I follow UK Law (GDPR and Data Protection Act 2018) and am registered with the Infomation commissioner Office (ZC016733). The information I collect is used soley by myself and is not shared with third parties or marketing. I only collect relevant information that I need to support you such as your contact details abd breif session notes. All information gathered is electronically stored in an a secure and encrypted device that only I have access too. All information is stored for the recommended timeframe of 7 years or until the company dissolves. You have the right under the freedom of information Act 2000 to request a copy of your notes, correct anything that is wrong and ask what information I am holding.

More information can be found on the below links.

https://ico.org.uk/ 

https://www.gov.uk/data-protection 

Confidentiality is the foundation of our work together.

All information shared within counselling and psychotherapy session is treated as confidential. Confidentiality will be maintained in accordance with legal obligations and the British association for counselling and psychotherapy ethical guidelines. However, there are some exceptions to confidentiality such as:

1. Legal Requirements – If I am required by law to disclose information (e.g., court order, safeguarding concerns).
2. Disclosure of serious criminal activity – Confidentiality may be breached with external services if a disclosure is made that implicates or involves criminal activity within certain legal Acts such as Human trafficking/ Modern slavery Act 2015, Terrorism Act 2006, The Children’s Act 1989, Safeguarding vulnerable person Act 2014, Money Laundering Act 2017.
3. Risk of Harm – If you disclose information indicating a serious risk of harm to yourself or others.
4. Supervision – I may discuss aspects of our work with my clinical supervisor to ensure best practice. Your identity will always remain protected, and my supervisor is bound by confidentiality.

When a breach of confidentiality is required by law or ethical duty, where possible and appropriate, you will be informed of such, and this decision will be discussed with you before the breach of confidentiality occurs. Any disclosure of information will remain within necessary limitations, made to the appropriate authorities only and in accordance with the law.

Safeguarding means protecting people from harm, abuse, neglect or exploitation. This applies to children, young people, and vulnerable adults (anyone who may be unable to protect themselves due to age, illness, disability, or personal circumstances).

I am committed to the safety and well-being of every person I work with. I take my safeguarding responsibilities seriously and follow all relevant legal guidelines, alongside the ethical framework of the British Association for Counselling and Psychotherapy (BACP), Safeguarding vulnerable group Act 2006 and the Care Act 2014.

I keep my safeguarding training up to date and follow best practice to ensure I recognise signs of harm and know how to respond appropriately.

I am committed to treating everyone with equal dignity and respect, regardless of background, identity or circumstances. I follow the Equality Act 2010 and BACP ethical guidelines to ensure an inclusive space for all. However, due to my own limitations and capabilities please note the following.

Communication: I speak English only. I have a basic knowledge of Level 1 BSL only, which is limited to simple communication.

Location: My therapy room is located on the ground floor with wheelchair accessible bathroom.

Information documents: I am able to provide large prints and audio of documents but unable to provide braile.

Age Range: I work exclusively with adults aged 18 and over. I am not trained to work with children or young people under 18.

Access & Fees: I offer concessionary rates for those on a low income, ensuring cost is never a barrier to support.

Session Options: We can work face-to-face, online, by telephone, or via walk & talk sessions. Residential visits are available only in exceptional circumstances.

I will always be clear about my limits and capabilities. If I am not the right person to support you, I will help signpost you to someone suitable.

I aim to provide a safe, respectful and high-quality service. If you are unhappy or have concerns, please let me know — I take all feedback seriously.

• Informal: Please speak to me directly or contact me by phone or email. Most matters are resolved quickly this way.
• Formal: If you wish to make a formal complaint, please put it in writing. I will acknowledge receipt within 5 working days and respond fully within 30 days.
• Independent: If you remain unhappy with my response, you may contact my professional body: British Association for Counselling and Psychotherapy (BACP) at www.bacp.co.uk

48 hours’ notice is required to cancel or reschedule. Any payment made will be credited to your next session.

Cancellations with less than 48 hours’ notice, or missed sessions, are charged in full and must be paid with or before your next booking.

Sickness exception: This policy does not apply if you advise me of illness at least 1 hour before your session starts. This flexibility applies to a maximum of 2 consecutive sessions as a reasonable adjustment.

I will give you 48 hours’ notice if I need to cancel, wherever possible.

If 3 consecutive sessions are cancelled (by either of us), we will need to discuss and review how we move forward with future appointments.

I am registered member (417796) and adhere to the British Association for Counselling and Psychotherapy (BACP) Ethical Framework, ensuring all my work is safe, professional and ethical.

Safety & Trust: I prioritise your wellbeing, creating a non-judgemental, confidential and secure space at all times.

Integrity & Respect: I value your uniqueness, treat you with dignity, and never act in a way that could cause harm or exploitation.

Competence: I work only within my training and experience, keep my skills updated, and receive regular professional supervision.

Confidentiality: What you share remains private, except where there is a risk of serious harm to yourself or others — details are set out in my Safeguarding Policy.

Transparency: I am open and clear about how I work, my limits, fees and policies, so you always know where you stand.

Your Rights: You are in control of your therapy; you can ask questions, raise concerns or end our work at any time.

I am committed to providing a safe, secure and comfortable environment for all sessions, whether held face-to-face, online, or outdoors.

Risk Assessments: Regular risk assessments are carried out for all therapy spaces — including my practice room, outdoor locations for walk & talk sessions, and residential settings (where applicable). Any identified risks are managed and minimised promptly.

Environment: My practice space is clean, well-maintained, free from hazards, and designed to ensure your privacy and safety.

Outdoor Sessions: Routes and locations are checked in advance for safety; weather and ground conditions are always considered. Please not that due to the public environment, walk and talks can minimise confidentiality of the sessions.

Your Safety: You are responsible for your own safety and environment when joining online, telephone or walk & talk sessions. Please ensure you are in a safe, private place before we begin.

Reporting: Please inform me immediately of any hazards, accidents or safety concerns you notice during our work together.

I work within the British Association of Counselling and Psychotherapy ethical guidelines; you can find the information for this on their website at https://www.bacp.co.uk/events-and-resources/ethics-and-standards/ethical-framework-for-the-counselling-professions/.

I hold a valid public liability insurance with the coverage of international work. However, all sessions provided to the client are conducted from and within the United Kingdom via a secure online platform for the availability of international work. I do not have any connection overseas whether it be law, finance or personal. Therefore, the contract between client and therapist is subject to English and Welsh law and within the exclusive jurisdiction of the Courts of the United Kingdom. Furthermore, any complaints or claims made against the therapist must be made via the correct channels within the United Kingdom.

I hold full Public Liability Insurance provided by Holistic Insurance Services (HIS118044) covering all my professional practice activities including online international clients.

This insurance provides protection and cover in the unlikely event of any claim for injury, loss or damage occurring to you or your property during our sessions or as a result of my professional work.

I maintain valid insurance cover at all times as part of my professional obligations and ethical practice standards.

I am entered onto the DBS update service (C764362009) since 2024 with an enhanced DBS certificate to work with Adults and Vulnerable Adults.

This privacy notice explains how I collect, use, store and protect personal information within my therapy practice including initial contact and continuing therapy sessions.

I, Lynne Jones, a sole trading psychotherapist who works via telephone, online and face-to-face  and outdoor in my private practice Let’s Talk Psychotherapy, is the responsible data controller for personal information I collect through my private practice processes. I am a registered data controller with ICO.gov.uk and my data collector reference number for the Information commissioner’s office is ZC016733. As a data controller I am responsible for collecting, protecting and deciding on the best way to keep your personal data safe and secure.

If you have any questions about this privacy notice, or about how your information is processed and handled you are able to read the relevant policy pages on the website Lets-talk-psychotherapy.co.uk, contact me directly via telephone 07455310708 or email letstalkwithlynne@gmail.com. You can also find further information of my responsibilities and duty of care to your data on the ICO website at www.ICO.gov.uk.

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

Information collected may be dependent on the process of interaction. This may be in the form of electronic enquiry or direct contact to myself or visiting my websites and profiles. I may collect and use the following information.

When you contact me, I may collect:

• your name
• your email address
• your phone number
• the information you choose to share in your enquiry
• any preferences around contact, availability or therapy format

If we arrange an initial call or begin therapy, I may also collect:

• Your address
• your date of birth
• your GP details
• emergency contact details, where appropriate
• relevant health, mental health or wellbeing information
• information about your personal history, relationships, work, identity, family,
• circumstances and reasons for seeking therapy
• brief clinical notes
• attendance, payment and appointment information
• correspondence between us

Some of this information may be classed as special or protected category data under UK data

protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.

I only collect information that is necessary for providing therapy safely, ethically and professionally.

I may use your personal information to:

• Respond to enquiries
• Arrange initial calls and appointments
• Provide therapy
• Keep appropriate clinical records
• Manage payments, invoices and appointments
• Communicate with you about sessions
• Meet legal, professional and ethical responsibilities
• Manage risk, safeguarding or emergency situations where necessary
• Maintain insurance, tax and accounting records
• Respond to data protection requests or complaints

I do not sell your personal information.

Lawful basis for using your information under UK GDPR.

I need a lawful basis for using personal information. For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

• Contract: where information is needed to arrange and provide therapy
• Legitimate interests: where I need to use information to run my practice safely, respond to enquiries, keep appropriate records and protect both you and me.
• Legal obligation: where I need to keep or share information to comply with the law

Where I process special category data, such as information about health or mental health.

I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018. Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

Confidentiality

Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.

There are some limits to confidentiality. I may need to share information if:

• I believe there is a serious risk of harm to you or someone else
• There is a safeguarding concern involving a child, vulnerable adult or person at risk
• Where I am required to do so by law, court order or legal process
• Disclosure is necessary to prevent or detect a serious crime
• There is a medical emergency, and information is needed to protect life
• I need to consult my clinical supervisor, while protecting your identity as far as possible

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

Supervision.

Like other ethical therapists, I use clinical supervision to support safe and effective practice. In supervision, I may discuss aspects of client work to support safe and effective practice. I aim to minimise identifying detail where possible and appropriate, and my supervisor is also bound by confidentiality and professional standards.

Clinical notes and records.

I keep brief clinical notes to support safe and ethical therapy. These are usually factual, proportionate and relevant to the work.

Clinical records may include:

• Session dates
• Brief themes discussed
• Relevant risk, safeguarding or clinical information
• Agreed actions or important decisions
• Contact and administrative information

I do not aim nor will I keep a full transcript of sessions.

How long I keep information for.

I only keep information for as long as necessary for the purpose for which it was collected.

Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person.

As a general guide:

• Enquiry information may be deleted if we do not begin therapy, usually within 2 months of contact.
• Client records may be kept for 7 years after therapy ends, based on your retention policy and the reasons for keeping them
• If the work involved a child or young person, a different retention period may apply
• Financial records may be kept for the period required for tax and accounting purposes
• Emails, messages and administrative records are reviewed periodically and deleted when no longer needed

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.

Where your information is stored - Your information may be stored in the following systems:

• Website / contact form: Webador
• Email: Google Mail, Webmail
• Practice management or client records: Zanda
• Online sessions: Zanda
• Payments / invoicing: Monzo Business
• Cloud storage or backup: Microsoft Office, integral encrypted pen drive (password protected)
• Phone / messages: WhatsApp, SMS

I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access and secure storage such as encrypted drives.

Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection, secure software and security arrangements.

Online Therapy

If we work online, sessions will take place using Zoom via Zanda. I will take reasonable steps to protect confidentiality from my side and I ask that you also choose a private space where you cannot easily be overheard or interrupted.

Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.

Outdoor (walk and talk) Therapy.

If we meet outdoors I will discuss confidentiality with you in advance. Outdoor therapy can be discreet, but it cannot guarantee the same level of privacy as a private therapy room. We will agree how to manage the possibility of seeing other people, being overheard, or needing to pause the conversation. We will discuss in advance the place to meet and the time to attend.

Face to face Therapy.

Face to face therapy is held in person where you attend a building fit for purpose. The therapy will be held in a private  and enclosed room without camers or recording devices. 

Telephone Therapy.

Telephone therapy will be held over the therapists and the clients telephone networks or whatsapp. The therapist will take necessary measurements to ensure confidentiality is upheld and conduct her telephone calls within her private working office space. I ask you to ensure you have a confidential and safe space to received the call.

AI tools, transcription and recording

I do not record, transcribe or use AI tools to process therapy sessions. I may use digital tools for general practice administration, writing, planning or education.

Where I do, I aim to avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.

Website visitors and cookies.

When you visit www.lets-talk-psychotherapy.co.uk some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools.

My website is hosted by Webador. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security.

You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.

Sharing your information.

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

• My clinical supervisor
• Professional advisers, such as an accountant, insurer or legal adviser
• My professional body, if required in relation to a complaint or ethical matter
• Safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern
• A court or legal authority, if required by law
• An appointed clinical executor if I die or become unable to contact clients myself
• Trusted digital service providers who process data on my behalf.

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it, and an appropriate transfer mechanism or other safeguard is in place where required.

Clinical will

I aim to have arrangements in place so that clients can be contacted if I die or become seriously incapacitated.

This may involve a trusted professional colleague or clinical executor having access to the minimum information needed to contact current clients and manage records appropriately. That person would be bound by confidentiality, would only access information if necessary, and would not take on an ongoing therapeutic role unless separately agreed and appropriate.

Your rights.

Under UK data protection law, you have rights over your personal information. These may include the right to:

• Be informed about how your data is used.
• Access a copy of your personal information.
• Ask for inaccurate information to be corrected.
• Ask for information to be deleted in some circumstances.
• Restrict or object to certain processing.
• Complain about how your information has been handled.

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint- related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies. If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

Data protection concerns and complaints.

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to investigate it without undue delay.

Please include:

• Your name.
• What your concern is about.
• What you would like me to investigate.
• How you would prefer me to respond.

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you about the outcome without undue delay.

If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Information Commissioner’s Office

Website: www.ico.org.uk

Telephone: 0303 123 1113

Last updated: 18/06/26