Privacy policy

Janet Sneddon Talking Therapies                Privacy Policy                 Last updated: 1^st November 2026

This privacy policy explains how I collect, use, store and protect personal information in my therapy practice.

I am Janet Sneddon, a counsellor and clinical supervisor working online and I am the data controller for personal information I collect through Janet Sneddon Talking Therapies. This means I am responsible for deciding how personal information is used and for keeping it safe.

If you have any questions about this privacy notice, or about how information is handled, you can contact me at:

Email: counselling@janetsneddon.co.uk  

Phone: 07749 265964

Website: www.janetsneddon.co.uk

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

Information I collect

I may collect and use the following information.

When you contact me directly I may collect:

• your name
• your email address
• your phone number
• the information you choose to share in your enquiry
• any preferences around contact, availability or therapy format

If I receive a referral for you (e.g., via an employer, EAP provider, Insurance company, other organisation]

• I may receive personal information from that organisation to help arrange or provide therapy

• the information received will depend on the referral arrangement and may include your contact details, relevant referral information, eligibility for sessions or information needed to arrange payment.

• Where applicable, I will explain what information may be shared between me and the referring organisation, for what purpose, and whether I will provide any feedback or reports. I will handle this information in accordance with my confidentiality obligations and applicable data protection law.

If we arrange an initial call or begin therapy, I may also collect:

• your address
• your date of birth
• your GP details
• emergency contact details, where appropriate
• relevant health, mental health or wellbeing information
• information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy
• brief clinical notes
• attendance, payment and appointment information
• correspondence between us

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy. I only collect information that is necessary for providing therapy safely, ethically and professionally.

It is important that the data I hold about you is accurate and current. Please keep me informed if your data changes during the period for which I hold it

How I use your information

I use your personal information to:

• respond to enquiries
• arrange initial calls and appointments
• provide therapy
• keep appropriate clinical records
• manage payments, invoices and appointments
• communicate with you about sessions
• meet legal, professional and ethical responsibilities
• manage risk, safeguarding or emergency situations where necessary
• maintain insurance, tax and accounting records
• respond to data protection requests or complaints

I do not sell your personal information.

Lawful basis for using your information

Under UK GDPR, I need a lawful basis for using personal information.

For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

• contract: where information is needed to arrange and provide therapy
• legitimate interests: where I need to use information to run my practice safely, respond to enquiries, keep appropriate records and protect both you and me
• legal obligation: where I need to keep or share information to comply with the law

Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.

Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

Confidentiality

Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.

There are some limits to confidentiality and I may need to share information, for example, if:

• I believe there is a serious risk of harm to you or someone else
• there is a safeguarding concern involving a child, vulnerable adult or person at risk
• I am required to do so by law, court order or legal process
• disclosure is necessary to prevent or detect a serious crime
• there is a medical emergency and information is needed to protect life
• I need to consult my clinical supervisor, while protecting your identity as far as possible

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

Clinical Supervision

Like other ethical therapists, I undertake clinical supervision as part of my professional and ethical responsibilities. Supervision helps me reflect on my work and maintain safe and effective practice.

I may discuss aspects of our work with my clinical supervisor where appropriate. I aim to minimise identifying information and share only what is necessary for supervision. My supervisor is also expected to maintain confidentiality and comply with applicable professional and ethical standards.

Clinical notes and records

I keep brief clinical notes to support safe and ethical therapy. These are usually factual, proportionate and relevant to the work.

Clinical records may include:

• session dates
• brief themes discussed
• relevant risk, safeguarding or clinical information
• agreed actions or important decisions
• contact and administrative information

I do not generally keep a full transcript of sessions.

How long I keep information

I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of legal requirements, professional responsibilities, insurance requirements and the circumstances of the work. My retention arrangements include the following:

• Enquiries: If therapy does not begin, I generally delete enquiry information within one month, unless there is a reason to retain it for longer

• Clinical records: I retain clinical records in accordance with my documented retention schedule and the applicable requirements of my professional indemnity insurance and professional body. Unless a longer retention period is required or permitted by law, my insurance requires me to hold all client records for at least five years from the date of treatment and, in the case of a minor, for a period at least five years after the minor reaches majority

• Financial records: I retain financial information for the period required by HMRC
• Emails, messages and administrative records: I review these periodically and delete them when they are no longer needed, subject to any applicable retention requirements.

In some circumstances, I may need to retain information for longer, for example in connection with a complaint, legal claim, safeguarding concern or insurance requirement.

If my practice has to be closed as a result of my death, serious accident or critical illness all data will be deleted unless otherwise agreed with an individual

I review my retention arrangements periodically to ensure that the periods remain appropriate and proportionate.

Where your information is stored

Depending on how we communicate and work together, your personal information may be held in the following systems:

• Website and contact forms: IONOS
• Email: Gmail and Outlook
• Mobile phone: Samsung device
• Online therapy sessions: Microsoft Teams
• Payments and invoicing: Monzo
• Telephone calls and messages: SMS or WhatsApp
• Paper records: Stored in a locked filing cabinet with access restricted to authorised persons.

These services may process some personal information as part of providing their services. The information processed will depend on the service and how I use it. I take reasonable technical and organisational measures to protect the information I hold. These may include device security, strong passwords, two-factor authentication, access restrictions and secure storage. Where a service provider processes personal information on my behalf, I take appropriate steps to assess its data protection and security arrangements. Where applicable, I will ensure that any transfer of personal information outside the UK complies with the relevant data protection requirements.

Online therapy

If we work online, sessions will take place using Microsoft Teams.  I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted. Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.

AI tools, transcription and recording

I do not record, transcribe or use AI tools to process therapy sessions. I may use digital tools for general practice administration, writing, planning or education. Where I do, I aim to avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.

Website visitors and cookies

When you visit my website some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools. My website is hosted by IONOS. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour or support security. You can usually control cookies through your browser settings.

Sharing your information

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

• my clinical supervisor
• professional advisers, such as an accountant, insurer or legal adviser
• my professional body, if required in relation to a complaint or ethical matter
• safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern
• a court or legal authority, if required by law

• an appointed clinical executor if I die or become unable to contact clients myself. I have a clinical will in place with a trusted professional colleague who has access to the minimum information needed to contact current clients and manage records appropriately. This person is also bound by confidentiality rules and would only access information if necessary.
• trusted digital service providers who process data on my behalf

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

Your rights

Under UK data protection law, you have rights over your personal information. These may include the right to:

• be informed about how your data is used
• access a copy of your personal information
• ask for inaccurate information to be corrected
• ask for information to be deleted in some circumstances
• restrict or object to certain processing
• complain about how your information has been handled

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies. If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

Data protection concerns and complaints

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.

Please include:

• your name
• what your concern is about
• what you would like me to look into
• how you would prefer me to respond

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you about the outcome without undue delay. If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use. The latest version will be available on my website.