Privacy Policy

Last updated: 19 June 2026

This document explains how Jessica Jeffrey collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.

1. Who I am

Jessica Jeffrey is the data controller responsible for your personal data.

I am Jessica Jeffrey, a counsellor/psychotherapist providing therapy services. I am registered with the Information Commissioner's Office (ICO) under registration number ZB700709, and I am a registered member of BACP.

If you have any questions about this policy or how I handle your data, please contact me at Jessica@jjtherapy.co.uk

2. What personal data I collect

Where you contact me to enquire about therapy before entering into a therapeutic agreement, I process your personal data under Article 6(1)(f) UK GDPR (legitimate interests), namely the legitimate interest of responding to enquiries and administering my practice.

If you decide to proceed with therapy, I collect and process the following types of personal information:

Contact and administrative information:

• Your name, date of birth, address, telephone number, and email address
• Emergency contact details (only used where I believe there is a serious concern for your safety or welfare)
• GP details (only used where I believe there is a serious concern for your safety or welfare)
• Enquiry details submitted 

Health and therapy-related information:

• Your presenting issues and reasons for seeking therapy
• Relevant medical and mental health history
• Information about current medications or treatments
• Session notes documenting our therapeutic work together
• Assessment and progress information

Important: Your health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I can only process it under specific conditions set out in law.

3. How I collect your data

I collect your personal information directly from you in the following ways:

• When you first contact me to enquire about therapy (by phone or email)
• During your initial assessment or intake session
• Throughout our ongoing therapy sessions
• Via email, telephone, or video call communications between sessions

I do not collect information about you from third parties without your knowledge, except where you have been referred through an Employee Assistance Programme (EAP), in which case I may receive limited referral information as part of that arrangement.

4. Why I process your data — lawful basis

Under UK GDPR, I need a lawful basis to process your personal information. Because therapy involves special category health data, I need to satisfy two separate legal requirements:

Article 6 basis (general personal data):

I rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services. Processing your personal data is essential for me to fulfil that contract.

Article 9 basis (special category health data):

I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified counsellor/psychotherapist bound by professional confidentiality obligations, I am permitted to process your health information for the purpose of providing your therapy.

The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes).

5. Professional obligations and supervision

I am required by BACP to attend regular clinical supervision. Supervision is an essential part of ethical therapeutic practice — it helps me reflect on my work and ensures I am providing you with the best possible care.

When I discuss my therapeutic work with my supervisor:

• Any identifying details are not shared with my supervisor
• I use anonymised or pseudonymised case material only
• My supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is bound by their own professional body's ethical framework

Supervision discussions are focused on the therapeutic process and my professional development, not on identifying individual clients.

6. Clinical will — what happens to your records if I am unable to practise

I use “Make Your Clinical Will” (Purple Pineapple Limited, 68-76 Kempston Street, Liverpool, L3 8HL) which ensures that a professional qualified counsellor will contact you in the event I’m suddenly unable to continue practising due to serious illness, incapacity, or death.  They will also offer a tailored referral, if required.

There is also provision made for the secure deletion of your records, which will be carried out by a nominated trusted professional individual. 

7. Who I share your data with

I treat your information as confidential and do not share it without good reason. However, the following parties may have access to your data in limited circumstances:

Clinical supervisor: As explained above, I discuss my therapeutic work in supervision using anonymised case material only. Your name and identifying details are not shared.

EAP or referral platform: Where you have been referred to me through an Employee Assistance Programme or similar referral arrangement, I may share limited information with the commissioning organisation as part of that arrangement. This is typically limited to confirming attendance and session count, not the content of our sessions. The specific information shared will be explained to you at the outset of therapy.

Third-party service providers: I use the following third-party services which may process your data: Google Meet for video-call sessions, IONOS as my website platform.

Google Meet

• Online therapy sessions are usually conducted via Google Meet, a video conferencing service provided by Google LLC. If you would prefer to use a different platform, please discuss this with me.
• When using Google Meet, personal data such as your name, email address, IP address, device information, and audio and visual data may be processed. Information discussed during therapy may also be transmitted through the platform.
• I use the free personal version of Google Meet. Google may process personal data in accordance with its own privacy policies and terms.
• Sessions are not recorded.
• The lawful basis for processing personal data during online therapy sessions is the provision of counselling and psychotherapy services. Any special category personal data disclosed during sessions is processed in accordance with UK GDPR requirements relating to the provision of health and counselling services.
• Google may process data outside the UK, using safeguards intended to protect personal data where international transfers occur.

I never sell your personal data.

IONOS webhosting

• My website is hosted by IONOS. When you visit the website, IONOS may automatically process technical information such as your IP address, browser type, device information, pages visited, and the date and time of your visit. This information is used to ensure the security and operation of the website and to provide basic website usage statistics.
• I do not collect personal information through website forms. If you choose to contact me using the email address provided on the website, any personal information you share will be processed in accordance with this Privacy Policy.
• IONOS may process data on my behalf as the website hosting provider and may use servers located within the UK, EEA or other locations, subject to appropriate data protection safeguards.

IONOS cookies

• This website may use essential cookies or similar technologies required for its operation and security. I do not use advertising or marketing cookies.

8. International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

• Google Meet (Google LLC, USA)

Where personal data is transferred outside the UK, I rely on the safeguards implemented by the relevant service provider, which may include International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or other lawful transfer mechanisms recognised under UK GDPR.

9. How long I keep your data

I keep your personal information only for as long as necessary. My retention periods are:

Type of record

Retention period

Reason

Therapy records (adult clients)

7 years after our last session

In line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Financial records

6 years

HMRC legal requirement

Website enquiries (non-clients)

12 months

Legitimate business purposes

After the applicable retention period:

• Session notes made on paper are transferred to your secure electronic record and are shredded within one week
• Electronic records are permanently deleted using secure deletion software

I take appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration or destruction.

10. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed You have the right to know how I use your data. This privacy policy fulfils that right.

Right of access You can request a copy of the personal information I hold about you. This is known as a Subject Access Request. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information and respond within one month.

Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I need to keep your records to comply with professional guidelines or insurance requirements, or to defend potential legal claims.

Right to restrict processing You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.

Right to data portability Where technically feasible, you can ask me to transfer your data to another provider in a commonly used electronic format.

Right to object You can object to certain types of processing. However, this is unlikely to apply to therapy records processed under the lawful bases I use.

Rights related to automated decision-making I do not use automated decision-making or profiling in my practice.

To exercise any of these rights, please contact me at Jessica@jjtherapy.co.uk 

I will respond within one month. There is no fee for most requests, though I may charge a reasonable fee if a request is manifestly unfounded or excessive.

11. Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate and respond promptly.

To make a complaint:

• Submit a complaint to: Jessica@jjtherapy.co.uk

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12. Confidentiality exceptions

Everything you share with me in therapy is treated as confidential. However, there are rare circumstances where I may need to share information without your consent:

• Risk of serious harm: If I believe there is a serious and imminent risk of harm to you or to another person
• Safeguarding concerns: If I become aware of concerns about the safety or welfare of a child or vulnerable adult
• Legal requirement: If I receive a court order requiring disclosure, or in other limited circumstances required by law

In most cases, I will try to discuss any disclosure with you first, unless doing so would itself put someone at risk.

13. Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make important changes that affect how I use your data, I will inform you directly.

The date at the top of this policy shows when it was last updated.

Contact

If you have any questions about this privacy policy or your personal data, please contact:

Jessica@jjtherapy.co.uk