Privacy Policy
I understand how important your privacy is. I adhere to current data protection legislation, including the General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), alongside the ethical framework of the BACP. These guidelines exist to protect your confidential material.
Who I am
Therapy with Jess
Jess Lock
c/o Favonius, Wyndham House, 65 The Cl, Salisbury SP1 2EN
'Data controller' is the term used to describe the person or organisation that collects, stores, and is responsible for people's personal data. In this instance, the data controller is me. I am registered with the Information Commissioner's Office, reference number ZC258468.
In order to provide you with the best service possible, I hold your personal contact details and records of your therapy sessions. Below is information about how this is held and used.
The legal basis for processing your data
I process your personal data under the following lawful bases:
· Contract - to arrange, run, and administer the counselling/therapy service you've asked for (e.g. booking, scheduling, payment).
· Legitimate interests - for example, keeping basic records to meet my professional obligations as a BACP member.
· Legal obligation - where I'm required to retain or disclose information by law (e.g. a court order, or HMRC).
· Consent - where I ask you directly, such as for sharing information with your GP in a non-emergency context.
Information about your health, including anything you share relating to your mental or physical wellbeing, is classed as special category data under Article 9 of UK GDPR. I process this on the basis of your explicit consent, given when you book a session with me, and because it is necessary for the provision of health/social care treatment, in line with my professional and ethical obligations as a BACP registered therapist and counsellor.
Your personal information
At the point of booking your initial consultation with me, you will be asked for your personal contact information, and you may also choose to share details of the issues you are looking for help with. Your contact information is stored securely on biometrically-protected devices and can only be accessed by me. By submitting your data, you are agreeing to receive the communications you have requested, such as initial consultation or session scheduling messages.
In order to fulfil my duty of care to you, prior to our first session (or in subsequent email administration), I will ask you for contact information for your GP and an elected Emergency Contact. These details are stored securely and only accessible to me. I will only contact your GP or Emergency Contact in a genuine safeguarding situation, or with your knowledge and agreement, except where I believe there is a serious and immediate risk to your safety or someone else's.
Please note that standard email is not a fully secure method of communication. While I take reasonable precautions, I cannot guarantee the security of information sent by email and would encourage you to avoid including highly sensitive details where possible.
How long your data is kept
Data given in an enquiry from a potential client will be kept for up to 12 months if therapy does not commence. If therapy does commence, I am required to keep records for 7 years. I store personally identifiable information (e.g. name, telephone number, address and email address) separately from session notes, all of which are retained for up to 7 years after your last session. After this time, they will be confidentially destroyed.
Data usage
I will never pass on your contact details to any third-party organisations for the purposes of sales, marketing, or research, and will never use your personal data for any purpose other than the administration of the counselling service I'm providing to you (i.e. to arrange, cancel and rearrange appointments, collect payment for sessions, or share information pertinent to your therapeutic process). This does not include the third-party service providers listed below, who help me operate the website and business.
Website and other service providers
Squarespace provides the website platform, including hosting, site functionality, contact forms, cookie banner tools, and basic website security. When you use this website or submit an enquiry through the contact form, Squarespace may process information such as your name, email address, phone number, enquiry details, IP address, browser information, and information about how you interact with the site.
Squarespace is based in the United States. Where your data is transferred outside the UK/EEA, this is done under appropriate safeguards, such as Standard Contractual Clauses, as set out in Squarespace's own privacy policy.
This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website and/or app. For information about the cookies dropped on your device, visit Squarespace's information pages here and here.
Confidentiality
Everything you discuss with me is confidential. Confidentiality will only be broken if there is concern about your safety or the safety of someone else, or I am instructed to do so by a Court of Law. This could include circumstances where:
· You disclose that you are at risk of harming yourself or others.
· You disclose that a child or vulnerable person is at risk of harm.
· You disclose information about serious crime, including terrorism, money laundering, and/or drug trafficking.
· A judge or coroner makes a legal order for the release of client notes.
I will always endeavour to speak to you about this first, where it's safe and appropriate to do so.
During remote working, I will ensure sessions are conducted in a quiet, private, and confidential setting. I have selected video calling platforms that offer end-to-end encryption to maximise privacy. Please note, however, that I cannot be held responsible for breaches arising from failures in third-party technology.
As part of my commitment to the BACP's ethical framework, I discuss my clinical work with a supervisor, to ensure I'm offering you the best support possible. These conversations are bound by professional confidentiality, and you will only ever be referred to by your first name.
In the event of my unexpected death or incapacity, I have appointed a trusted colleague, also bound by the same professional confidentiality, to manage client contact and data. This is known as a 'Clinical Will'.
I may keep short, factual notes of session content. These are pseudonymised (meaning they don't display your full name and are stored separately from your identifying details) and held in a locked filing cabinet or a password-protected file. They are for my use only, and help me keep track of what's been discussed. Please note that because these notes can still be linked back to you using information I hold elsewhere, they remain personal data under data protection law, and are retained and destroyed in line with the timeframes set out above.
Your name will appear on my business bank statements as a record of payment. In certain regulated circumstances, such as mortgage applications or HMRC audits, third parties may request access to these statements. Where this happens, I will take all reasonable steps to redact your information. However, some lenders or regulatory bodies require unredacted statements; in those instances, I am not able to refuse this, as it is a legal or financial obligation. I will only ever disclose the minimum information required.
Your rights
I try to be as open as possible in giving people access to their personal information. Depending on the lawful basis under which it's processed, you have the right to:
· Ask for a copy of the information I hold about you
· Ask me to correct inaccurate information
· Ask me to delete your personal information
· Ask me to restrict how I use your personal information
· Object to the use of your personal data in some circumstances
· Withdraw consent at any time, where consent is the basis for processing
You can read more about your rights at ico.org.uk/your-data-matters.
Please note: some of these rights (particularly deletion and restriction) don't apply where I have a legal or professional obligation to keep records, such as the 7-year retention period required by my insurance and the BACP's ethical framework.
To exercise any of these rights, please contact me by email at hello@therapy-with-jess.co.uk. I will respond within one month.
Raising concerns
Should you have any concerns about my data protection practices, you can raise these directly with me via email. You can also contact the Information Commissioner's Office at ico.org.uk. I am registered with the ICO under reference number ZC258468.