Privacy Note - Open to Change

Last updated: 5 October 2026

This Privacy Notice explains how I collect, use, store and protect personal information in connection with my psychotherapy and therapeutic coaching practice.

I am committed to protecting your privacy and handling personal information respectfully, confidentially and in accordance with UK data protection legislation.

Who I am

I am Olga Ashnina (Phillips), Integrative Psychotherapist (in training), UKCP Trainee Member and Therapeutic Coach, practising under Open to Change.

Email: olga@opentochange.uk
Telephone: 07874 165416

For the personal information I hold within my independent practice, I am responsible for deciding how and why that information is processed.

This notice also explains how I handle clinical notes that I am personally responsible for maintaining as part of my GP counselling placement. The GP practice may separately hold information about you under its own privacy and data-protection arrangements.

What information I collect

Depending on the nature of our contact and work together, I may collect and hold:

your name, date of birth, address and contact details;
GP details;
emergency contact details;
information contained in enquiries and correspondence;
appointment and payment information;
brief clinical notes relating to sessions and our therapeutic work;
information relevant to safeguarding, risk or your wellbeing.

I do not routinely collect information that is not necessary for our work.

I work with adults aged 18 and over. However, clients may talk about children, partners or other family members during therapy. Where information about another person is relevant to the therapeutic work, I may make a limited note of it. I aim to minimise identifying information about third parties wherever possible.

Sensitive or special-category information

Psychotherapy may involve discussing information which UK data protection law considers particularly sensitive, known as special-category personal data.

Depending on what is relevant to your therapeutic work, this may include:

physical or mental-health information;
disability or neurodivergence;
religious or philosophical beliefs;
information concerning sex life;
sexual orientation.

I only record sensitive information where it is relevant and proportionate to the work.

Why I use your information

I use personal information where necessary to:

respond to enquiries and arrange appointments;
provide psychotherapy or therapeutic coaching;
maintain appropriate clinical records;
support safe and ethical practice;
manage safeguarding or serious-risk concerns;
communicate with you about sessions;
receive and record payments;
participate in clinical supervision;
respond to concerns, complaints or professional enquiries;
establish, exercise or defend legal claims where necessary;
comply with applicable professional or legal obligations.

Lawful bases for using your information

Under UK data protection law, I must have a lawful basis for processing personal information.

While you are enquiring about working with me or we are working together, I generally process ordinary personal information because it is necessary in order to enter into or carry out our contract.

After our work has ended, I may rely on legitimate interests to retain limited records where this is necessary for professional, ethical or legal purposes. This may include responding to a complaint, professional query or legal claim and demonstrating that I have practised responsibly and in accordance with professional standards.

I only retain information that is relevant and proportionate to these purposes, restrict access to it and do not use it for unrelated purposes.

Where I process special-category information as part of the provision of psychotherapy or therapeutic care, I rely, where applicable, on the health and social care condition under Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018. This processing takes place subject to a professional duty of confidentiality.

Where it is necessary to retain or use special-category information to establish, exercise or defend a legal claim, Article 9(2)(f) may apply.

Where I receive information from

Most personal information comes directly from you.

I may also receive limited information from:

referring therapy practices or booking services, including where you make an enquiry or booking through The Practice;
other healthcare professionals where appropriate;
in my GP placement, the GP practice or clinical lead as part of the referral process.

I am responsible for securely maintaining my own clinical notes relating to the clients I see.

Confidentiality

What you share with me in psychotherapy or coaching is treated as confidential.

As part of ethical professional practice, I attend regular clinical supervision. I may discuss aspects of our work with my supervisor, normally without sharing identifying details.

There are limited circumstances in which I may need to share relevant information. These may include:

where there is a serious risk of harm to you or another person;
safeguarding concerns involving a child or vulnerable adult;
an emergency in which information is required to protect someone’s safety;
where disclosure is required by law or by a court;
where information is required in connection with a professional complaint or legal claim.

Where possible and appropriate, I would discuss this with you before sharing information.

How long I keep information

I retain client agreements and brief clinical records for seven years after our work together ends, after which they are securely destroyed unless there is a clear professional or legal reason why they need to be retained for longer.

Seven years reflects general professional best practice for psychotherapy records.

If you make an enquiry but do not go on to work with me, I retain your enquiry and correspondence only for as long as reasonably necessary and then delete it.

Financial information required for accounting and tax purposes is retained for the period required by HMRC.

Records arising from my GP placement may be subject to the retention requirements applicable to that service. Where those requirements differ, I follow the applicable record-retention policy.

How I store and protect information

I take appropriate steps to protect personal information from unauthorised access, loss, disclosure or misuse.

Brief clinical records and client information are kept securely. Access is limited to me except where information must legitimately be shared in one of the circumstances described in this notice.

I use professional digital services for email, online sessions and my website.

Organisations that process information on my behalf

I currently use the following service providers:

Google Workspace / Google Cloud EMEA Limited
Google provides my professional email service and Google Meet for online psychotherapy and coaching sessions. Online sessions are not recorded.

Elementor Hosting / Elementor Ltd.
Elementor hosts and operates my website and processes information submitted through the website contact form, together with limited technical information required to operate and secure the website.

These providers process information in accordance with their contractual and data-protection obligations.

Other organisations with whom information may be shared

Information is not routinely shared with third parties.

Where necessary and justified, relevant information may be shared with:

a GP or other healthcare professional;
emergency services;
organisations or professionals involved in safeguarding;
my professional indemnity insurer;
professional or legal advisers;
my professional or training organisation where required in connection with a professional matter;
organisations or authorities where I am legally required to provide information.

Only information that is relevant and necessary would be shared.

International transfers

Some of the digital services I use may process personal information outside the UK.

Google Cloud EMEA Limited is based in Ireland, which is recognised by the UK as providing an adequate level of data protection.

Elementor may process information in Israel, which is also recognised by the UK as providing an adequate level of data protection.

Where these providers or their authorised subprocessors transfer information elsewhere, they are required to use appropriate safeguards in accordance with UK data protection law.

Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

ask for a copy of the personal information I hold about you;
ask me to correct inaccurate or incomplete information;
ask me to erase personal information in certain circumstances;
ask me to restrict how your information is used;
object to certain types of processing;
request transfer of information you have provided, where the right to data portability applies.

These rights are not absolute and some exemptions may apply, particularly where information needs to be retained for legal, professional or safeguarding reasons.

If you make a data-protection request, I will respond without undue delay and normally within one month.

Please contact me using the details above if you wish to exercise any of these rights.

Concerns or complaints about your information

If you have any questions or concerns about how I collect, store or use your personal information, please contact me first: