Privacy and Data Handling

Jo Shaw, trading as JJS Therapy

Last updated: 6 November 2026

1. About this notice

This notice explains what personal information I collect, why, how I keep it safe, how long I keep it, when I might share it, and your rights, including how to complain. It applies to clients, people who contact me about therapy, and visitors to my website.

I am a psychotherapist in private practice, working in London, Tunbridge Wells and online. As a sole trader, I am the ‘data controller’ for your information, which means I am responsible for how it is used and protected. I am registered with the Information Commissioner's Office (ICO), registration number ZB629984. I am an Accredited member of the British Association for Counselling and Psychotherapy (BACP) and follow its ethical requirements.

Contact: jo@jjstherapy.com
07551 152067

2. Information I collect

If you contact me about therapy, by email, by phone or through the contact form on my website, I collect:

  • Your name, contact details and anything you include in your message.

If you become a client, I collect:

  • Your name, contact details and date of birth.
  • Details of an emergency contact and, where you agree, your GP or other relevant healthcare professional.
  • Information that you share about your mental and physical health, history and circumstances.
  • Brief session notes.
  • Payment records on my own password-protected accounting software.

Information about your health is ‘special category data’ under UK data protection law and receives extra protection. I collect information directly from you, and I will tell you if I ever receive information about you from someone else, such as a referrer.

If you visit my website, see Section 8.

3. Why I use your information, and the legal basis

I use your information to arrange and provide therapy, keep appropriate records, take payment, contact you about appointments, and meet my legal and professional obligations. I do not use your information for marketing, and I never sell it.

  • Contact and payment details: necessary to provide the service you have asked for (UK GDPR Article 6(1)(b)).
  • Health information and session notes: necessary for providing health care (UK GDPR Article 9(2)(h), with Data Protection Act 2018, Schedule 1, Part 1, paragraph 2). I owe you a duty of confidentiality in respect of this information.
  • Records kept after therapy ends are kept to meet professional requirements and in case of complaints or legal claims (UK GDPR Articles 6(1)(f), 9(2)(f) and 9(2)(h)).
  • Financial records are kept for six years because the law requires it (UK GDPR Article 6(1)(c)).
  • Website technical information and visitor statistics: my legitimate interest in running a secure website that works well (UK GDPR Article 6(1)(f)). See also Section 8.

4. How I keep your information safe

I strive to keep your data completely safe.

  • Session notes identify you only by your first name or initial. They are kept in password-protected folders on an encrypted drive, backed up locally in encrypted form. Session notes are never stored in the Cloud.
  • Documents containing your contact or medical details are double password protected on the same encrypted drive.
  • A copy of your contact details only is also held on Proton Drive, a Swiss-based, cloud storage service with end-to-end, zero-access encryption. Zero-access encryption means that Proton cannot read them under any circumstances. I keep this copy so my clinical executor can access it and reach you if I die or am suddenly unable to work (see section 5).
  • Email: I use Proton Mail, which operates under Swiss privacy law. Emails are stored with zero-access encryption, and emails between Proton users are end-to-end encrypted. If you use a different email provider, messages are encrypted in transit, but your copy is held by your own provider which may be less secure. Please bear this in mind when deciding what to write by email.
    • Proton AG is based in Switzerland, which UK law recognises as having adequate data protection standards, and processes data under a data processing agreement that meets UK GDPR requirements.
  • My devices are password protected, kept up to date, and not shared with anyone.
  • Online sessions: I use a paid Zoom Pro account for online sessions, which are encrypted using Zoom's standard encryption. Sessions use my personal meeting link with a passcode and a waiting room, and I only ever admit the client I am expecting. I never record sessions, in the Cloud or on my computer, and I do not use Zoom's AI features or any AI note-taking, transcription or summary tools, whether built into Zoom or added on.
    • Zoom Video Communications, Inc. is based in the United States. It processes limited information, such as meeting times and connection data, under a data processing agreement, and transfers to the US are covered by the UK–US data bridge.
    • Your part in keeping sessions private: please join from somewhere you won't be overheard, on a device and Wi-Fi network you trust. Please don't record sessions, or use AI note-taking or transcription tools, without discussing it with me first. If it ever feels unsafe to continue, for example if someone comes into the room, if necessary we can pre-agree a signal to pause or end the call if you would like to.

5. Confidentiality

I take confidentiality extremely seriously, as both data protection law and BACP's ethical requirements require. Our work is entirely private, except in the specific circumstances below. Other than clinical supervision (2), these are extremely rare.

  1. Keeping you safe. If you say or do anything that gives me genuine concern that you are at risk of hurting yourself or someone else, I may contact someone who can help keep you and/or the other person safe. This may be the emergency contact you have given me, or an appropriate professional. If I can, I will discuss this with you first, though this may not always be possible.
  2. Clinical supervision. All ethical therapists work with a qualified clinical supervisor, usually another experienced and specially trained therapist, with whom they talk over some of the issues their clients bring. This helps me get another point of view on how best to support you. Supervisors are bound by the same duty of confidentiality as I am, and I will only ever refer to you by your first name or an initial.
  3. My professional body. I may need to share information about our work with BACP, for example on an ethical question. In almost all circumstances this would not identify you. If you raise a complaint against me, it may include your name and contact details.
  4. Where the law requires it. I must disclose information if ordered to by a court, or where another legal duty applies, such as information about terrorism. Where the law allows, I will tell you first.
  5. If I become incapacitated or die. My clinical executor will have access to your contact details so that you can be told what has happened.

My clinical will

Professional ethics require me to plan for the unexpected, so that clients are not left without contact or support. I have a clinical will and have appointed a clinical executor, a qualified therapist, and a personal executor.

If I become seriously ill, incapacitated or die, my clinical executor will have secure access to your name and contact details only, so that you can be told what has happened and be offered appropriate support if necessary. They will not have access to your session notes. This is based on my legitimate interest, and yours, in making sure you are contacted and supported (Article 6(1)(f)), and on providing continuity of care (Article 9(2)(h)).

My clinical executor will ensure my session notes are kept securely for the rest of the retention period and then destroyed without being read. Or if you would like your notes passed to a new therapist, my clinical executor can arrange this with your written consent.

6. How long I keep information

  • Session notes and client records: 7 years after our work ends, then securely deleted.
  • Enquiries from people who don't become clients, including messages sent through my website's contact form: 6 months, then deleted.
  • Financial records: 6 years, as HMRC requires.

7. Your rights

You have the right to:

  • Access the information I hold about you.
  • Ask me to correct inaccurate information.
  • Ask me to delete your information, although I may need to keep some records to meet professional or legal obligations.
  • Ask me to restrict or object to how I use your information.
  • Receive your information in a portable format, where applicable.

To make a request, contact me at jo@jjstherapy.com. There is usually no charge, and I will respond within one month.

8. My website

Hosting: My website is hosted on Cloudflare Workers, a service of Cloudflare, Inc., a US company. When you visit, Cloudflare's servers automatically process technical information such as your IP address, browser type and the pages you request, in order to deliver the website to you and protect it from attacks and misuse. I do not use this information to identify you. It may be processed in the United States. Cloudflare processes it under a data processing agreement, and transfers to the US are covered by the UK–US data bridge, with standard contractual clauses approved under UK law as a backup. Cloudflare's own privacy policy is here.

Cookies: My website does not use cookies, which is why you are not asked to accept or decline them when you visit.

Visitor statistics: I use Cloudflare Web Analytics to see high-level statistics about my website, such as the number of visits, which pages are viewed and which websites visitors came from. It is designed to preserve your privacy: it does not use cookies or store anything on your device, and it does not ‘fingerprint’ visitors using their IP address, browser details or any other information. I only see overall totals, which cannot identify you or any other visitor. This information is processed by Cloudflare on the same terms as the hosting described above.

Contact form: The contact form on my website is provided by Formspark, a service of Trampoline Software SRL, a company based in Belgium. When you send a message through the form, Formspark receives what you enter (such as your name, email address and message), along with technical information including your IP address, an approximate location based on that address, and your browser type. It stores your message in Ireland and Germany, which UK law recognises as having adequate data protection standards, and passes it on to me. Formspark processes this information under a data processing agreement. I delete enquiries as set out in section 6, and Formspark deletes IP address and location information after 12 months. You don't need to include details about your health or circumstances in your first message; a short note is enough, and we can talk about the rest when we speak. Formspark's own privacy policy is here and the relevant section is titled ‘Data we handle for our customers’.

9. Complaints about how I use your data

Under the UK's Data (Use and Access) Act 2025, I have a formal process for complaints about how I have handled your personal information. You can raise a complaint in whatever way suits you: in a session, by email, by phone or in writing.

  1. I will acknowledge your complaint formally, in writing, within 30 days.
  2. If we are working together, I will offer to discuss it with you, in a session or separately if you prefer, to understand what happened and, if necessary, how things can be put right. If we are no longer working together, I will offer an online or phone conversation. You are welcome to handle the whole complaint in writing if you'd rather.
  3. I will look into your complaint promptly and keep you updated.
  4. I will tell you about the outcome in writing, including any action I will take. If we agree on further action to resolve the matter, I will carry it out.
  5. If you are unhappy with my response, you can take your concerns to BACP; this page gives more details.

You can also complain to the Information Commissioner's Office at any time, whether or not you have complained to me first. This page explains how or call 0303 123 1113.

10. Changes to this notice

I review this notice regularly. If I change how I use your information, I will update it and let current clients know before the change takes effect.