Legal
How your personal information is collected, used and protected — on this website, when you get in touch, and if you go on to work with me.
Last updated 25 August 2026
This website sets no cookies and does not track you. It counts visits, using a service that stores nothing on your device and cannot identify you or follow you to other websites. There is no advertising and no advertising pixels, and nothing about you is ever sold, rented or shared for marketing.
If you send an enquiry, I use those details only to reply to you and to arrange an introductory call. If you go on to become a client, I keep confidential records of our work, as I am professionally required to — and the sections below explain exactly what that means.
The rest of this page is the detail. If anything here is unclear, please just ask.
Gr8tStep is the practice of Gina Riley, providing counselling, coaching and physical wellbeing services. Gr8tStep is a trading name of V Riley, who practises as Gina Riley and operates as a sole trader. For data protection purposes the data controller is V Riley.
You can reach me at gina@gr8tstep.co.uk. A postal address is available on request.
I am registered with the Information Commissioner's Office (ICO) as a data controller.
I am a Registered Member of the British Association for Counselling and Psychotherapy (MBACP, membership number 01009586) and an EIA Coaching Practitioner with EMCC Global (UK MEM:202506928). My handling of your information sits within their ethical frameworks as well as within data protection law.
This policy covers your use of this website and your first contact with the practice. If you go on to become a client, you will be given a fuller privacy notice alongside your working agreement, covering session records in more detail. Where the two differ, the notice you are given as a client applies to your client records.
This site sets no cookies at all, so there is no cookie banner to dismiss. There is no advertising network, no advertising pixels, no social media tracking and nothing that profiles you or follows you to other websites.
It does count visits, using Vercel Web Analytics — the same company that hosts the site. This was chosen specifically because of how little it takes: it stores nothing whatsoever on your device, sets no identifier, and does not track anyone from one site to another or from one visit to the next.
What it records is the page visited, the general region it was visited from, and the broad type of device and browser. It does not store your IP address. Instead a temporary, one-way hash is made from the incoming request to tell one visitor's page views apart within a single day, and that is discarded every 24 hours — so there is nothing that persists, and nothing that can be traced back to you. I see visitor counts and popular pages, never people.
The site also measures how quickly its pages load for real visitors, using Vercel Speed Insights. That records timings — how long a page took to appear and to become usable — alongside which page it was, the broad type of device and the speed of the connection. It exists so I can tell whether the site is slow for people on a phone or a poor signal, and it sets nothing on your device either.
Because neither of these stores anything on your device, and nothing in them identifies you, they do not require your consent under either the Privacy and Electronic Communications Regulations or data protection law. If you would rather it did not count you at all, most browsers and privacy extensions can block the request, and the site works exactly the same without it.
The site stores one small flag in your browser's own session storage, recording that you have seen the opening animation so that it does not replay on every page. It is strictly functional — it is what makes the site work as intended rather than anything that watches you — and is exempt from the consent rules for that reason. It is readable only by this site, holds no personal information, and is erased automatically when you close your browser.
This website is hosted by Vercel Inc. Like any web host, their servers automatically log technical information about requests — including your IP address, the time of the request, the page requested and basic browser information. These logs exist for security and to keep the site running, are generated by the host rather than collected by me, and are retained for a short period under Vercel's own policies. I do not use them to identify visitors.
The typefaces used on this site are served by Google Fonts. When a page loads, your browser requests those font files from Google's servers, and Google therefore receives your IP address as part of that request. Google states that it does not use these requests to build advertising profiles. If you would rather avoid this, most browsers and privacy extensions allow third-party requests to be blocked; the site remains usable and simply falls back to standard system typefaces.
If you complete the enquiry form on the Book page, I receive your name, your email address, your phone number if you choose to give it, which service you are interested in, and whatever you write in the message box.
The form deliberately asks for very little, and it asks you not to include sensitive detail about your circumstances. That is not a formality — an enquiry form is not a secure or confidential channel in the way a session is, and there is no need to explain anything difficult in writing before we have spoken. A sentence or two is genuinely enough.
The enquiry form is delivered by Web3Forms, a form-handling service. What you write is passed to them, turned into an email and sent to me; they do not store the contents of your enquiry, and it is not used for anything else. My email is Zoho Mail.
If you contact me directly, I hold whatever you choose to tell me. The free introductory call is a conversation, not an assessment: it is not recorded, and I keep only brief notes of what we agreed.
Video calls take place on Microsoft Teams, Google Meet or Zoom, whichever suits you best. Sessions are never recorded.
Once we begin working together I will hold more information, and some of it is sensitive. This will include your contact details, your GP's details, an emergency contact, a short assessment of what brings you to therapy, relevant health information, and brief factual notes of each session.
Information about your physical or mental health is special category data under data protection law, which means it carries additional protection. It is kept securely, kept to the minimum necessary, and seen by nobody else except in the specific circumstances set out below.
Like all ethically practising counsellors, I discuss my casework in regular clinical supervision. This is a professional requirement and it exists to protect the quality and safety of your therapy. Your identity is not shared: cases are discussed anonymously, and my supervisor is bound by the same duties of confidentiality.
What you bring to a session stays between us. There are a small number of circumstances where I may have to pass information on, and I would always aim to discuss it with you first wherever it is safe and appropriate to do so:
These limits are explained again in your working agreement before any therapeutic work begins.
Data protection law requires a lawful basis for processing personal information. The bases I rely on are:
I do not send marketing, and I will not add you to a mailing list.
Your information is not sold, rented or shared for marketing under any circumstances. It is shared only with the service providers needed to run the practice, each of which acts on my instructions and is bound to keep it secure:
Some of the providers above are based in, or store data in, the United States — Vercel, Google and Web3Forms in particular. Where information is transferred outside the UK, it is protected by the safeguards data protection law requires, such as the UK Addendum to the International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework. Your clinical records themselves are not routinely transferred overseas.
Email is the exception, and deliberately so. My inbox is hosted on Zoho's European servers, and the UK recognises the EU as offering an equivalent standard of protection to its own — so anything you email me stays under protections the UK already treats as adequate, with no additional transfer safeguards needed.
Records are held securely, with access limited to me alone. Electronic records are stored on password-protected, encrypted devices and accounts; any paper records are kept in locked storage. Identifying details are kept separately from session notes wherever practical, and I keep only what is genuinely necessary.
No method of transmission over the internet is completely secure. Email in particular is not a confidential medium, which is why the enquiry form asks you not to put sensitive detail in writing.
Under UK data protection law you have the right to:
To exercise any of these, email gina@gr8tstep.co.uk. I will respond within one month and there is no charge. I may need to confirm your identity first.
Some rights are qualified rather than absolute. Where a professional obligation requires me to retain a record, I will explain that to you rather than simply refuse.
If you are unhappy with how your information has been handled, please tell me first — I would always rather put something right directly.
You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
If your concern is about my professional practice rather than your data, the BACP operates a professional conduct procedure at bacp.co.uk.
This policy may be updated from time to time. The date at the top of the page shows when it was last revised. If anything changes materially for existing clients, I will tell you directly rather than rely on you noticing here.
Any question about this policy, or about your information, is welcome at gina@gr8tstep.co.uk.
A Moment To Pause
Four rounds, a little over a minute.
Stop whenever you like. If you feel light-headed, let your breathing return to normal.