Privacy Notice & Data Protection Policy
Your privacy is very important to me, and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me.
I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This privacy notice tells you what I will do with your personal information from the initial point of contact through to after your therapy has ended, including:
- Your data protection rights
- Why I am able to process your information and what purpose I am processing it for
- Whether you have to provide it to me
- How long I store it for
- Whether there are other recipients of your personal information
- Whether I intend to transfer it to another country
- Whether I do automated decision-making or profiling
Privacy Policy: Your Data Protection Rights
I aim to be as open as possible in terms of giving people access to their personal information. You have a right to ask me to delete your personal information, to limit how I use your personal information, or to stop processing your personal information. You also have a right to ask for a copy of any information I hold about you and object to using your personal data in some circumstances. You can read more about your rights at ico.org.uk/your-data-matters. If I do hold information about you, I will:
- give you a description of it and where it came from;
- tell you why I am holding it, tell you how long I will store your data and how I made this decision;
- tell you to whom it could be disclosed;
- let you have a copy of the information in an intelligible form.
You have the right to request access to the personal information I hold about you. I will normally respond to such requests within one month, as required by UK GDPR.
Feel free to ask me to correct any mistakes in the personal information I hold about you. If you need any personal information I may hold about you, please put the request in writing by emailing: jrosecounselling@outlook.com
Complaints
If you have any concerns about how your personal information is collected, stored, used, or shared, please contact me in the first instance so that I can understand and address your concerns. I will acknowledge receipt of your complaint within 30 days and investigate the matter without undue delay.
If you have a complaint about the counselling service itself, please refer to the Complaints Procedure outlined in your Counselling Agreement.
If your complaint relates to the processing of your personal data and you remain dissatisfied with my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights and data protection law. Further information can be found at www.ico.org.uk/make-a-complaint.
‘Data controller’ is the term used to describe the person/ organisation that collects, stores, and is responsible for people’s personal data. In this instance, the data controller is me, Jennifer Rose Francies-Meagher. My Information Commissioner’s Office Registration number will be included in our Counselling Agreement.
My Basis for Holding and Using Your Personal Information
UK GDPR requires me to identify both a lawful basis for processing personal data and, where relevant, an additional condition for processing special category data.
As a counsellor, I process special category personal data relating to health, mental health, emotional wellbeing and other sensitive information that may arise during the counselling process.
My lawful basis for processing your personal information is:
- Contract – where processing is necessary to provide counselling services and fulfil our counselling agreement.
- Legitimate Interests – where it is necessary for the safe and effective operation of my practice, provided your rights and freedoms are not overridden.
- Legal Obligation – where I am required by law to retain or disclose information.
The condition relied upon for processing special category data is generally:
- Article 9(2)(h) UK GDPR – provision of health or social care or treatment, together with the relevant provisions of the Data Protection Act 2018.
How Your Information is Processed
Initial Contact
When you enquire about my counselling services, I will collect limited personal information to respond to your enquiry. This usually includes your name and contact details (email address and/or telephone number). Your details may also be provided by your GP or another health professional making a referral, or by a trusted individual enquiring on your behalf. If I do not hear back from you, I may send one follow-up message approximately 7 days after your initial enquiry. I will not contact you again after this unless you respond. If you decide not to proceed, or if no therapeutic relationship is established, I will retain your basic enquiry details for up to 12 months for legitimate practice purposes, such as monitoring enquiry patterns and demand over time. After this period, your personal data will be securely deleted. You may request deletion of your information at any time.
Contracting
I use Google Forms, a service provided by Google, to collect basic contact information for our Counselling Agreement. When you submit information through these forms, the data you provide is processed and stored by Google on secure servers. This may include personal information such as your name, contact details, and any information you choose to share in the form. Google processes data in accordance with its own privacy and security policies. Google states that it implements industry-standard security measures to protect data and does not use information submitted through Google Forms for advertising purposes. Your information is only accessed by me for the purposes of responding to your enquiry, arranging appointments, and providing therapeutic services. If you prefer not to submit information through Google Forms, you may contact me directly to arrange alternative ways of providing your details.
While You Are Accessing Counselling
Rest assured that everything you discuss with me is confidential. However, I hold a duty to disclose to the relevant bodies if I feel you may be at serious risk or you share information relating to anything that may be deemed illegal, such as abuse of a vulnerable person, abuse or neglect of a child, any act of terrorism, drug trafficking or people trafficking. This also includes any involvement in driving offences. As your counsellor, I reserve the right to limit our confidentiality where I am obligated to do so. Where possible and appropriate, I will always aim to discuss this with you before taking any action. If a third party requests information relating to our work together, I will seek your consent before sharing anything, unless safeguarding or legal obligations prevent this. I keep a record of your personal details and brief factual session notes to support the safe, ethical and effective running of my practice. These records are stored securely using password-protected and encrypted systems and are only accessed where necessary for the provision of counselling services. I do not use automated decision-making or profiling when processing your personal information.
After Counselling Has Ended
Once counselling has ended, your records will normally be retained for seven years from the date of our final session. In some circumstances, records may need to be retained for longer where required by law, insurance requirements, safeguarding considerations, or professional and regulatory obligations. At the end of the retention period, records will be securely destroyed. You may request deletion of your information at any time. Such requests will be considered in line with my legal, ethical, insurance and professional obligations.
Third-Party Recipients of Personal Data
To operate my practice safely and effectively, I use a number of trusted third-party service providers. These may include: Microsoft Outlook for email communications, Google Forms for counselling agreements and administrative forms, Setmore for appointment booking and scheduling, Wix for website hosting and website analytics, and secure cloud-based storage providers used for record keeping and practice administration.
International Transfers & AI
Some of the service providers I use may process or store information outside the United Kingdom. Where personal data is transferred internationally, appropriate safeguards are in place in accordance with UK GDPR. I do not use client-identifiable information with generative artificial intelligence (AI) systems. Should AI-assisted tools ever be introduced for administrative purposes, they will only be used in accordance with UK GDPR and professional ethical standards.
Data Security & Website Usage
I take the security of the data I hold about you very seriously, and as such, I take every effort to ensure it is kept secure. I use encrypted and password-protected devices and software. When someone visits my website, I use a third-party service, Wix, to collect standard internet log information and details of visitor behaviour patterns. No user-specific data is collected.
Booking System & Social Media
To make booking as easy as possible, I use Setmore. Clients' data is used for essential notifications. I also use professional social media accounts to share information about counselling and wellbeing. Please keep in mind that social media platforms aren’t private or secure. For your confidentiality, I’ll suggest we move our conversation to email. I am always happy to discuss any questions you might have about this policy.