Introduction

Your privacy is important to me. I take care to protect the personal information you share with me and to use it only for appropriate purposes connected with my counselling and psychotherapy practice.

This privacy policy explains how I collect, use, store and protect your personal information, from your initial enquiry through to after therapy has ended. It also explains your rights under UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

I am the data controller responsible for the personal information I collect and hold.

Jess Yau – Integrative Counselling and Psychotherapy

ICO registration number: ZC170747

Postal address: Spitalfields Therapy, Norvin House, 45-55 Commercial Street, London E1 6BD

Telephone: 07775 340741

Email: jess@jessyau.com

If you have any questions about how I handle your personal information, please contact me using the details above.

My lawful basis for using your information

Under UK GDPR, I must have a lawful basis for collecting and processing your personal information.

When you contact me about starting therapy, or are receiving therapy from me, I process information where necessary to take steps towards entering into a contract or to fulfil our therapeutic agreement.

After therapy has ended, I retain relevant records under the lawful basis of legitimate interests, including maintaining appropriate professional records and responding to any concerns or legal claims that may arise.

I may also process information where necessary to comply with a legal obligation.

Some information shared during therapy, particularly information relating to your physical or mental health, is classed as special category personal data. I process this information for the provision of counselling and psychotherapy, under the relevant health or social care condition in UK data protection legislation and subject to professional confidentiality obligations.

How I collect and use your information

Initial enquiries

When you contact me about counselling or psychotherapy, I may collect your name, email address, telephone number and any information you choose to share about your reasons for seeking therapy.

This information may be provided through my website contact form, directory contact forms, by email, telephone or by someone making an enquiry on your behalf.

I use this information to respond to your enquiry, discuss my services and arrange an introductory call or appointment where appropriate.

You do not need to provide detailed personal or clinical information when making an initial enquiry.

If you decide not to proceed with therapy, I will delete your enquiry and associated personal information within four weeks. You can request earlier deletion by contacting me.

During therapy

If we begin working together, I will collect and retain information necessary to provide counselling and psychotherapy. This may include your contact details, relevant personal and health information, intake form, therapeutic agreement, session notes and relevant correspondence.

What you share during therapy is treated as confidential.

There are, however, circumstances in which confidentiality may need to be broken. These include situations where I have serious concerns about a significant risk of harm to you or another person, where disclosure is required by a court order or other legal obligation, or where disclosure is required by law, including in relation to certain criminal offences.

Any disclosure would be considered in accordance with my legal and professional responsibilities. Wherever appropriate and possible, I would discuss this with you beforehand, unless doing so would create a safeguarding concern or otherwise be inappropriate.

As part of maintaining professional standards, I discuss aspects of my clinical work in professional supervision. Client identities are protected wherever possible, and supervision is conducted within professional confidentiality requirements.

How I store your information

Client records are stored securely in physical and electronic formats, including Google Workspace (Google Drive). Appropriate measures are taken to protect personal information, including restricted access, password protection and pseudonymisation where appropriate.

Relevant emails and messages may be retained as part of your client records where necessary. Ordinary correspondence and messages that do not need to be retained are deleted within four weeks.

For online therapy sessions, I use Google Meet.

After therapy has ended

I retain client records for seven years after the end of our therapeutic contact, in line with my professional record-keeping arrangements. After this period, records are securely deleted or destroyed unless there is a legal or other justified reason to retain them for longer.

Certain administrative or financial records may be retained for different periods where required by law.

Third-party service providers

I use a small number of third-party services to support the administration and operation of my practice.

These include:

IONOS: website hosting, contact-form services and website analytics.

Google Workspace: professional email, electronic document storage and Google Meet for online sessions.

These providers may process or store personal information as part of delivering their services. I take appropriate steps to protect personal information and use service providers with relevant data protection arrangements.

Some providers may process or store information outside the United Kingdom. Where international transfers take place, they must be covered by appropriate safeguards under applicable data protection law.

I do not sell your personal information or share it with third parties for marketing purposes.

Your data protection rights

Under UK data protection legislation, you have rights concerning your personal information. Depending on the circumstances, these include the right to:

Request access to the personal information I hold about you.

Ask for inaccurate information to be corrected.

Request deletion of your personal information.

Ask me to restrict how your information is processed.

Object to certain uses of your information.

Request the transfer of certain information to another provider.

Some rights are subject to legal conditions and exceptions. For example, I may need to retain certain records to meet professional or legal obligations even if you request their deletion.

If you would like to exercise any of these rights, please contact me at jess@jessyau.com.

You can find further information about your rights at https://ico.org.uk/your-data-matters/.

If you have concerns about how I handle your information, I would welcome the opportunity to address them directly.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator, at https://ico.org.uk/make-a-complaint/.

Data security

I take the security and confidentiality of personal information seriously.

I use password-protected devices and accounts, electronic storage services and locked physical storage to help protect client information from unauthorised access, loss or disclosure.

I take reasonable steps to ensure that personal information is accessed and used only where necessary for the operation of my practice and the provision of therapy.

Visitors to my website

My website is hosted by IONOS and uses IONOS SiteAnalytics to collect statistical information about website visits, such as the number of visitors and which pages are viewed. This helps me understand how my website is used.

According to IONOS, SiteAnalytics uses log files or tracking pixels rather than cookies. IP addresses are anonymised after transmission, and the resulting analytics information does not identify individual visitors.

If you contact me using the enquiry form on my website, the information you provide is processed through IONOS and forwarded to me so that I can respond to your enquiry. Please avoid including detailed sensitive or clinical information in your initial enquiry.

You can read more about IONOS's data protection arrangements at https://www.ionos.co.uk/terms-gtc/privacy-policy/.

Changes to this privacy policy

I may update this policy from time to time to reflect changes in my practice, the services I use or applicable data protection requirements. The latest version will be available on my website.