Privacy Policy

Privacy Policy Notice:

Introduction

This privacy notice tells you what to expect me to do with your personal information from the initial point of contact through to after your therapy has ended. Your privacy is very important to me, and you can be confident that your personal information will be kept safe and secure and will only be used for the purposes for which it was provided. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

This notice explains:

• Why I am able to process your information and what purpose I am processing it for

• Whether you have to provide it to me

• How long I store it for

• Whether there are other recipients of your personal information

• How I protect your data when it is shared or accessed internationally

• That I do not use automated decision-making or profiling for my services

• Your data protection rights 

'Data controller' is the term used to describe the person who collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me. I am registered with the Information Commissioner’s Office (ICO). My ICO registration number is: ZC192113. I am happy to discuss any questions you might have about my data protection policy; please see the Contact details section below to get in touch.

·       Contact details

·       What information I collect, use, and why

·       Lawful bases and data protection rights

·       Where I get personal information from

·       How long I keep information

·       Who I share information with

·       Sharing information outside the UK

·       How to complain

Contact details

If you have any questions or concerns about this privacy notice, or if you would like to exercise any of your data protection rights, please contact me at:

Email: jaye@talktojaye.co.uk

What information I collect, use, and why

How I use your information:

Initial contact

When you contact me with an enquiry about my counselling services, I will collect information to help me satisfy your enquiry. This includes your name and contact details. Alternatively, your GP or another health professional may send me your details when making a referral, or a trusted individual may provide your details when making an enquiry on your behalf. If you decide not to proceed, I will ensure all your personal data is deleted within one month. If you would like me to delete this information sooner, please let me know. 

While you are accessing counselling

Rest assured that everything you discuss with me is confidential. That confidentiality will only be broken if there are safeguarding concerns or legal obligations that require me to share information. I will always try to speak to you about this first, unless there are safeguarding issues that prevent me from doing so.

In order to provide you with safe, professional health and care treatment, I collect or use the following information:

·       Contact details: Full name, home address, email address, and telephone number.

·       Emergency contact: Name and phone number.

·       Clinical information: GP surgery (address and phone number), training provider/modality, medications, and health conditions that may impact therapy sessions.

·       Administrative records: Records of meetings, decisions, and financial/payment information.

I also collect or use the following information to provide patient care and services:

·       Name, address and contact details

·       Emergency contact details

·       Health information (including medical conditions, allergies, medical requirements and medical history)

·       Payment details (including card or bank information for transfers and direct debits)

·       Records of meetings and decisions

·       Information about income and financial needs for funding or personal budget support

I also collect the following special category information to provide patient care and services. This information is subject to additional protection due to its sensitive nature:

·       Racial or ethnic origin

·       Religious or philosophical beliefs

·       Health information

·       Sex life information

·       Sexual orientation information

I collect or use the following personal information for the prevention, detection, investigation or prosecution of crimes:

·       Name, address and contact details

·       Witness statements and contact details

·       Relevant information from previous investigations

·       Financial information eg for fraud prevention or detection

I collect or use the following information for safeguarding or public protection reasons:

·       Name, address and contact details

·       Emergency contact details

·       Health information (including medical conditions, allergies, medical requirements and medical history)

·       Records of meetings and decisions

I also collect the following special category information for safeguarding or public protection reasons. This information is subject to additional protection due to its sensitive nature:

·       Racial or ethnic origin

·       Religious or philosophical beliefs

·       Health information

·       Sex life information

·       Sexual orientation information

I collect or use the following personal information to comply with legal requirements:

·       Name

·       Contact information

·       Financial information

·       Safeguarding information

I collect or use the following personal information for dealing with queries, complaints or claims:

·       Names and contact details

·       Payment details

·       Customer or client accounts and records

·       Financial transaction information

·       Information relating to health and safety (including incident investigation details and reports and accident book records)

·       Correspondence

I also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

·       Racial or ethnic origin

·       Religious or philosophical beliefs

·       Health information

·       Sex life information

·       Sexual orientation information

How I handle your sensitive information:

Because I am a therapist, I need to collect some information that is considered 'special' under data protection law, such as your health information or details about your sexual orientation. I handle this information with the highest level of care, under a specific legal framework (Article 9(2)(h) of the UK GDPR) that allows me to provide you with safe, professional health and care treatment.

Lawful bases and data protection rights

If I do hold information about you I will:

·   give you a description of it and where it came from;

·   tell you why I am holding it, tell you how long I will store your data and how I made this decision;

·   tell you who it could be disclosed to;

·   let you have a copy of the information in an intelligible form.

You can also ask me at any time to correct any mistakes there may be in the personal information I hold about you.

To make a request for any personal information I may hold about you, please put the request in writing addressing it to jaye@talktojaye.co.uk.

If you have any complaint about how I handle your personal data please do not hesitate to get in touch with me by writing or emailing to the contact details given above. I would welcome any suggestions for improving my data protection procedures.

If you want to make a formal complaint about the way I have processed your personal information you can contact the ICO which is the statutory body that oversees data protection law in the UK. For more information go to https://ico.org.uk/make-a-complaint.

I try to be as open as I can be in terms of giving people access to their personal information. Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis I rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the https://ico.org.uk/your-data-matters/ (ICO’s website).

·       Your right of access - You have the right to ask me for copies of your personal information. You can request other information such as details about where I get personal information from and who I share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

·       Your right to rectification - You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

·       Your right to erasure - You have the right to ask me to delete your personal information. Read more about the right to erasure.

·       Your right to restriction of processing - You have the right to ask me to limit how I can use your personal information. Read more about the right to restriction of processing.

·       Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.

·       Your right to data portability - You have the right to ask that I transfer the personal information you gave me to another organisation, or to you. Read more about the right to data portability.

·       Your right to withdraw consent – When I use consent as my lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, I must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

My lawful bases for the collection and use of your data

My lawful bases for collecting or using personal information to provide patient care and services, are:

·       Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

·       Legitimate interests – I am collecting or using your information because it benefits you, the organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

·       I rely on legitimate interests to process personal data for the following administrative and operational purposes: Business Operations and Audit: To manage my professional records, process payments, and conduct internal audits to ensure my service remains reliable and compliant. Service Improvement: To review and improve the quality of my service delivery, ensuring I meet professional standards. Professional Communication: To manage correspondence regarding appointments, administrative queries, and service updates. Balancing Test: I have carefully balanced these interests against your rights and freedoms. I only process the minimum amount of data necessary for these purposes, and I do not use your information in ways that would be unexpected, intrusive, or harmful. My primary objective remains the provision of high-quality, safe therapeutic care, and I do not permit my business interests to override your fundamental right to privacy.

For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

·       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

My lawful bases for collecting or using personal information for the prevention, detection, investigation or prosecution of crimes are:

·       Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

·       Legitimate interests – I am collecting or using your information because it benefits you, the organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

·       I rely on legitimate interests to process personal data for the following administrative and operational purposes: Business Operations and Audit: To manage my professional records, process payments, and conduct internal audits to ensure my service remains reliable and compliant. Service Improvement: To review and improve the quality of my service delivery, ensuring I meet professional standards. Professional Communication: To manage correspondence regarding appointments, administrative queries, and service updates. Balancing Test: I have carefully balanced these interests against your rights and freedoms. I only process the minimum amount of data necessary for these purposes, and I do not use your information in ways that would be unexpected, intrusive, or harmful. My primary objective remains the provision of high-quality, safe therapeutic care, and I do not permit my business interests to override your fundamental right to privacy

For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

·       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

My lawful bases for collecting or using personal information for safeguarding or public protection reasons are:

·       Legal obligation – I must collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

·       Legitimate interests – I am collecting or using your information because it benefits you, the organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

·       I rely on legitimate interests to process personal data for the purpose of safeguarding my clients and protecting the public. Purpose: The purpose of processing this data is to uphold my professional duty of care, respond to safeguarding concerns, and comply with my ethical obligations to protect vulnerable individuals from neglect, harm, or abuse. Necessity: This processing is necessary because I must be able to identify risks and take appropriate action—including, where necessary, sharing information with relevant agencies such as social services or emergency services—to ensure the safety and well-being of the individual. Balancing Test: I have carefully balanced these interests against your rights and freedoms. I recognise that your right to privacy is paramount; therefore, I only share information when it is strictly necessary, proportionate, and required to protect someone from serious harm. My duty to ensure public safety and protect vulnerable individuals is a compelling interest that outweighs the individual’s right to confidentiality in these specific, emergency-driven scenarios.

For more information on the use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

·       Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

My lawful bases for collecting or using personal information to comply with legal requirements are:

·       Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

My lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

·       Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

·       Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

·       Legitimate interests – I am collecting or using your information because it benefits you, the organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

·       I rely on legitimate interests to process personal data for the purpose of managing and resolving queries, complaints, or potential claims. Purpose: The purpose of processing this data is to enable me to investigate concerns, respond to queries, and defend my professional conduct if a complaint or claim is made. This ensures transparency and fairness in the resolution of disputes. Necessity: This processing is necessary to maintain accurate records of communications and clinical work, which may be required to resolve a query or to provide evidence in the event of a professional complaint or insurance claim. Balancing Test: I have carefully balanced these interests against your rights and freedoms. I recognise that your right to privacy is paramount; therefore, I only access and use the information necessary to address the specific query or complaint. My interest in ensuring accountability, resolving disputes, and upholding professional standards is a compelling interest that does not unfairly override your fundamental right to privacy.

For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

Where I get personal information from

·       Directly from you

·       Regulatory authorities

·       Family members or carers

·       Other health and care providers

·       Schools, colleges, universities or other education organisations

·       Insurance companies

·       Relevant regulatory authorities

·       Suppliers and service providers

·       Professional colleagues or supervisors: I may receive information from my clinical supervisor or professional peers to ensure I am providing the safest and most effective care for my clients. I engage in regular clinical supervision to ensure my practice is safe and ethical. You may be discussed during supervision, but your identity will remain anonymous.

How long I keep information

I will keep a record of your personal details to help the counselling services run smoothly. To ensure your information remains secure, I store clinical notes and administrative records using secure, encrypted, password-protected practice management platforms (such as Kiku for private clients and relevant secure systems for organisational referrals). These systems are chosen for their high standards of security, including encryption and two-factor authentication. For security reasons, I do not use text messaging for professional communication. Likewise, any email correspondence will be deleted after three months if it is not important; if necessary, I will save important correspondence within your secure digital clinical record. Once counselling has ended, your records will be kept for 7 years from the end of our contact with each other in line with professional insurance and BACP requirements, after which they are then securely destroyed. If you want me to delete your information sooner than this, please tell me.

Who I share information with

I sometimes share personal data with third parties, where I have contracted with a supplier to carry out specific tasks. In such cases, I have carefully selected which partners I work with and ensure they do not use your information in any way other than the task for which they have been contracted.

Data processors

Name/Category: Google Workspace (Cloud Computing and Email Services) Sector\/Sub-sector: IT and Cloud Services Location: USA (with data stored globally)

This data processor does the following activities for me: For Google Workspace (IT and Cloud Services): I use this service for my professional email communications, secure file storage, practice administration, and for receiving and processing enquiries submitted via the contact form on my website.

I use external, secure platforms to assist with the administration of my practice and the secure storage of clinical records. These platforms act as data processors under my instruction and are selected for their high standards of security, such as encryption and two-factor authentication.

·       For private clients: I may use secure practice management software (such as Kiku) to store contact details, agreements, and clinical notes.

·       For clients referred via organisations: I may use the secure platforms provided or required by those organisations to process and store relevant clinical data and practice records.

In all instances, I ensure that appropriate data processing agreements are in place to protect your confidentiality, and these platforms are only used for the specific tasks for which they have been contracted.

Others I share personal information with

·       Other health providers (eg GPs and consultants)

·       Organisations I need to share information with for safeguarding reasons

·       Emergency services

·       Professional advisors

·       Organisations I am legally obliged to share personal information with

Duty of confidentiality

Confidentiality is the basis of our therapeutic relationship, but there are limits, such as safeguarding concerns or legal obligations, where I may be required to share information. I am subject to a common law duty of confidentiality. However, there are circumstances where I will share relevant health and care information. These are where:

·       you’ve provided me with your consent (I have taken it as implied to provide you with care, or you have given it explicitly for other uses);

·       I have a legal requirement (including court orders) to collect, share or use the data;

·       on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);

·       If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or

·       If in Scotland – I have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.

Sharing information outside the UK

Where necessary, I will transfer personal information outside of the UK. When doing so, I comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

Organisation name: Google Workspace

Category of recipient: Category of recipient: Cloud Service Provider \/ IT Infrastructure Provider. Sector: IT and Cloud Services. Purpose: To provide secure email communication, file storage, and data processing for practice administration.

Country the personal information is sent to: United States of America

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Where necessary, the data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

Organisation name: Google Workspace

Category of recipient: Cloud Service Provider

Country the personal information is sent to: United States of America

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Visitors to my website

When someone visits my website, I do not currently use third-party services to collect standard internet log information or details of visitor behaviour patterns. I do not make any attempt to find out the identities of those visiting my website.

Should I decide to use website analytics in the future to help improve my service, I will update this policy to specify which tools I am using and how they collect data. Any such tool will be chosen for its privacy-friendly approach, and I will ensure that my use of cookies and data collection remains transparent and compliant with UK data protection law.

I use Google Sites as the content management system for my website. My website is hosted by Krystal Hosting.

My website uses only "strictly necessary" cookies. These are essential for the website to function correctly, such as ensuring secure page navigation. Under the Privacy and Electronic Communications Regulations (PECR), I do not require your consent to use these cookies. I do not use any non-essential cookies, such as those for marketing or visitor analytics, and therefore do not display a cookie consent banner. You can manage or delete cookies at any time through your own web browser settings.

No user-specific data is collected by me or any third party through my website. If you use a contact form on my website, that data is processed directly by Google Forms and is stored within my secure professional Google Workspace account.

How to complain

I aim to provide the highest standard of care, but if you have any concerns about how I handle your personal data, please contact me directly at jaye@talktojaye.co.uk so I can try to put things right. I operate a formal data protection complaints process; I will acknowledge receipt of your complaint within 7 working days of receiving it, and I will investigate and respond to your concerns without undue delay, keeping you informed of progress throughout the process. If you remain dissatisfied, you have the right to lodge a complaint with the ICO (Registration Number: ZC192113).  The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint