Privacy Notice

Practice Principles & Data Transparency

Last updated: 14 September 2026

This notice explains what personal information I collect, why I use it, how it is protected and your rights under UK data-protection law.

Who I am

I am Jen Patrick, trading as Jen Patrick Counselling. I am the data controller for the information held within my private practice.

Email: contact@jen-patrick.com
Website: www.jen-patrick.com
ICO registration number: ZA762626

What information I collect

Depending on your contact with me, I may collect:

Your name, address, email address and telephone number
Emergency-contact and GP details, where appropriate
Information you provide when making an enquiry
Client-registration information and our counselling agreement
Information you choose to share during counselling
Brief clinical notes and relevant risk or safeguarding information
Appointment, attendance and cancellation records
Invoice, payment and refund information
Email and text correspondence
Technical information generated when you use my website, including cookie preferences

Counselling information may include information about your physical or mental health and other sensitive aspects of your life. Data-protection law refers to this as special-category data.

Most information is provided directly by you. I may also receive relevant information from Harley Therapy, someone you have authorised to contact me or, in exceptional circumstances, a health professional, emergency contact or safeguarding service.

Please keep initial website enquiries brief and avoid including detailed clinical information or sensitive information about another person.

Why I collect it

I use personal information to:

Respond to enquiries
Arrange and provide counselling
Manage appointments, cancellations and payments
Maintain appropriate clinical records
Participate in clinical supervision
Protect people where there are serious safety or safeguarding concerns
Respond to complaints or legal matters
Meet applicable financial and legal requirements

My lawful bases under the UK GDPR include:

Contract, where information is needed to arrange and provide counselling
Legitimate interests, where information is needed to operate a safe and accountable private practice
Legal obligation, where particular information must be retained or disclosed by law
Vital interests, in limited emergencies where information is needed to protect someone’s life
Consent, for optional uses such as AI-assisted note-taking

For special-category information required to provide counselling, I rely on Article 9(2)(h) of the UK GDPR, Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 and my duty of confidentiality.

Who I share it with

Information shared during counselling is treated as confidential. I do not routinely share session content with family members, employers or other people in your life.

I discuss my clinical work regularly in professional supervision. I limit the information shared and remove identifying details wherever practicable. My supervisor is also bound by confidentiality requirements.

There are circumstances in which I may need to share limited information, including:

A serious risk of harm
Safeguarding concerns involving a child or adult at risk
A binding court order or other specific legal requirement
A complaint, insurance matter or legal claim

Wherever it is safe and practicable, I will discuss a disclosure with you first. I will share only information that is relevant and necessary.

Services used within my practice

I use:

Wix for my website, contact forms and online bookings
Stripe to process website payments and refunds
Zanda for client records, appointments, counselling agreements, invoices and routine practice communications
Google Gmail for work email and correspondence
Zoom for online counselling sessions
Harley Therapy for referrals and administration relating to clients who access my services through that platform

These services receive only the information needed to perform their functions. Some process information on my instructions, while others have separate responsibilities for the way they handle information. Their own privacy notices provide further details.

Some providers or their subprocessors may process information outside the UK. Where this involves a restricted international transfer, the provider is required to use an appropriate legal safeguard, such as UK adequacy regulations or approved contractual clauses. You may contact me for further information about these arrangements.

AI-assisted clinical notes

I keep brief clinical notes as part of my professional responsibilities.

With your separate agreement, I may use BizzyAI, an AI-assisted feature within Zanda, to convert my own post-session dictation into a draft clinical note. The counselling session itself is not recorded.

Zanda states that the dictated audio is streamed rather than stored, that its AI processing services do not retain the information after processing and that client information is not used to train AI models. The resulting draft is stored within the client record in Zanda.

I review and edit every draft and remain responsible for the final clinical record. AI is not used to provide counselling, assess risk, make clinical decisions or replace my professional judgement.

You may decline AI-assisted note-taking or withdraw your agreement at any time without this affecting your access to therapy. If you decline, I will prepare your notes manually.

How I store and protect your information

I take reasonable steps to protect personal information against unauthorised access, loss, misuse or disclosure. This includes password-protected accounts, two-factor authentication where available, device security and restricting access to client information.

No internet-based service can guarantee absolute security.

How long I keep it

I use the following retention periods:

Enquiries that do not lead to counselling are retained for up to six months after our last substantive contact.
Waiting-list details are retained while you wish to remain on the list and reviewed periodically. If counselling does not begin, they are deleted within six months of our last substantive contact.
Adult counselling records, agreements and clinically significant correspondence are retained for seven years after counselling ends.
Routine appointment emails, text messages and duplicate website notifications are deleted within 90 days of the matter being resolved, after anything important has been added to the main client record.
Financial and tax records are retained for at least five years after the relevant 31 January tax-return deadline.
Information may be retained for longer where this is necessary because of an unresolved complaint, safeguarding matter, legal claim or other specific legal requirement.

When information is no longer required, it is securely deleted or destroyed.

Website cookies

My website uses essential cookies to provide functions requested by visitors. It may also use optional cookies for functions such as website analytics.

Where consent is required, optional cookies will not be activated unless you choose to allow them. You can review or change your choices through the cookie settings on the website.

Your rights

Depending on the information and the lawful basis being used, you may have the right to:

Request access to your personal information
Ask for inaccurate information to be corrected
Ask for information to be erased in certain circumstances
Ask for processing to be restricted
Object to processing based on legitimate interests
Request the transfer of eligible information
Withdraw consent where processing is based on consent

These rights are not absolute. If I cannot fulfil a request in full, I will explain why.

To make a request, contact me at contact@jen-patrick.com. I may ask for information to confirm your identity and will normally respond within one month.

I do not use your information to make solely automated decisions that have legal or similarly significant effects on you.

How to complain

If you have concerns about how your information has been collected, used, stored or shared, please contact me at contact@jen-patrick.com.

You may also complain to the Information Commissioner’s Office without contacting me first:

Website: www.ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

Changes to this notice

I will review this notice when my working practices, service providers or relevant requirements change. The current version will always be available on my website.