Privacy policy

​

Sarah Kent-Jones Counselling is committed to protecting your personal data and maintaining your privacy. This policy outlines how your data is collected, handled, and securely stored in compliance with the Data Protection Act 2018, UK GDPR, the Data (Use and Access) Act 2025 (including the mandatory statutory complaints updates), and the National Counselling and Psychotherapy Society (NCPS) Ethical Guidelines.

1. Data Controller & Registration Information

Sarah Kent-Jones operates the website https://www.skj-counselling.co.uk/ and serves as the Data Controller.

• Contact Email: sarah@skj-counselling.co.uk

• Contact Phone: 07473 534713

• ICO Registration: Sarah Kent-Jones is fully registered as a data controller with the Information Commissioner’s Office (ICO) under registration number ZB696796

2. What Personal Data is Collected

The following information may be collected through website forms, phone inquiries, or ongoing therapy sessions:

• Contact Details: First name, last name, phone number, and email address.

• Therapy Records: Session notes, clinical history, emergency contacts, and signed contracts.

• Special Category Data: Health information and mental health history shared during sessions, which requires enhanced protection under data laws.

3. Purpose and Legal Basis for Processing Data

Your information is processed under the following lawful bases:

• Consent: Voluntarily provided via website contact forms for initial consultations.

• Contract: Necessary to deliver face-to-face, telephone, or online counselling services.

• Legitimate Interests: Necessary for administrative tasks, invoicing, and keeping network infrastructure secure.

• Special Category Provision: Clinical data processing follows strict health and social care exceptions under UK data law.

4. Confidentiality and Limits to Disclosure

In accordance with the NCPS Code of Ethics, strictly confidential records are maintained. Your personal data will never be shared for marketing purposes. Information is only shared under specific conditions:

1. Clinical Supervision: Case material is shared with a professional supervisor, always fully anonymised to protect your identity.

2. Safeguarding & Public Protection: Overriding legal obligations apply if you present a serious risk of harm to yourself, the therapist, or others.

3. Legal Requirements: Disclosures may be required in compliance with a court order or specific statutory obligations.

5. How Data is Stored and Retained

• Digital Records: Any online notes or correspondence are safeguarded on encrypted, password-protected platforms.

• Physical Records: Paper files are stored securely in a locked cabinet within a secure property.

• Retention Period: Clinical records are safely kept for a minimum period mandated by professional insurance and NCPS guidelines before being permanently and securely destroyed.

6. Your Data Protection Rights

Under UK data privacy laws, you possess the following rights:

• Right of Access: You can request copies of the personal data held about you.

• Right to Rectification: You can ask to correct inaccurate information.

• Right to Erasure: You can request data destruction, subject to certain legal or clinical retention limitations.

• Right to Restrict Processing: You can request that processing of your personal data be limited under specific circumstances.

7. Statutory Data Complaints Procedure

In compliance with the Data (Use and Access) Act, you have a statutory right to complain directly to the Data Controller regarding how your data is handled.

• How to Complain: Submit data protection complaints directly via email to sarahjcounselling@gmail.com.

• Timeline: Your complaint will be acknowledged within 30 days of receipt (with the statutory clock starting the day after receipt).

• Investigation: An investigation will be conducted without undue delay, keeping you informed of its progress. The outcome and resolution steps will be communicated to you in an accessible format as soon as it concludes.

• Escalation: Under the law, you must attempt to resolve complaints internally through this process first. If you remain unsatisfied with the outcome, you can escalate the matter to the Information Commissioner's Office (ICO).