Privacy Policy

---

Privacy Policy

Reference: UNN-016
Version: 2.1
Review date: 9 October 2026
Status: Director Approval
Approval date: 09.10.2026
Next review: October 2027, or sooner if required

1. Our commitment

Unmasked Neurodiversity Network CIC is committed to protecting the privacy of everyone who accesses our services, works with us or contacts our organisation.

We recognise that people accessing counselling and neurodiversity support may share sensitive personal information. We treat that information with care, respect and confidentiality.

This notice explains what information we collect, why we use it, who it may be shared with, how long we keep it and the rights individuals have under data protection law.

2. Who we are

Organisation: Unmasked Neurodiversity Network CIC
Company number: 15671121
Address: Suite 6, Prospect Park, Limewood Approach, Seacroft, Leeds, LS14 1NG
Email: info@unmaskednn.org
Website: www.unmaskednn.co.uk

Unmasked is generally the data controller for personal information processed in delivering its own services.

Where we work with independent practitioners or partner organisations, responsibilities may differ depending on the arrangements in place.

3. Who this notice applies to

This notice covers:

• People enquiring about or receiving counselling, coaching and other support.
• People attending groups, workshops and community activities.
• Parents, carers and family members contacting Unmasked.
• Student counsellors and placement applicants.
• Qualified counsellors and other practitioners.
• Volunteers, employees, contractors and applicants.
• Referrers, suppliers, partner organisations and website visitors.

The information collected depends on the individual's relationship with Unmasked.

4. Information we collect

• Clients and service users

We may collect contact details, referral and assessment information, communication preferences, accessibility requirements, appointment information, relevant health and wellbeing information, counselling agreements, session notes, risk and safeguarding records, payments and feedback.

• Student counsellors

We may collect contact details, applications, course and training provider information, placement agreements, professional membership and insurance information, relevant safeguarding checks, training records, placement hours, supervision arrangements and information necessary to assess suitability for client work.

• Qualified counsellors and practitioners

We may collect professional contact details, qualifications, memberships, insurance information, relevant checks, agreements, availability, caseload administration, payment information and records relating to professional or safeguarding concerns where necessary.

• Volunteers

We may collect contact details, applications, role information, emergency contact details where appropriate, induction and training records, relevant safeguarding checks, availability and information necessary to provide reasonable adjustments.

• Other individuals

We may collect information necessary to manage recruitment, partnerships, invoices, organisational communications and community activities. We aim to collect only the information necessary for the relevant purpose.

5. Why we use personal information

We use personal information to:

• Respond to enquiries and referrals.
• Assess suitability for our services.
• Deliver counselling and other support.
• Manage appointments, waiting lists and payments.
• Maintain appropriate professional and safeguarding records.
• Support clinical supervision.
• Recruit and support counsellors, students and volunteers.
• Manage organisational and contractual arrangements.
• Meet legal and regulatory responsibilities.
• Evaluate services and provide appropriate reports to funders.
• Respond to complaints and information requests.

We do not use confidential counselling records for unrelated marketing purposes.

6. Lawful bases

We identify an appropriate lawful basis under Article 6 UK GDPR for each processing activity.

Depending on the circumstances, this may include:

• Contract: To provide an agreed service or take steps requested before entering an agreement.
• Legal obligation: To comply with applicable legal requirements.
• Legitimate interests: For necessary organisational activities, subject to an appropriate balancing assessment.
• Consent: Where we genuinely rely on consent for a particular activity.
• Vital interests: In limited circumstances involving protection of someone's life.

Consent to counselling does not automatically constitute consent for every use or disclosure of information.

The specific bases used for Unmasked's activities will be documented in our internal processing records.

7. Sensitive information

We may process special category information, including health, disability, neurodivergence, racial or ethnic origin, religious beliefs and information relating to sex life or sexual orientation.

This information requires additional protection.

We will identify an appropriate Article 9 UK GDPR condition alongside the relevant Article 6 lawful basis.

Where relevant, we will also meet additional requirements under the Data Protection Act 2018, including maintaining an Appropriate Policy Document where legally required.

Information about criminal convictions or offences, including relevant DBS information, will be handled under the applicable legal requirements.

8. Counselling confidentiality and supervision

Counselling information is treated as confidential.

Relevant aspects of client work may be discussed in professional supervision, with identifying information minimised wherever practicable.

Confidentiality may be limited where disclosure is appropriately authorised, legally required or otherwise justified, including certain serious safeguarding situations.

We will consider necessity, proportionality and applicable legal requirements before sharing information.

Where appropriate and safe, we will explain significant disclosures to the individual concerned.

Further information is provided in our Confidentiality Policy.

9. How information is stored

We use organisational systems including Carepatron and Google Workspace for aspects of our clinical and administrative work.

We apply appropriate safeguards, including access controls, account security and confidentiality requirements.

Access is limited according to individual responsibilities.

Paper records, where used, must be stored securely.

We do not guarantee that digital systems are risk-free, but we take proportionate steps to protect information.

10. Sharing information

Where lawful and necessary, information may be shared with:

• Authorised members of the Unmasked team.
• Counsellors and clinical supervisors.
• Healthcare or safeguarding services.
• Emergency services.
• Referrers or partner organisations.
• IT, payment and administrative service providers.
• Legal or regulatory authorities.

We aim to share only the minimum necessary information.

Funders will ordinarily receive anonymised or aggregated reporting rather than identifiable counselling notes.

We do not sell personal information.

11. External providers and international transfers

Some external systems may process or provide access to information outside the UK.

Unmasked will review relevant provider arrangements and ensure that required contractual and international transfer safeguards are in place.

Information about processors, data locations and transfer mechanisms will be maintained in our internal records.

12. How long we keep information

We keep personal information only for as long as necessary for its purpose and applicable legal or professional requirements.

Adult counselling records: Unmasked proposes a standard retention period of seven years from the final counselling session, subject to formal approval and adoption in the organisational retention schedule.

Other information, including enquiries, safeguarding records, financial records, student placements, practitioner records, volunteer records and complaints, may have different retention periods.

Where retention needs to be extended because of legal proceedings, complaints or safeguarding matters, the reason will be documented.

Information will be securely deleted, destroyed or anonymised when no longer required.

13. Children and young people

Unmasked's counselling service is currently intended for adults aged 18 and over.

We may receive information about children and young people through family activities, enquiries or safeguarding matters.

Appropriate additional safeguards will be applied, and retention periods will be considered separately where necessary.

14. Feedback, photographs and publicity

We may invite feedback to evaluate and improve services.

Providing optional feedback will not affect access to support.

We will not publish identifiable client stories, testimonials or photographs without an appropriate lawful basis and any required permission.

15. Website and communications

Our website and online services may collect information through contact forms and other interactions.

Where non-essential cookies or tracking technologies require consent, we will seek that consent.

Any marketing communications will comply with applicable data protection and electronic communications requirements.

16. Your rights

Depending on the circumstances, individuals may have the right to:

• Be informed about how their information is used.
• Access their personal information.
• Request correction of inaccurate information.
• Request erasure in certain circumstances.
• Restrict or object to certain processing.
• Request data portability where applicable.
• Withdraw consent where processing relies on consent.
• Receive protections relating to certain automated decisions.

These rights are subject to applicable legal conditions and exemptions.

Requests may be made verbally or in writing.

Contact: info@unmaskednn.org

We will respond within the applicable legal time limits.

17. Data breaches

We investigate suspected personal data breaches and take proportionate action.

Where legally required, we will report relevant incidents to the Information Commissioner's Office and notify affected individuals.

18. Complaints

Concerns about how Unmasked handles personal information can be raised with:

info@unmaskednn.org

Individuals also have the right to complain to the Information Commissioner's Office:

www.ico.org.uk
0303 123 1113

19. Making privacy information available

We aim to provide relevant privacy information when personal information is collected.

This includes enquiry and intake processes, placement applications, practitioner agreements, volunteer onboarding and website forms.

Privacy information will be made accessible in alternative formats where reasonably practicable.

20. Review

This policy will be reviewed annually or sooner where legal requirements, systems or organisational arrangements change.

Prepared for approval by: Toni Denton
Approval date: 09/10/2026

This policy explains our data practices to individuals. Our Confidentiality Policy and Data Protection Policy establish the corresponding responsibilities for people working with Unmasked.