PRIVACY POLICY

Black Sheep Wellbeing | Ken Etchells MA, MBACP 00988492 | ICO 00014426800 Holistic Insurance Services HIS1222343 | Newline Syndicate 1218 at Lloyd's | 26 June 2026 to 25 June 2027 Online, Telephone, Home Visits & Walk & Talk - NO clinic at home WF9 4NG | Konfidens Secure GDPR Practice Management www.blacksheepwellbeing.co.u ────────────────────────────────────────────────────────────────────────────── Privacy Policy Data Controller: Ken Etchells, Black Sheep Wellbeing - NO FIXED PREMISES - NO IN-PERSON AT HOME WF9 4NG - Correspondence via website only www.blacksheepwellbeing.com ICO Registration: 00014426800 BACP 00988492 renewal 24 Feb 2027 Insurance Holistic Insurance Services HIS1222343 Newline Syndicate 1218 at Lloyd's Malpractice & Professional Liability £5m any one occurrence, Public Liability £5m, Products Liability £5m, £10m aggregate incl. defence costs 26 June 2026 to 25 June 2027 Practice Management System: Konfidens (Mindcare AS, Røatoppen 11C, 0756 Oslo, Norway, Business Reg 925 239 070, hello@konfidens.com) - UK GDPR Representative Euverify Ltd, 3rd Floor 86-90 Paul Street, London EC2A 4NE, gdpr@euverify.com - Privacy Policy last revision Aug 5 2026 - Data Processing Agreement available at app.konfidens.uk - Sub-processors at konfidens.com/sub-processors - EU/EEA based data centres - Encrypted - Separation of health and personal data Last Updated May 2025 v4 KONFIDENS CORRECTED No jargon - trauma-informed includes data handling. 1. What collected: Enquiry: name, email, phone, what you share. Client: name, DOB, client home address for home visits (encrypted in Konfidens), phone, email, GP & emergency contact, assessment, brief factual notes (stored separately from personal data in Konfidens per their security model), payment via Konfidens Pay, consent forms. Website analytics anonymised, cookies. 2. Lawful Basis: Enquiry Legitimate Interest, Counselling Contract Article 6(1)(b) and health data Article 9(2)(h) with Data Protection Act 2018 Schedule 1 Part 1 para 2 (provision of health care), Records 7-year per insurance {POLICY} BACP {BACP} Legitimate Interest, Website security Legitimate Interest. Where Konfidens is data processor (session notes, appointments, client details) - governed by Konfidens Data Processing Agreement app.konfidens.uk, I as therapist am data controller for patient record. Where Mindcare AS is data controller: secure login, booking, booking history, payment - Article 6(1)(b). 3. How stored & Security - Konfidens: Practice management via Konfidens - Secure GDPR-compliant platform designed for therapists UK. Features: EEA/EU based data centres GDPR compliant, encryption from capture to storage and access, separation of health and personal data only brought together in your browser (in unlikely breach health info remains protected), Two-Factor Authentication MFA password + one-time password, event logging per Norwegian Directorate of eHealth (accessing patient record, writing notes, signing notes, granting access includes user identifier date login method IP for sensitive actions like printing), no third-party marketing/tracking cookies only functionality/security, sub-processors listed publicly at konfidens.com/sub-processors all within EEA/UK unless stated, Privacy Policy last revision Aug 5 2026. My own storage: Notes separately from identifying details per Konfidens separation model, password-protected encrypted 2FA, paper locked in private residence no clinic access, devices encrypted, no unsecured USB, home address WF9 4NG not published correspondence via website only. Never sell data. 4. Video Calls - Konfidens/Whereby: Video via Konfidens using Whereby - European video provider founded in Norway built with privacy at core, chosen over US providers for GDPR alignment. GDPR-compliant secure video calls seamlessly integrated, works from any browser mobile/desktop no install, chat and screen sharing built-in, notes appointments client records at fingertips directly from video call, automated confirmations and reminders secure video room per appointment email/SMS link to join. No recording by either party unless agreed for supervision with explicit consent and stored securely by therapist not Konfidens. 5. Retention: Enquiry not client 6 months, Client file 7 years after ending per insurance {POLICY} then secure deletion per Konfidens archiving (account archived and anonymized 6 months after 4 years inactivity unless login), Payment 7 years HMRC per Norwegian accounting 10 years fiscal year for Mindcare AS where applicable. 6. Access: Only me except anonymised supervision BACP {BACP} initials only, legal/safeguarding/serious risk, explicit consent GP. Konfidens as processor processes on my instructions per DPA. No marketing third parties. 7. Rights: Access, rectification, erasure (not absolute where 7-year insurance {POLICY} required or healthcare legal obligation to maintain records), restriction, objection, portability, complain. Respond 1 month via website or hello@konfidens.com for data where Mindcare is controller. Contact UK GDPR Representative Euverify Ltd London EC2A 4NE gdpr@euverify.com for UK subjects. 8. Cookies: Konfidens does not use third-party cookies for marketing/tracking but has certain cookies for user-friendliness and security minimal. Essential for site to work, analytics anonymised only if accept. See Konfidens cookie info at app.konfidens.uk and my Cookie Policy. 9. Complaints: Me first, then ICO www.ico.org.uk 0303 123 1113 ICO 00014426800 and BACP 01455 883300 BACP 00988492 and Konfidens hello@konfidens.com or Euverify representative. 10. Changes: Reviewed annually or when office secured or Konfidens updates privacy Aug 5 2026.