Truth Casa · Matthew Bain

Privacy Notice

Last updated: 27 September 2026 at 14:36

This notice explains what personal information I hold about you, why I hold it, and what you can do about it. It covers counselling clients, anyone who contacts me about counselling, and visitors to this website.

I work with adults aged 18 and over. I do not make automated decisions about anyone, and I do not build profiles of anyone.

Where the practice is at the moment. Truth Casa is opening rather than open: I am not yet taking clients, and the systems that will hold client records are still being built. This notice tells you what I do with an enquiry today, and what I will do with a client record from the day I take a first client. When the practice starts I will update this notice again — in particular to name the services that hold your records, including for video sessions and for invoicing — and the date above will change.

• Who is responsible
• If you contact me
• If you become a client
• If you visit this website
• Who else sees your information
• Email and messages
• How long I keep things
• Your rights
• If you are unhappy

Who is responsible

I am. Matthew Bain, trading as Truth Casa, is the data controller for the information described here.

Contact me at hello@truth.casa with any question about your information, or to exercise any of the rights below.

If you contact me about counselling

What I collect: your name, your contact details, and whatever you choose to tell me in your message.

Why: to reply to you, and to work out whether I can help.

The free introductory conversation. Before we agree to work together we will usually have a free conversation of about twenty minutes, by video or telephone, so that we can both decide whether working together makes sense. To arrange one I ask for a name I can call you, an email address, a phone number if you would rather talk by telephone, and a few practical answers chosen from short lists: how you would prefer to meet, the kind of work you are looking for, when you are usually free, and how you heard of me. There is no box to write in, and you do not need to tell me anything in advance about what you are bringing. The conversation is not recorded. Afterwards I write a short note of what we agreed and whether I think I am the right person to help.

My lawful basis: you have asked me to reply, or to arrange a conversation, and I cannot do either without your name and a way to reach you. If you tell me something confidential in that first message, it is kept for the same 6 months as the rest of your enquiry, unless you become a client. (In the law's words, "steps at your request before entering a contract" and "the provision of health or social care".)

How long: 6 months from our last contact, unless you become a client — in which case any note of our introductory conversation becomes part of your client record and is kept for as long as the rest of it.

If you become a client

What I collect. Before we start, on the intake form and the Client Agreement: your name, your contact details, your date of birth, your GP's details, and an emergency contact. The same form asks four short questions answered yes or no: whether you are currently seeing a GP, psychiatrist or other professional about your mental health, whether you take any prescribed medication, whether you have had counselling before, and whether you need any adjustments to take part, for example because of a physical health condition or disability. If the answer to a health question is yes, you do not have to explain it on the form: we talk about it in our first session. There is no box on the form for telling me what is happening for you, because that is what the sessions are for.

During sessions, and in any questionnaires or feedback forms: whatever is relevant to your therapy. In practice that can include your age, background, family and relationships, health and mental health, sexuality, religion or beliefs, finances, and what is happening in your life and work. I also keep brief session notes.

I need your contact details, GP details and an emergency contact before we start. Without them I cannot work with you safely. Please let your emergency contact know that you have given me their details.

Why: to provide counselling safely and competently, and to keep the records my profession requires.

My lawful basis. I hold your contact details, your GP's details, your emergency contact, and the record of our appointments and payments because we have a Client Agreement, and I cannot carry out that agreement without those details. I hold your session notes because it is my professional duty to do so. (In the law's words, these are "performance of a contract" and "the provision of health or social care".)

Why I do not ask for your consent to keep these records. Consent is something you can take back at any moment. Counselling records are not: my profession requires me to keep them for seven years, and I would have to keep them even if you asked me not to. Asking you to consent to something I could not then undo would be a false choice, so I do not ask. Instead I tell you plainly what I keep, why, and for how long. Your rights are the same either way: you can see your records, have mistakes corrected, and ask me to delete them, and the section on your rights below says how each works.

Recording. This covers recording of any kind — a sound recording or a video one, in the room or on screen. I do not record sessions as a matter of course, and I ask that you do not record them either. The one exception happens only if you agree to it: a recording that helps my own training and supervision.

How I ask. I will ask you in our first session, face to face, and tell you which kind of recording it would be, that only a tutor, supervisor or examiner on my training course would ever see it, and how long I would keep it. If you agree, we both sign a short paper form saying so, and I keep it with your record and give you a copy. Agreeing to a sound recording is not agreeing to a video one: I make only the kind you have agreed to, and where sound alone is enough for the work, that is what I ask for. Saying no changes nothing about the work, and you need give no reason.

If you do agree. I record on my own device, keep the recording with your other records — encrypted, and separate from your contact details — show it only to a tutor, supervisor or examiner on my training course and to nobody else, and keep it only while my training course is still running. Work I do in one year often draws on sessions from an earlier one, so I cannot honestly give you a fixed date; what I can tell you is that the recordings are destroyed when the course ends, that I review what I am still holding every three months until they are, and that you can ask me at any time what I hold and why.

The part that is yours. Withdraw your agreement at any moment and I stop recording that same day, without asking you anything; if you would rather one session was not recorded, say so before it starts.

Deleting what I already hold takes a little longer, on purpose. I check whether any recording has already gone to my course with an assignment, and where I can I confirm the request with you when we next speak — because a message can be sent from someone's account by another person, and I would rather know that a request to destroy something came from you. If we cannot speak, your withdrawal still stands: everything I can delete is deleted within eight weeks at the latest, and sooner in the ordinary case.

The one limit, which I tell you before you agree rather than after. A recording already submitted with an assignment cannot be pulled back, because the examiners need it until the mark is finally confirmed; it is used for nothing else in the meantime and deleted as soon as the mark is ratified. If my course holds its own copy of what I submitted, that copy is the course's to keep under its own rules, and I will tell you what it has and when it goes.

Research. I do not record sessions for research, for advertising, or for any purpose other than the one above. If I ever wanted to record for research, that would be a separate request, explained separately and needing your explicit agreement in advance; it would never be assumed from your agreement to this, and this notice would change first.

My lawful basis for recording is your consent. Recording is genuinely optional, and you can take consent back at any time. Taking it back does not make anything done while it stood unlawful. Recordings already handed in with an assignment are different. I keep those on the basis that my training course and I have a legitimate interest in an assessed piece of work being able to stand, be moderated or be appealed on the evidence it was handed in with, and that a recording may be kept where it is needed to defend a right of that kind. (In the law's words, "legitimate interests" and "the establishment, exercise or defence of legal claims".) I rely on this only for the recordings an assignment depends on, only until its mark is ratified, and for nothing else.

How I keep it safe. Your session notes are kept separately from the details that identify you. The health answers from the intake form are kept with your session notes rather than with your contact details, so that if an administrator ever helps me with appointments or invoicing they cannot see them. Paper records are kept locked away. Electronic records are encrypted and password protected, with two-factor authentication where the service allows it. Backups are encrypted.

Who processes it on my behalf. One company holds your information on my instructions, and may not use it for anything of its own: Amazon Web Services (AWS), which runs my email and stores my records and backups in the United Kingdom. If we work by video, I will tell you which platform I use before our first session and update this notice.

If you visit this website

This website sets no cookies and runs no analytics or tracking scripts. Nothing is stored on your device, and no advertising or analytics company is told about your visit.

The server keeps an automatic record of each request: your IP address, the time, the page you asked for, whether it worked, your browser type, and the page that referred you. An IP address can indicate roughly where you are, usually only to the level of a town.

Why: to keep the site secure and available, and to see how much genuine traffic it gets as opposed to automated scanning, which is most of it.

My lawful basis: my legitimate interest in the security and upkeep of my own website. These records are not linked to any counselling record and I do not use them to identify individual visitors.

How long: 90 days, then deleted automatically.

The site is hosted by Amazon Web Services, who process this data on my instructions. It is delivered through a global content network, so your request may be served from outside the UK; the records themselves are stored in the UK.

Who else sees your information

Normally, nobody. There are four exceptions:

1. Anyone you ask me to contact — for example your GP. I share only what you have asked me to share, and a word in session is enough. If I ever needed to contact your GP without your asking, that is the risk exception below, not this one.
2. Clinical supervision. My professional bodies — the British Association for Counselling and Psychotherapy (BACP) and the UK Council for Psychotherapy (UKCP) — require me to discuss my work with a supervisor. One supervisor covers both. I use as little identifying detail as possible, and my supervisor is bound by the same duty of confidence.
3. Risk of serious harm. If I believe someone is at risk of serious harm — including a child or adult safeguarding concern — I may tell the relevant authority, or your GP. Wherever it is safe to do so, I will talk to you first and ask your agreement. If my professional judgement is that I must act without it — for example because you are too unwell to decide — I will tell you as soon as it is safe to, and record why.
4. Where the law requires it. For example a court order.

Safeguarding, and information about crime. If I have to act on a concern for someone's safety, I record what I was told, who I consulted, what I decided and what I passed on. Where that record includes information about a criminal offence, the law treats it as a category of its own: I hold it under the conditions in Schedule 1 of the Data Protection Act 2018 for safeguarding and for preventing or detecting unlawful acts, and I keep a short written policy explaining how, which you can ask me for at any time. A record connected to a safeguarding concern may be kept for longer than the periods below, and if that applies to you I will tell you.

I do not sell your information, and I do not use it for marketing.

A note on email and text messages

Email, SMS and most messaging apps are not end-to-end encrypted, so I cannot guarantee they stay private in transit. Please do not treat email as a secure way to reach me: if you share confidential information by email, you do so at your own risk. The same goes for text messages. Avoid public Wi-Fi for anything personal. If you want a more private written channel, message me on WhatsApp at [PRACTICE NUMBER]. WhatsApp messages are end-to-end encrypted, though WhatsApp itself still sees who messaged whom and when, and your own chat backups are only encrypted if you turn that on.

What happens to your messages. A copy of each message you send me, by email, text or WhatsApp, is kept with your contact details and the record of our appointments, for as long as the rest of your record. If an administrator helps me with appointments or invoicing, they can read these messages and may reply to them. Please keep anything sensitive for our sessions.

How long I keep things

I keep client records for seven years because that is the period my professional bodies' guidance and my insurer treat as best practice, and it covers the time in which a legal claim could be brought.

After that, records are securely destroyed.

Your rights

You can ask me to:

• Show you the information I hold about you
• Correct anything that is wrong
• Delete it
• Stop or limit what I do with it
• Give you a copy to take elsewhere
• Stop processing where I rely on legitimate interests — this applies to the website logs

Email hello@truth.casa. There is no charge. I will respond within one month, or up to three months for an unusually complex request, in which case I will tell you why.

Some limits, so you know where you stand. I cannot always delete records. If your information relates to a safeguarding concern, a disclosure about a crime, or something a court or my insurer may need, I may have to keep it. If that applies, I will tell you why.

If you are unhappy

Please tell me first — I would rather put it right. If you are still not satisfied, you can complain to the Information Commissioner's Office:

• ico.org.uk/make-a-complaint
• 0303 123 1113

Changes

I review this notice periodically. The date and time at the top show when it last changed.