Privacy Policy

Last updated: 01/09/2026

1.    About this Privacy Policy

Your privacy is very important to me, and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended, including:

·      Why I am able to process your information and what purpose I am processing it for

·      Whether you have to provide it to me

·      How long I store it for

·      Whether there are any other recipients of your personal information

·      Whether I intend to transfer it to another country

·      Whether I do automated decision-making or profiling

·      Your data protection rights

I am happy to chat through any questions you might have about my data protection policy, and you can contact me via jessirwintherapy@gmail.com.

‘Data controller’ is the term used to describe the person/organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me.

I am registered with the Information Commissioner’s Office (ICO). Registration number ZC239056.

2.    Your rights

I try to be as open as I can be in terms of giving people access to their personal information. You have a right to ask me to delete your personal information, to limit how I use your personal information, or to stop processing your personal information. You also have a right to ask for a copy of any information that I hold about you and to object to the use of your personal data in some circumstances. You can read more about your rights at www.ico.org.uk/your-data-matters.

If I do hold information about you I will:

·      Give you a description of it and where it came from

·      Tell you why I am holding it, tell you how long I will store your data and how I made this decision

·      Tell you who it could be disclosed to

·      Let you have a copy of the information in an intelligible form

You can also ask me at any time to correct any mistakes there may be in your personal information I hold about you.

To make a request for any personal information I may hold about you, please put the request in writing addressing it to jessirwintherapy@gmail.com. 

If you have any complaint about how I handle your personal data, please do not hesitate to contact me. I would welcome any suggestions for improving my data protection procedures. Please include your name and what your concern is related to. I will acknowledge your complaint within 30 days.

If you want to make a formal complaint about the way I have processed your personal information you can contact the ICO which is the statutory body that oversees data protection law in the UK. For more information, go to www.ico.org.uk/make-a-complaint.

Please note, these rights are not absolute and may be subject to legal or regulatory requirements. I may need to keep some information for legal, professional, safeguarding, insurance, or complaint-related reasons.

3.    What information I collect

Depending on your relationship with me, I may collect and use the following information:

·      Your name and contact details, such as email address, telephone number and postal address.

·      Your date of birth.

·      Emergency contact details, or other relevant contact information where you choose to provide it. 

·      Information you provide when making an enquiry or arranging an appointment.

·      Information relating to your therapy sessions and treatment. 

·      Information about your mental or physical health, wellbeing, and personal history where relevant to providing therapy.

·      Payment and invoicing information.

·      Correspondence between us.

·      Information relating to appointments, cancellations, and attendance.

·      Information necessary to manage professional, legal, regulatory or insurance requirements. 

Some of the information you provide may constitute special category data under UK data protection law. This includes information about mental and physical health, sexuality, ethnicity, religion, or other sensitive areas relevant to therapy. 

I only collect information that is relevant, ethical and necessary for the purposes described in this Privacy Policy.

4.    How I use your information 

I may use your personal information to: 

·      Respond to enquiries and requests for information.

·      Provide a therapeutic service.

·      Arrange and manage appointments, payments and invoices.

·      Communicate with you about your appointments. 

·      Meet legal, regulatory, professional and insurance requirements.

·      Protect your safety of the safety of another person where this is necessary and lawful. 

·      Keep appropriate clinical records.

·      Deal with complaints and disputes. 

I will not use your personal information for unrelated purposes, nor will I try to sell your data. 

5.    Lawful basis for processing

Under UK GDPR, I must have a lawful basis for processing personal information. Depending on the circumstances, I may rely on: 

·      Article 6(1)(b) – Contract: where processing is necessary to provide services you have requested or to take steps at your request before entering into a contract.

·      Article 6(1) –Legal obligation: where processing is necessary for me to comply with the law.

·      Article 6(1)(f) – Legitimate interests: where processing is necessary for me to run my practice safely, respond to enquiries, keep appropriate records and protect myself and clients.

·      Article 6(1)(a) –Consent: where I have appropriately obtained your consent for a particular processing activity. 

The appropriate lawful basis depends on the particular purpose for which information is being processed. 

6.    Health and other special category information

Information about your health is special category data and receives additional protection under UK data protection law. Where I process special category data, I will identify both an appropriate Article 6 lawful basis and an Article 9 condition for processing. Where applicable to the provision of therapy, this may include the Article 9(2)(h) health and social care condition, subject to the requirements and safeguards that apply to that condition. I will only process special category information where it is necessary, relevant and lawful to do so.

7.    Confidentiality

Confidentiality is an important part of therapeutic work. I will normally keep the information you provide confidential and will not disclose it to other people without your permission unless there is a lawful basis for doing so. There may be circumstances where confidentiality cannot be maintained, such as:

·      For the purposes of supervision - Following the BACP guidelines, all therapists require supervision. These sessions allow me to gain support and guidance to maintain ethical and competent work. When I discuss our work together, I will keep your identity anonymous, and any identifying details will be altered.

·      If there is a safeguarding concern involving a vulnerable adult or child.

·      If disclosure is necessary to prevent or detect a serious crime.

·      If I believe you are at serious risk of harm to yourself or another person.

·      If I am legally required to give evidence in a court of law.

If it is possible, I will aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

8.    Who I may share information with

I will only share your personal information where there is a lawful reason to do so. Depending on the circumstances, this may include sharing information with:

·      My clinical supervisor/s.

·      The BACP, if required in relation to a complaint or ethical matter.

·      Emergency services where necessary.

·      Your GP or another healthcare professional, where appropriate and lawful.

·      My insurer, solicitor or other professional advisers where necessary and lawful. 

·      An appointed clinical executor if I die or become unable to contact clients myself.

·      Service providers who may process information on my behalf.

If I or another organisation processes personal information on my behalf, I will take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

9.    Where your information is stored

I take the security of the data I hold about you very seriously and as such I make every effort to make sure it is kept secure. 

·      Website/contact form: Squarespace

·      Email: Gmail

·      Client records: Encrypted, password-protected folder on my PC

·      Payments/invoicing: Barclays Bank

·      Phone/messages: SMS, Instagram, Facebook

10.  How long I store information 

I keep information only for as long as necessary for the purpose for which it was collected. Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person. As a general guide: 

·      Enquiry information is deleted within 3-6 months if you choose not to proceed with therapy.

·      Client records may be kept for at least 5 years from the end of our contact with each other. 

·      Email or other forms of correspondence will be deleted after 3 months if it is not important. If necessary, I will store this within your encrypted folder which will be destroyed in line with client record retention above.

·      Financial records may be kept for the period required for tax and accounting purposed, usually annually. 

·      If the work involves a child or young person, a different retention period will apply.

If you want me to delete your information sooner than this, please let me know.

11.  Therapy records and notes

I keep written notes of each session in order to meet professional and ethical requirements. I aim to keep records accurate, relevant and limited to what is necessary. They may include session dates, brief themes discussed, any relevant risk or safeguarding information, contact and admin information. I do not keep full transcripts of sessions.

12.  Online therapy

Where therapy is provided online, I may use:

Platform: Google Meet

The platform provider may process personal information in accordance with its own privacy policy.

I will take reasonable steps to use appropriate privacy and security settings and will not knowingly record online therapy sessions unless there is a specific lawful reason to do so and, where required, informed consent has been obtained.

I do not consent to our sessions being recorded for your own personal use. If you are found to be recording our sessions without consent, our therapeutic relationship may end.

13.  Cookies and website information

When someone visits my website, I use Squarespace to collect standard internet log information and details of visitor behaviour patterns. I do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. I do not make, and do not allow Squarespace to make, any attempt to find out the identities of those visiting my website. 

I use legitimate interests as my lawful basis for holding and using your personal information in this way when you visit my website. 

Like most websites we use cookies to help the site work more efficiently. For reference, see www.bacp.co.uk/notices/cookies.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. 

14.  Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changed in my practice, technology, legal requirements or regulatory guidance. The most recent version will be made available at www.jessirwintherapy.com.