Privacy Policy

Introduction

Your privacy is very important to me. You can be confident that your personal information will be kept safe and secure, and will only be used for the purpose it was provided. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This Privacy Notice explains how I will process your personal information from the initial point of contact through to after your therapy has ended, including:

• Why I am able to process your information, and the purposes for which it will be processed
• Whether you are required to provide your information
• How long I store your information
• Whether other recipients will have access to your personal information
• Whether I intend to transfer your information to another country
• Whether I engage in automated decision-making or profiling
• Your data protection rights

I am happy to discuss any questions you may have about my data protection policy. You can contact me via email, text message, or Whatsapp.

The term ‘Data Controller’ refers to the person or organisation responsible for collecting, storing, and managing personal data. In this instance, I am the Data Controller. I am registered with the Information Commissioner’s Office, registration number ZB888958.

You can get in touch with me via the contact page on my website: https://www.jenlubytherapy.co.uk/Home/Contact

My lawful basis for holding and processing your information

The GDPR requires that I have a lawful basis for processing your personal data. There are different lawful bases depending on the stage at which I am processing your data. Below, I have outlined the relevant lawful bases:

If you have completed therapy with me and it has now ended: I will use legitimate interest as my lawful basis for holding and using your personal information.

If you are currently receiving therapy or considering therapy: I will process your personal data where it is necessary for the performance of our contract.

The GDPR also ensures that any sensitive personal information you disclose to me is handled appropriately. This type of information is referred to as ‘special category personal information’. The lawful basis for processing any special category information is that it is necessary for the provision of health treatment (in this case, counselling) and is required for the contract with a health professional (in this case, a contract between me and you).

How I Use Your Information

Initial contact: When you contact me with an enquiry about my counselling services, I will collect information necessary to respond to your enquiry. This may include your name, contact details, and a brief description of the support you are seeking. If you decide not to proceed with therapy, I will delete your personal data within one month of our last contact. If you would prefer your information to be deleted sooner, please let me know and I will action this promptly.

While you are accessing counselling: Rest assured that everything you discuss with me is confidential. That confidentiality will only be broken if I believe there is a serious risk of harm to you or others, if I am required to do so by law, or if you disclose information about certain criminal activities (such as terrorism or money laundering). I will always try to speak to you about this first, unless there are safeguarding concerns that prevent this. I will keep a record of your personal details to help the counselling service run smoothly. These details are kept securely on a password-protected device and are not shared with any third party. I will keep written notes of each session; these are kept securely in a locked cabinet and will use a code instead of your name. For security reasons, I do not retain text messages for more than one month, or email correspondence for more than three months. If there is relevant information contained in a text message or email, I will transfer it to your digital client record and then delete the original message.

After counselling has ended: Once counselling has ended, your records will be kept for five years from the date of our final contact, and will then be securely destroyed. If you would like me to delete your information sooner than this, please let me know.

Third party recipients of personal data

I share personal data with third-party service providers as necessary to deliver my counselling services. This includes platforms such as Microsoft Teams for video sessions, as well as secure email and cloud storage providers. I have carefully selected these services and ensure that appropriate data processing agreements are in place. These third parties are not permitted to use your information for any purpose other than the specific task for which they have been contracted.

Your Rights

I strive to be as transparent as possible in providing access to your personal information. You have the right to request that I delete your personal data, limit how I use it, or stop processing it altogether. You also have the right to request a copy of any information I hold about you and to object to the use of your personal data in certain circumstances. For more details on your rights, you can visit ico.org.uk /your-data-matters.

If I hold information about you, I will:

• Provide a description of the data and explain where it came from;
• Inform you of the reasons I am holding it, how long I will store it, and how I made that decision;
• Advise you of who may receive the information;
• Provide a copy of the information in a clear and understandable format.

You can also request at any time that I correct any inaccuracies in the personal information I hold about you.

To make a request for your personal data, please get in touch with me via the contact page on my website: https://www.jenlubytherapy.co.uk/Home/Contact

If you have any concerns or complaints regarding how I handle your personal data, please feel free to contact me directly by emailing the contact details provided above. I welcome any suggestions for improving my data protection practices.

If you wish to make a formal complaint about how I have processed your personal information, you can contact the Information Commissioner’s Office (ICO), the statutory body overseeing data protection law in the UK. For more information, visit ico.org.uk/make-a-complaint.

Data security

I take the security of the data I hold about you very seriously and make every effort to ensure it is kept secure. To protect your personal information, I use a combination of physical, electronic, and procedural safeguards. For example:

• I store all digital information on encrypted devices with secure passwords.
• Paper records are kept in a locked filing cabinet.
• I use secure, GDPR-compliant platforms for communication and data storage (e.g., encrypted email services).
• I regularly update and maintain security software to protect against unauthorized access.

These measures help to ensure that your personal information is protected from unauthorized access, disclosure, alteration, or destruction.