Your privacy is very important to me and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended, including:

• Why I am able to process your information and what purpose I am processing it for
• Whether you have to provide it to me
• How long I store it for
• Whether there are other recipients of your personal information
• Whether I intend to transfer it to another country
• Whether I do automated decision-making or profiling
• Your data protection rights

I am happy to answer any questions you might have about my data protection policy and you can contact me by email at unfoldingwithjess@gmail.com.

‘Data controller’ is the term used to describe the person or organisation that collects, stores, and has responsibility for people’s personal data. In this instance, the data controller is me.
I am Jessica Gregory trading as Unfolding with Jess. Registration reference: C2044466 

My Contact Details:
• Email: unfoldingwithjess@gmail.com
• Phone: [insert your phone number]
• Location / Postal Address: Birmingham, West Midlands (full postal address available upon request)

My Lawful Basis for Holding and Using Your Personal Information
The UK GDPR states that I must have a lawful basis for processing your personal data. The lawful bases I rely on depend on the stage at which I am processing your data:
 

• Initial Enquiries / Prospective Clients: If you contact me to consider therapy, I process your personal data where it is necessary to take steps at your request prior to entering into a contract.
   
• Active Clients: If you are currently receiving counselling, I process your personal data because it is necessary for the performance of our therapeutic contract.
   
• Former Clients: Once therapy has ended, I rely on legitimate interests as my lawful basis for storing your personal information for a specified retention period (e.g., to comply with professional insurance requirements and defend potential legal claims).
   
• Website Visitors: I rely on legitimate interests to collect standard internet log details via website analytics tools to ensure the functionality, performance, and security of my website.
   

Special Category Personal Data
The UK GDPR classifies health information, including details shared during counselling, as special category personal data. The lawful basis enabling me to process special category data is Article 9(2)(h) of the UK GDPR: the provision of health or social care or treatment, provided under a duty of confidentiality.

How I Use Your Information

Initial Contact
When you contact me with an enquiry about counselling, I collect information to answer your enquiry. This typically includes your name, email address, phone number, and any information you provide in the contact form on my website or via direct email. Alternatively, another healthcare professional or a trusted individual may provide your details on your behalf.
If you decide not to proceed with therapy, I ensure all your personal data is deleted within three calendar months. If you wish for it to be deleted sooner, please let me know.

While You Are Accessing Counselling
Everything you discuss with me is strictly confidential. Confidentiality may only be broken in exceptional circumstances—such as where there is a risk of serious harm to yourself or others, or where required by law (e.g., terrorism, money laundering, or court orders). I will always endeavour to discuss any potential breach of confidentiality with you first, unless safeguarding issues or legal restrictions prevent me from doing so.

To manage my practice securely and smoothly:
 

• Session Notes & Clinical Records: Written session notes and administrative records are stored electronically on encrypted, password-protected systems.
   
• Online Appointments: Online video sessions are conducted securely via encrypted teleconferencing platforms.
   
• Communications: Text messages are deleted after six weeks, with any relevant clinical details transcribed into your main record. Important email correspondence is retained as part of your client record or safely deleted after six months if no longer required.
   

After Counselling Has Ended

Once counselling has ended, your clinical records will be securely retained for six years from our final contact to comply with professional indemnity insurance requirements and legal guidance. After six years, all records are permanently and securely erased.

Third-Party Data Processors (Categories of Recipients)
To run my private practice efficiently and securely, I work with carefully selected third-party service providers who process data on my behalf. Any service provider I engage acts as a Data Processor under strict obligations of confidentiality and data security.
The categories of data processors I use include:
 

• Website Hosting & Contact Form Providers: To host my practice website and process initial online web enquiries safely.
   
• Email & Telecommunications Providers: To manage secure digital messaging, email correspondence, and video consultations.
   
• Practice Management & Note-Taking Software: To store electronic clinical notes, client contact information, and appointment scheduling in encrypted environments.
   
• Banking & Financial Institutions: To process bank transfers and fee payments (financial records do not contain clinical notes).
   
• Professional Insurance & Bodies: Data may be shared on rare, necessary occasions with my professional indemnity insurer or professional regulatory bodies strictly for compliance, legal, or safeguarding obligations.
   

Website Visitors, Cookies, and Analytics
 

• Analytics: My site uses standard analytics tools to collect anonymous information regarding visitor behavior and traffic volume. This data is processed in a way that does not identify individuals.
   
• Cookies: Cookies are small text files placed on your device to ensure web functionality and improve user experience. You can adjust your browser settings to refuse or delete cookies at any time.
   

Your Data Protection Rights
Under UK data protection law, you have specific rights regarding your personal data:
 

• Right of Access: You have the right to request a copy of the personal information I hold about you (a Subject Access Request).
   
• Right to Rectification: You can ask me to correct any inaccurate or incomplete information.
   
• Right to Erasure ('Right to be Forgotten'): You can request that I erase your personal data, subject to legal or professional retention mandates (such as insurance requirements for clinical notes).
   
• Right to Restrict or Object: You have the right to object to or restrict certain types of processing.
   

To exercise any of these rights, please submit your request in writing to unfoldingwithjess@gmail.com.