Last updated: 3^rd November 2026

Who I am

I am Juliette Coffey, a psychotherapist in private practice trading as w2wcounselling. I am registered with the Information Commission (ICO) under registration number ZA390485.

If you have any questions about how I handle your personal data, please contact me at w2wcounselling@gmail.com

What personal data I collect

I collect and process the following categories of personal data:

Contact information

• Your name, address, telephone number, and email address

Health and therapy-related information

• The reason you are seeking therapy (your presenting issues)
• Information about your mental and emotional wellbeing
• Relevant medical history you choose to share
• Session notes recording the content of our therapeutic work together
• Risk assessments where appropriate

Health and therapy-related information is classified as special category data under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection due to its sensitive nature.

Administrative information

• Appointment dates and times
• Payment and invoice records
• Emergency contact details

Website enquiries

• I collect your name and email address when you submit the contact form

How we collect your data

I collect your personal data directly from you:

• When you first contact me to enquire about therapy
• During our initial assessment session
• Throughout our therapeutic work together, during sessions
• Through email, telephone, or video communication between sessions
• When you complete intake forms or questionnaires
• When you submit an enquiry through my website contact form

I do not collect personal data about you from third parties without your knowledge, unless there is a safeguarding concern that requires me to do so.

Why I process your data — lawful basis

Under the UK GDPR, I must have a lawful basis for processing your personal data. I rely on the following:

Article 6 basis (ordinary personal data)

Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us.

When you engage me as your therapist, we enter into a contract for the provision of therapy services. Processing your personal data is necessary to fulfil that contract, including scheduling appointments, maintaining appropriate records, and providing you with therapeutic care.

Article 9 basis (special category data)

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional.

The additional condition required under UK law is met through DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care). Processing is carried out by a qualified psychotherapist subject to the professional obligation of confidentiality under the BACP Ethical Framework for the Counselling Professions.

Professional obligations and CPD

I am required by BACP to attend regular clinical supervision as part of maintaining safe and ethical practice. I may discuss our therapeutic work with my supervisor. When I do so:

• Your name and any identifying details are not shared with my supervisor
• I use anonymised or pseudonymised case material only
• My clinical supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is bound by their own professional code of ethics and practice

Supervision supports the quality of the therapy I provide and is a core requirement of ethical practice.

Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor who will act on my behalf if I become seriously ill, incapacitated, or die. My Clinical Executor is a qualified therapist bound by the same professional confidentiality obligations as I am.

If I am unable to continue practising, my Clinical Executor will:

• Contact you to let you know that our therapeutic relationship has ended
• Offer to provide you with referral information to help you find another therapist if you wish
• Retain your records securely until the end of the applicable retention period
• Securely destroy your records only after the retention period has ended

Your records will be handled with the same level of confidentiality and care that I would provide.

Who I share your data with

I take your confidentiality seriously and limit access to your personal data as far as possible.

Parties who may have access to your data:

• Clinical supervisor — I share anonymised case material only with my supervisor. Your name and identifying details are not disclosed.
• External accountant or bookkeeper — Invoice data only (your name and amounts paid) may be shared for accounting purposes. They do not have access to your therapy records or session notes.

Third-party services:

I use the following third-party services which may process your data:

• GoDaddy — This website runs on GoDaddy. Any installed plugins may process personal data.
• Bluehost — This website is built on Bluehost, Bluehost may collect certain technical data about visitors including basic analytics.
• Zoom — I offer online therapy sessions via Zoom.

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

I never sell your personal data.

International data transfers

The following third-party services I use may transfer personal data outside the United Kingdom:

• GoDaddy (USA)
• Bluehost (USA)
• Zoom (Zoom Video Communications Inc, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision.

You can request a copy of the relevant transfer safeguards by contacting me.

How long we keep your data

I retain your personal data for the following periods:

TYPE OF RECORD	RETENTION PERIOD	REASON
Therapy records	3 years after our last session	Reflecting the period within which a client may raise a complaint, and my professional judgement as a practitioner
Financial records (invoices, payment records)	6 years	HMRC legal requirement
Website enquiries (non-clients)	12 months	Legitimate interest in responding to enquiries

After the applicable retention period has ended, records are securely destroyed. Electronic records are permanently deleted.

Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed 

You have the right to know how I collect and use your personal data. This privacy policy fulfils that right.

Right of access 

You can request a copy of the personal data I hold about you. This is known as a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.

Right to rectification 

If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure 

You can ask me to delete your personal data. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance obligations, or law.

Right to restrict processing 

You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.

Right to data portability 

You can ask me to provide your data in a structured, commonly used format so you can transfer it to another service. This applies to data you have provided to me and which I process based on your consent or our contract.

Right to object 

You can object to processing based on legitimate interests. I do not process your therapy data on this basis, but you may object to any marketing communications.

Rights related to automated decision-making 

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. I do not use automated decision-making in my practice.

To exercise any of these rights, please contact me at w2wcounselling@gmail.com

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. If you are unhappy with how I have handled your personal data, please let me know so I can try to resolve your concerns.

You can submit a complaint via: w2wcounsellimg@gmail.com

If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commission (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are specific circumstances where I may need to break confidentiality:

• Risk of serious harm — If I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep you or others safe.
• Safeguarding concerns — If I become aware of a child or vulnerable adult who may be at risk of abuse or neglect, I have a duty to report this to the relevant safeguarding authorities.
• Court order — If a court orders me to disclose information, I am legally required to comply.

I will always try to discuss any disclosure with you first, unless doing so would itself put someone at risk.

Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how I handle your personal data, I will inform you directly.