BIANCA MARIE ROSS
Privacy Policy
This privacy policy explains how Bianca Marie Ross collects, uses, stores, and protects your personal data when you use any of our services, including our websites, therapy sessions, programmes, and AI support tools.
Last updated: May 2026
Bianca Marie Ross is a qualified counsellor and NLP practitioner operating in the United Kingdom. She is the founder of Counsellor Care and the creator of the Ross Neurodiversity Integration Framework (RNIF).
For the purposes of UK data protection law, Bianca Marie Ross is the data controller for all personal data collected through this website and associated services.
Contact: www.biancamarieross.com
Counsellor Care: www.counsellor-care.co.uk
• Your name and email address if you complete the contact form
• Your phone number if you choose to provide it
• Any information you include in your message to us
• Technical data such as your IP address, browser type, and pages visited — collected automatically by our website provider GoDaddy
• Your name, contact details, and date of birth
• Relevant background information you share during an initial consultation
• Session notes and clinical records
• Any correspondence between us
Susan is an AI-powered between-session support assistant available to existing clients. When you use Susan, the following data is collected:
• The content of your conversations with Susan
• The date and time of each conversation
• A conversation identifier
Conversations with Susan are classified as special category data under UK GDPR because they relate to your mental health. This data is afforded the highest level of protection.
• Your email address
• Your name if provided
We use your personal data to deliver counselling, NLP, and related services. This includes maintaining clinical records, preparing for sessions, and following up appropriately.
Conversation data from Susan is used to:
• Provide between-session support to existing clients
• Alert your therapist when a clinical concern or risk is identified
• Enable your therapist to review conversations where a concern has been flagged
Susan's alert system sends an automated notification to Bianca Marie Ross when crisis language is detected in a conversation. This notification includes the message content, timestamp, and conversation ID.
When you contact us through the website, we use your information to respond to your enquiry and, if appropriate, to discuss working together.
If you have signed up to our newsletter, we use your email address to send you updates about our services and offerings. You can unsubscribe at any time.
We may use and retain your data where required by law or by our professional regulatory bodies, including BACP.
We process your personal data on the following legal bases:
• Explicit consent — for newsletter sign-ups, for use of Susan, and for the collection of special category health data
• Contractual necessity — to deliver the therapy or programme services you have agreed to
• Legitimate interests — to respond to enquiries and manage our practice
• Vital interests — where processing is necessary to protect your life or the life of another person
• Legal obligation — where we are required to retain or share data by law or professional guidance
Mental health information is classified as special category data under UK GDPR. This applies to:
• Clinical session notes and records
• Information shared during therapy
• Conversations with Susan
We process this data only on the basis of your explicit consent and where necessary to provide health and social care services. We apply the highest level of care and security to this data at all times.
We do not sell your personal data to anyone. We do not share your data with third parties for commercial or marketing purposes.
We may share your data in the following limited circumstances:
Our services are supported by the following third-party platforms, each of which processes data on our behalf under appropriate data processing agreements:
• Botpress — hosts the Susan AI support tool. Data is processed in accordance with GDPR-equivalent standards.
• Make (formerly Integromat) — used to route crisis alert notifications. Based in the EU.
• Google Gmail — used to receive crisis alert notifications.
• GoDaddy — hosts our websites and processes website usage data.
We discuss client work in clinical supervision as required by our professional obligations. This is done anonymously wherever possible. Our supervisor is bound by equivalent confidentiality obligations.
We may share your data without your consent where we are legally required to do so, or where we have a safeguarding obligation — for example, where there is a risk to your life or the life of a child or vulnerable adult. We will always try to discuss this with you first unless doing so would put you or others at risk.
Some of our platform providers may process data outside the UK. Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions recognised by the UK Information Commissioner's Office.
• Client therapy records: retained for a minimum of 7 years following the end of the therapeutic relationship, in line with professional guidance
• Susan conversation data: retained for 12 months, unless a crisis or safeguarding concern requires longer retention
• Crisis alert data: retained for 24 months where a significant risk to life was identified
• Safeguarding disclosures involving a child: retained until the youngest person involved reaches the age of 25
• Website enquiry data: retained for 12 months
• Newsletter subscriber data: retained until you unsubscribe
Under UK GDPR, you have the following rights in relation to your personal data:
• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request that inaccurate data is corrected
• Right to erasure — to request deletion of your data, subject to our legal and professional obligations
• Right to restriction — to request that we limit how we process your data
• Right to data portability — to receive your data in a portable format
• Right to object — to object to our processing of your data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, please contact us directly. We will respond within one month. In some cases, particularly where data must be retained for clinical or legal reasons, we may not be able to fulfil a deletion request immediately — we will explain this clearly if it applies.
Our websites use cookies to analyse traffic and improve your experience. When you first visit our site, you will be asked to accept or decline cookies. You can change your preferences at any time.
We use Google Analytics via GoDaddy to understand how visitors use our site. This data is anonymised and aggregated. We do not use cookies for advertising purposes.
This section provides specific information about how your data is handled when you use Susan, our AI between-session support tool.
Susan is an AI-powered support assistant available to existing clients of Bianca Marie Ross. She is not a therapist and does not replace therapy sessions. She is available 24 hours a day, 7 days a week to provide a supportive presence between sessions.
Susan is powered by GPT-4.1, developed by OpenAI, accessed through the Botpress platform. When you send a message to Susan, that message is processed by the AI model to generate a response. Conversation data is stored by Botpress.
Susan monitors conversations for language that may indicate a risk to your safety or the safety of others. When such language is detected, an automated alert is sent to Bianca Marie Ross. This alert includes the message you sent, the time it was sent, and a conversation reference number.
This alert is sent via Make (EU-based) and delivered to a Gmail inbox. You will be informed of this process in the informed consent document you sign before using Susan.
Before accessing Susan, you will be asked to read and sign an informed consent document. This confirms that you understand what Susan is, how your data is used, and the circumstances in which your therapist may be alerted. Access to Susan is conditional on providing this consent.
Susan conversation data is retained for 12 months. You may request earlier deletion at any time by contacting Bianca Marie Ross. Where there is an active clinical or safeguarding concern, data may be retained for longer — you will be informed if this is the case.
We take the security of your personal data seriously. The measures we take include:
• Use of GDPR-compliant third-party platforms with appropriate data processing agreements
• Limiting access to personal data to those who need it
• Treating all mental health data as special category data with the highest level of care
• Regular review of our data handling practices
No system is completely secure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of it.
If you have any concerns about how we handle your personal data, please contact us directly in the first instance. We will do our best to resolve any concerns promptly.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We may update this privacy policy from time to time, for example when our services change or when legal requirements change. The date at the top of this document shows when it was last updated. We will notify existing clients of any significant changes.
Bianca Marie Ross
Last updated: May 2026