, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

1. Who is responsible for your information?

I am Kaz Hazelwood, an NCPS-accredited psychotherapeutic counsellor and coach, trading as Stepping Out.

I am the data controller responsible for the personal information collected and processed in connection with my practice.

Contact details

Website: https://www.stepping-out.life

Email: steppingout.life@gmail.com

Telephone: 07903 274503

ICO Registration Number: ZB715298

2. What information do I collect?

Depending on the services you receive, I may collect:

Your name, address, telephone number, email address and date of birth.
Information about your physical and mental health.
Information about your personal circumstances and reasons for seeking counselling or coaching.
Relevant medical information, medication, GP details and emergency contacts.
Information provided through my client agreement and registration forms.
Appointment, payment and communication records.
Confidential notes relating to our sessions.
AI-assisted session summaries where you have explicitly agreed to their use.

I only collect information that is relevant and necessary for providing my services safely, ethically and professionally.

3. Why do I use your information?

I use your personal information to:

Arrange and provide counselling and coaching.
Communicate with you about appointments and our work together.
Maintain appropriate professional records.
Manage payments and accounting.
Meet legal, regulatory and professional obligations.
Respond appropriately to safeguarding concerns.
Support continuity of care where necessary.

Under Article 6 of UK GDPR, I generally rely on the performance of our contract to arrange and provide services, legal obligations for relevant accounting and regulatory requirements, and legitimate interests where appropriate for maintaining professional records and administering my practice.

Counselling may involve processing special-category information, particularly information about physical and mental health.

For information necessary to provide counselling and maintain appropriate therapeutic records, I rely on the health or social care condition under Article 9(2)(h) of UK GDPR, where its requirements, including the applicable duty of confidentiality, are met.

Where another lawful condition is required for a particular activity, I will identify and apply it appropriately.

4. Confidentiality

Everything discussed during counselling is treated as confidential, subject to recognised professional and legal limitations.

I undertake professional supervision to support safe and ethical practice. Client work may be discussed during supervision, with identifying information minimised wherever possible.

I do not routinely share information about our sessions with family members, employers, referring organisations or healthcare professionals.

There may be exceptional circumstances in which information needs to be disclosed, including where disclosure is required by law or justified by serious safeguarding concerns.

Where possible and appropriate, I will discuss this with you beforehand. Any disclosure will be considered carefully and limited to what is necessary.

5. How I store and protect your information

I store confidential client documents and counselling records on my password-protected computer.

My computer uses BitLocker encryption, automatic screen locking and regular security updates.

Records are backed up to Google Drive, with access controlled through my Google account.

Information submitted through my client agreement form is stored in Google Forms and its associated Google spreadsheet.

I take reasonable technical and organisational measures to protect information against unauthorised access, accidental loss, misuse or disclosure.

I do not sell client information or share it for advertising purposes.

6. Online counselling and Zoom

I use Zoom to provide online counselling and coaching sessions.

Zoom processes certain technical and participation information when you join a meeting, including information about your device, IP address and meeting participation.

Some information may be processed outside the UK, subject to applicable data protection safeguards.

Further information is available in Zoom's privacy statement:

https://www.zoom.com/en/trust/privacy/privacy-statement/

7. Use of Zoom AI Companion

I offer the use of Zoom AI Companion to help generate written summaries of online counselling sessions.

This allows me to remain more fully engaged in our conversation without needing to take extensive notes.

When enabled, Zoom AI Companion processes information from our conversation to produce a summary. This may involve temporary transcription and processing by AI systems.

Although this is different from making a conventional audio or video recording, it still involves processing confidential information.

I will only use Zoom AI Companion for your sessions where you have explicitly agreed to it.

You are free to decline. This will not affect your access to counselling or coaching.

You can withdraw your agreement at any time, and I will stop using AI-assisted summaries for subsequent sessions.

I review AI-generated summaries for accuracy and remain professionally responsible for the content of my records and all clinical decisions.

I currently delete AI-generated summaries from Zoom within 30 days. This does not necessarily mean that all associated technical or processing information is deleted from Zoom's systems within that period.

Any information retained as part of your counselling records is protected and managed in accordance with this privacy statement.

Zoom states that it does not use customer communications content to train its own or third-party AI models.

8. How long do I keep your information?

I generally retain counselling records for five years after our work together has ended, unless a different retention period is required or justified by law or professional obligations.

After the relevant retention period, records are securely deleted or destroyed.

Financial records may be retained for longer where required for accounting or tax purposes.

Information held by third-party providers may be subject to their own applicable retention arrangements.

9. Your rights over your information

Under UK data protection legislation, you have rights relating to your personal information.

Depending on the circumstances, these include the right to:

Request access to information I hold about you.
Ask for inaccurate information to be corrected.
Request deletion of information where applicable.
Request restriction of certain processing.
Object to certain uses of your information.
Withdraw consent where processing relies on consent.

These rights are subject to applicable legal conditions and exemptions.

To exercise your rights, please contact me using the details at the beginning of this statement.

10. Subject access requests

You can ask to see the personal information I hold about you, including relevant counselling records.

You can make a subject access request verbally or in writing. You do not need to use a particular form.

I will normally respond within one calendar month.

If your request is unclear and clarification is reasonably necessary, the response deadline may be paused while I await clarification, in accordance with the Data (Use and Access) Act 2025.

I am required to undertake reasonable and proportionate searches.

In certain circumstances, the response period may be extended or information may be withheld where permitted by law. I will explain this where applicable.

11. Complaints about your personal information

If you are concerned about how I have collected, used, stored or shared your personal information, you can make a complaint directly to me.

Please email:

steppingout.life@gmail.com

You can also raise your concerns by telephone or during a session.

I will:

Acknowledge your complaint within 30 days.
Investigate your concerns appropriately and without undue delay.
Keep you informed about progress.
Explain the outcome and any action taken without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO complaints information:

https://ico.org.uk/make-a-complaint/

For concerns about my professional conduct or counselling services, please see my Complaints and Concerns Policy and the NCPS Complaints and Concerns Procedure:

https://ncps.com/complaints/complaints-concerns-procedure

12. Cookies and website information

My website is hosted on Squarespace and may use cookies and similar technologies to support its operation, remember preferences and provide information about website usage.

Some cookies are necessary for the website to function. Other cookies may be used for analytics or additional functionality.

Where cookies require consent, visitors should be offered appropriate choices before those cookies are used. Where an applicable legal exemption permits cookies without prior consent, the relevant transparency and opt-out requirements will apply.

Information about cookie preferences is provided through the website's cookie controls, where available.

13. Changes to this statement

I review this privacy statement periodically to reflect changes in legislation, professional requirements and the way I provide my services.

The latest version will be available on my website.