How we handle your information

These documents explain how Find Focus Therapy collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.

ICO-registered

UK GDPR compliant

DUAA 2025 compliant

Updated 12 June 2026

Privacy policyCookie policyData retentionGDPR statementMake a complaint

Privacy Policy

Last updated: 12 June 2026

1. Who we are

This privacy policy explains how  Find Focus Therapy collects, uses, and protects your personal information.

I am Juliet Smart a counsellor/psychotherapist providing therapy services through Find Focus Therapy I am registered with the Information Commissioner's Office (ICO) under registration number  ZB589762

and I am a registered member of BACP.

If you have any questions about this policy or how I handle your data, please contact me at findfocustherapy@gmail.com

2. What personal data we collect

I collect and process the following types of personal information:

Contact and administrative information:

• Your name, address, telephone number, and email address
• Emergency contact details
• GP details (where relevant)
• Enquiry details submitted via our website contact form

Health and therapy-related information:

• Your presenting issues and reasons for seeking therapy
• Relevant medical and mental health history
• Information about current medications or treatments
• Session notes documenting our therapeutic work together
• Assessment and progress information

Important: Your health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I can only process it under specific conditions set out in law.

3. How we collect your data

I collect your personal information directly from you in the following ways:

• When you first contact me to enquire about therapy (by phone, email, or through the website contact form)
• During your initial assessment or intake session
• Throughout our ongoing therapy sessions
• Via email, telephone, or video call communications between sessions
• Through any forms or questionnaires you complete as part of your therapy

I do not collect information about you from third parties without your knowledge, except where you have been referred through an Employee Assistance Programme (EAP), in which case I may receive limited referral information as part of that arrangement.

4. Why we process your data — lawful basis

Under UK GDPR, I need a lawful basis to process your personal information. Because therapy involves special category health data, I need to satisfy two separate legal requirements:

Article 6 basis (general personal data):

I rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services. Processing your personal data is essential for me to fulfil that contract.

Article 9 basis (special category health data):

I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified counsellor/psychotherapist bound by professional confidentiality obligations, I am permitted to process your health information for the purpose of providing your therapy.

The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes).

5. Professional obligations and supervision

I am required by BACP to attend regular clinical supervision. Supervision is an essential part of ethical therapeutic practice — it helps me reflect on my work and ensures I am providing you with the best possible care.

When I discuss my therapeutic work with my supervisor:

• Your name and any identifying details are not shared with my supervisor
• I use anonymised or pseudonymised case material only
• My supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is bound by their own professional body's ethical framework

Supervision discussions are focused on the therapeutic process and my professional development, not on identifying individual clients.

6. Clinical will — what happens to your records if I am unable to practise

I am currently putting arrangements in place for a clinical will — a plan for the secure handling of your records in the event that I am suddenly unable to continue practising due to serious illness, incapacity, or death.

Once these arrangements are finalised, I will update this policy and inform clients of the details. The clinical will ensure that a nominated colleague (also bound by professional confidentiality) can securely manage or destroy records and, where appropriate, contact clients to offer support or referral.

7. Who we share your data with

I treat your information as confidential and do not share it without good reason. However, the following parties may have access to your data in limited circumstances:

Clinical supervisor: As explained above, I discuss my therapeutic work in supervision using anonymised case material only. Your name and identifying details are not shared.

EAP or referral platform: Where you have been referred to me through an Employee Assistance Programme or similar referral arrangement, I may share limited information with the commissioning organisation as part of that arrangement. This is typically limited to confirming attendance and session count, not the content of our sessions. The specific information shared will be explained to you at the outset of therapy.

Third-party service providers: I use the following third-party services which may process your data:

• WordPress — this website runs on WordPress, which may process certain technical data
• WebHealer — this website is built on WebHealer, which may collect certain technical data about visitors including basic analytics
• Microsoft Teams — used for video therapy sessions where agreed

Each of these services is bound by a data processing agreement. Links to their privacy policies are available on request.

I never sell your personal data.

8. International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

• WordPress (Automattic Inc, USA)
• Microsoft Teams (Microsoft Corporation, USA)
• WebHealer (WebHealer Ltd, UK — no international transfer)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision, which is why these additional safeguards are necessary.

You can request a copy of the relevant transfer safeguards by contacting me at findfocustherapy@gmail.com

9. How long we keep your data

I keep your personal information only for as long as necessary. My retention periods are:

TYPE OF RECORD	RETENTION PERIOD	REASON
Therapy records (adult clients)	7 years after our last session	In line with the Limitation Act 1980 and standard professional indemnity insurance requirements
Therapy records (clients under 18 at time of therapy)	Until the client reaches the age of 25	Extended retention to allow time for any claims after reaching adulthood
Financial records	6 years	HMRC legal requirement
Website enquiries (non-clients)	12 months	Legitimate business purposes

After the applicable retention period:

• Paper records are securely shredded
• Electronic records are permanently deleted using secure deletion software

10. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed You have the right to know how I use your data. This privacy policy fulfils that right.

Right of access You can request a copy of the personal information I hold about you. This is known as a Subject Access Request. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information and respond within one month.

Right to rectification If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to erasure In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I need to keep your records to comply with professional guidelines or insurance requirements, or to defend potential legal claims.

Right to restrict processing You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.

Right to data portability Where technically feasible, you can ask me to transfer your data to another provider in a commonly used electronic format.

Right to object You can object to certain types of processing. However, this is unlikely to apply to therapy records processed under the lawful bases I use.

Rights related to automated decision-making I do not use automated decision-making or profiling in my practice.

To exercise any of these rights, please contact me at hello [at] therapywithjanine.co.uk. I will respond within one month. There is no fee for most requests, though I may charge a reasonable fee if a request is manifestly unfounded or excessive.

11. Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate and respond promptly.

To make a complaint:

• Contact me at at findfocustherapy@gmail.com

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12. Confidentiality exceptions

Everything you share with me in therapy is treated as confidential. However, there are rare circumstances where I may need to share information without your consent:

• Risk of serious harm: If I believe there is a serious and imminent risk of harm to you or to another person
• Safeguarding concerns: If I become aware of concerns about the safety or welfare of a child or vulnerable adult
• Legal requirement: If I receive a court order requiring disclosure, or in other limited circumstances required by law

In most cases, I will try to discuss any disclosure with you first, unless doing so would itself put someone at risk.

13. Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make important changes that affect how I use your data, I will inform you directly.

The date at the top of this policy shows when it was last updated.

Contact

If you have any questions about this privacy policy or your personal data, please contact:

Juliet Smart at findfocustherapy@gmail.com generated: 12 June 2026