Privacy notice

Your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended. The contents list below shows what it covers.

I'm happy to chat through any questions you might have about my data protection policy. You can contact me — Jamie Longson — by email at jplcounselling@protonmail.com.

My lawful basis for holding and using your personal information

The UK GDPR states that I must have a lawful basis for processing your personal data. I have explained this below:

• If you have had therapy with me and it has now ended, I will use 'legitimate interest' as my lawful basis for holding and using your personal information. My legitimate interest is keeping appropriate clinical records in line with my professional obligations as a BACP-registered counsellor and to protect against any future complaint or claim.
• If you are currently having therapy or if you are in contact with me to consider therapy, I will process your personal data where it is necessary for the performance of our contract.

The UK GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called 'special category personal information'. The lawful basis for me processing any special categories of personal information is that it is for the provision of health treatment (in this case counselling) and necessary for a contract with a health professional (in this case, a contract between me and you), under Article 9(2)(h) of the UK GDPR.

Where there is an emergency and I need to act to protect your life, or someone else's, I may also rely on the protection of vital interests as my lawful basis.

How I use your information

Initial contact

When you contact me with an enquiry about my counselling services, I will collect information to help me satisfy your enquiry. This includes your name, address, telephone numbers and email address. In addition, your date of birth, reasons for counselling, past counselling experiences, previous or existing medical conditions / admissions, GP details and any history of self-harm or violence or overdose will be recorded on your client agreement form. This information is highly sensitive, but essential for counselling to take place as it helps to build a picture of who you are and helps me to understand your circumstances.

Whilst useful it is not essential, and it is your right to refuse to give me any or all of this information.

Alternatively, your GP or other health professional may send me your details when making a referral, or a trusted individual may give me your details when making an enquiry on your behalf.

If you decide not to proceed, I will ensure all your personal data is deleted within 30 days. If you would like me to delete this information sooner, just let me know.

How you reach me makes a difference to who else keeps a copy of that first message, so it is worth setting out the routes:

• Through my website — the enquiry form at www.jplcounselling.co.uk. Your message comes to me by email and is covered by this notice.
• By email to jplcounselling@protonmail.com, which is encrypted.
• By text or call to my work mobile. My mobile network and yours hold a record of the fact, time and length of calls and texts, although not the content of a call.
• Through WhatsApp Business. Messages are encrypted in transit, but they pass through and are held on Meta's systems under Meta's own privacy practices, which I do not control.
• Through Instagram. The same applies as for WhatsApp: Meta holds the message.
• Through my Psychology Today listing. Psychology Today collects your name, email address, telephone number and whatever you write in the message box, and holds it under its own privacy policy. It does not state a fixed deletion period for those messages, and I have no control over that copy.

If you would rather as few other companies as possible held a copy of your first contact, email or call me directly. Whichever route you use, if you decide not to go ahead I will delete the copy I hold within 30 days.

While you are accessing counselling

Everything you discuss with me is confidential. That confidentiality will only be broken if you were to disclose involvement in or knowledge of an act of terrorism, money laundering or drugs trafficking. In addition to this, I have a responsibility to report instances of harm to self or to others, and I do have a legal obligation to report harm or abuse to a minor or vulnerable adult. I will always try to speak to you about this first, unless there are safeguarding issues that prevent this.

I will keep a record of your personal details to help the counselling services run smoothly. These details are kept securely, password protected, with access to me only and are not shared with any third party.

I will keep notes of each session. These are securely stored electronically using strong passwords and encryption, and the data is regularly backed up with multiple copies, in the event of accidental deletion, natural disaster, fire or a cyber-attack.

So that it is clear what "your record" means, it is more than my session notes. While we are working together, and for the retention period afterwards, my record of our work may include:

• my session notes;
• your contact details, GP details and emergency contact;
• your GAD-7 and PHQ-9 scores and any review notes;
• any questionnaires or worksheets we use;
• any safety plan we make together, and my record of any conversation about risk or safety;
• our texts, emails and other messages about your counselling;
• if we work remotely, the location you confirm at the start of each session;
• a note of any decision I have had to make about your care, and my reasons for it.

All of it is held to the same standard of security, and all of it carries the rights set out below.

For security reasons I do not retain text messages and social media messages (WhatsApp, Facebook or Instagram) for more than 1 year. If there is relevant information contained in a text message or social media message, I will screenshot and electronically store it securely. Likewise, any email correspondence will be deleted after 1 year if it is not important. If necessary, I will save the email electronically and store it securely.

To be clear about how the one-year and five-year periods fit together: I delete routine messages within a year. If something in a message is clinically important — a disclosure, a change in how safe you are feeling, or an agreement we reach — I record it in your notes at the time, and that record is kept for five years after our work ends, along with the rest of your file.

If we work online or by telephone

If we work online or by telephone, I will ask you to confirm where you are at the start of each session. This is a safety measure: if you became unwell or unsafe during a session, I would not be able to direct emergency help to you without it. I note it with my record for that session and hold it as securely as everything else, for the same retention period. My lawful basis for holding it is the same as for the rest of your record, together with the protection of your vital interests should an emergency arise. If you would rather not give it, please tell me — but I may not be able to offer remote sessions safely without it.

After counselling has ended

Once counselling has ended your records will be kept for 5 years from the end of our contact with each other and are then securely destroyed. This retention period is in line with guidance for counselling and psychotherapy practice and allows for the possibility of complaints, professional reviews, or insurance matters arising after the end of therapy. If you want me to delete your information sooner than this, please tell me.

Records of ethical decisions

From 3 November 2026 the BACP Ethical Framework asks counsellors to be able to explain the reasoning behind the decisions we make in our work. Where a decision concerns you, my note of that reasoning forms part of your record. It is held as securely as everything else and carries the same rights. It is written to record what I decided and why, without holding more about you than it needs to.

If you buy my workbook

I sell a self-help workbook to the public through Payhip. Buying it does not make you a counselling client, and the rest of this notice — which is about counselling records — does not apply to that purchase.

• Payhip Ltd (UK) processes your order on my behalf: your name, email address and order details.
• Payment is taken through PayPal. PayPal holds its own record of the transaction and decides for itself how it uses that information, under its own privacy policy. I can see your name, your email address and the amount and date of the payment in my PayPal account. I never see or hold your card or bank details.
• I use your email address to deliver the workbook and to deal with any question, problem or refund. I will not add you to a mailing list unless you ask me to.
• I keep order records for six years, which is the period HMRC requires business records to be kept.
• I do not sell the workbook to my counselling clients. Where it would be useful in our work together, I give it to clients free of charge.
• The rights set out below apply to this information in the same way as to anything else I hold.

Refunds and cancellation are dealt with in the workbook terms of sale, which you will find with the listing.

How your data is kept secure

I take the security of your personal information seriously. The measures I have in place include:

• Electronic records stored on password-protected and encrypted devices.
• Strong, unique passwords with multi-factor authentication where available.
• Regular secure backups so data can be recovered in the event of accidental loss, disaster or cyber-attack.
• Paper records (where used) stored in a locked location accessible only to me.
• Email handled through ProtonMail, which provides end-to-end encryption.
• Secure deletion of records once retention periods end.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours and inform you without undue delay where required.

Third party recipients of personal data

I will not share your information with any third parties unless:

• You have consented to this.
• It is as part of my duty to protect a child, a vulnerable adult, yourself or the public.
• I am required to do so by any court or law or any relevant regulatory authority.

Where I do have to share information to protect someone, the organisations I would contact are: the emergency services (999); NHS 111; your GP; Manchester City Council's Contact Centre on 0161 234 5001, for a concern about an adult at risk or about a child; and the police. I share only what is necessary, I record what I shared and why, and wherever it is safe and appropriate to do so I will talk to you about it first.

I use a small number of trusted service providers ("data processors") to deliver my service:

• ProtonMail — email provider (Switzerland, end-to-end encrypted).
• Proton AG (Proton Drive) — encrypted storage for my session notes, questionnaires and worksheets (Switzerland).
• Proton AG — provides Proton Meet, the platform used for online video sessions (Switzerland). It is end-to-end encrypted, which means the audio, video and any chat are encrypted on our own devices, so Proton cannot access them. Proton stores no recording of a meeting and no record of who met with whom. You join under whatever name you choose, so your details need not pass through the video provider at all. Sessions are not recorded. No notes or records are stored in or sent through the platform.
• Ginger Labs, Inc. (Notability) — the app I use on a secured iPad to complete worksheets. Its backup is set to sync only to Proton Drive, and not to iCloud, Google Drive or Dropbox (USA).
• Deskcush Ltd — UK company that designs, builds and operates this website (including the AI assistant) on my behalf. ICO registration ZC136157.
• Netlify, Inc. — website hosting and serverless functions (USA). Currently contracted by Deskcush Ltd on my behalf.
• Anthropic PBC — provides the Claude large language model that powers the AI assistant on this site (USA). Currently contracted by Deskcush Ltd on my behalf.
• Cloudflare, Inc. — content delivery network used at the edge by Netlify (USA, sub-processor).
• Payhip Ltd — the platform through which I sell my self-help workbook to the public (UK). This concerns buyers rather than counselling clients; see "If you buy my workbook" above.

Each is bound by their own data protection obligations and only processes your data on my instructions, or on the instructions of Deskcush Ltd acting on my behalf. Where a provider's standard terms do not include a specific processing agreement with me, I limit what passes through their systems accordingly.

Some organisations hold information connected to our work but decide for themselves how they use it, so they are not acting on my instructions:

• Monzo Bank Ltd — my business bank. If you pay by bank transfer, your full name as it appears on your own account shows on my statement, together with the amount, the date and any reference you use. Your own bank holds the same record. I cannot prevent this. If it concerns you, please talk to me — for face-to-face sessions I can also take cash (UK).
• Sussex Directories Inc. (Psychology Today), in respect of the directory listing. I stopped using their video tool for sessions on 18 September 2026. If you found me through Psychology Today or messaged me there, Psychology Today holds a record of that contact under its own privacy policy, which I do not control (USA).
• PayPal (Europe) — the payment provider used for workbook sales. PayPal is a regulated payment company and decides for itself how it uses transaction data, under its own privacy policy.
• Meta Platforms — only if you choose to contact me through WhatsApp, Facebook or Instagram. See the section on those platforms below.

My clinical supervisor is not a data processor. I discuss my work in supervision, as every counsellor is required to, using pseudonymised material only. My supervisor is bound by the same duties of confidentiality and data protection as I am, and I do not disclose your identity.

Platforms and tools that may collect data

Some of the systems I use to run my practice collect information about our contact as a by-product of providing the service, even though what we discuss in counselling stays between us. So that you know what those are:

• Your phone network and mine hold a record of the fact, time and length of our calls and texts, even though I keep the content of messages to a minimum.
• ProtonMail holds our emails in encrypted form. Proton cannot read them, but the fact of an email between us exists on their system.
• Proton Meet holds no meeting content and no record of who met with whom. Its servers handle only the minimum technical data needed to route a call while it is happening. Proton Meet runs on infrastructure provided by LiveKit, which only ever handles encrypted traffic and cannot read anything; I have asked Proton to confirm that company's country of establishment and will update this notice when they reply.
• The Psychology Today directory is an advertising-funded website. Unlike my own site, it uses cookies, pixels and similar tracking for advertising and analytics, and shares data with partners including Google. If you reached me through Psychology Today, or messaged me there, that happened under their policy rather than mine. Their policy includes a "Do not sell or share my personal information" option.
• This website is hosted by Netlify and delivered through Cloudflare. Their servers log ordinary technical information such as IP addresses, for security. There are no analytics or tracking cookies on this site, as set out under Cookies below.
• Monzo holds a record of counselling fee payments, as any bank would, and PayPal holds a record of workbook purchases.

On this website I do not use any tool that monitors your device, tracks you across the internet, or builds a profile of you. I cannot make that promise about other companies' websites, including Psychology Today's.

International data transfers

Some of my service providers (for example, the AI assistant provider, the video platform and my worksheet app) may process data outside the UK. Where this happens, I rely on the safeguards each provider has in place under UK GDPR — usually the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the provider's own equivalent approved mechanism — together with additional technical measures such as encryption. Each provider describes this in its own privacy policy, and I keep a note of what each one relies on.

The AI assistant on my website

My website includes an AI-powered assistant that can answer general questions about my counselling service (for example, fees, location, how to book an initial assessment).

The AI assistant is not a counsellor and does not provide therapy, advice or emotional support. It is intended only to help with practical enquiries and to point you towards booking an initial assessment with me.

How it works:

• The assistant is powered by Anthropic Claude, a large language model built by Anthropic PBC (USA). Messages you send to the assistant are processed by Anthropic to generate a response.
• Your conversations with the assistant are not used to train AI models. This is contractually guaranteed under Anthropic's commercial terms of service.
• Conversations are not stored on this site. They exist only in your browser's memory while the chat is open, and are sent to Anthropic for the few seconds needed to generate each reply. As soon as you close the chat panel or navigate away, the conversation is gone — there is no permanent record on this site's servers and no admin dashboard that holds your messages.
• Anthropic acts as a data processor on my behalf and is bound by a data processing agreement. Anthropic operates its own logging on the API side (governed by their privacy policy and retention rules) — that is outside my control. You can read Anthropic's privacy policy at anthropic.com/legal/privacy.
• Proton is established in Switzerland, which the UK recognises as providing an adequate level of protection, so no additional transfer safeguard is needed for your session notes, our emails, my diary or online sessions.
• Anthropic processes messages on servers in the USA; appropriate safeguards (UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses) are in place, together with technical measures including encryption in transit.

I do not use AI to make any automated decisions about you or your care. All decisions about whether to offer or continue counselling are made by me personally, and if you ask me why I made a particular decision, I will tell you.

I want to be equally clear about what I do not use AI for in my wider practice. I do not use any AI tool for your session notes, or for anything drawn from our sessions. I never enter information that could identify you into an AI tool. Where I use AI — for drafting worksheets and exercises, website copy, social media posts and other practice documents — I check what it produces before I rely on it, and I remain responsible for it. The tools I use for that work are named in my AI Use Policy. If you would prefer that I use no AI tools at all in connection with the administration of your counselling, please tell me and I will work without them — it will make no difference to the counselling you receive. My AI Use Policy sets this out in full.

The self-reflection tool

The site includes a short self-reflection: 8 gentle prompts to help you notice where you are. It runs in two places — a dedicated page at /reflect, and as a guided flow inside the AI assistant chat widget (the "Self-reflection" pill).

• It is not a clinical screening tool, not a diagnostic test, and not a substitute for talking to a qualified person.
• In both versions, the questions, your selections and the resulting reflection run entirely in your browser. Nothing is sent to my server, to Anthropic, or to any third party — even when the reflection runs inside the chat widget, the model is not invoked during the flow.
• Nothing is stored. Closing or refreshing the page (or closing the chat) clears it.
• No analytics or tracking is attached to either version. No cookies are set by them.

Cookies and website analytics

This site uses only strictly necessary browser storage — a single local-storage flag that records when you've dismissed the cookie notice, so it doesn't reappear on every visit. Nothing else is set. There are no analytics, no advertising trackers, and no third-party cookies on this site.

If non-essential cookies are ever introduced (for example, anonymous usage analytics), they will only load after you opt in through the cookie banner, and you'll be able to withdraw consent at any time.

The AI assistant on this site does not store anything in your browser. Your conversation with it is held only in memory while the page is open and is sent to Anthropic for the duration of each request.

How I handle your data when communicating through Facebook, Instagram and WhatsApp Business

Facebook

• I will not add you as a friend on Facebook nor like any of your posts.
• Any communication between us on Facebook will be kept private and not shared with any third parties.
• I will not post any information about you on Facebook.

Instagram

• I will not follow you on Instagram nor like any of your posts.
• Any direct messages between us on Instagram will be kept private and not shared with any third parties.
• I will not post any information about you on Instagram.

WhatsApp Business

• I will only add clients as contacts on WhatsApp if they have given me explicit consent to do so.
• Any communication between us on WhatsApp will be kept private and not shared with any third parties.
• I will not post any information about you on WhatsApp.

Please be aware that messages sent through Facebook, Instagram and WhatsApp pass through Meta's servers and are subject to Meta's own privacy practices. For confidential matters, I'd encourage you to contact me by email or phone instead.

Your rights

Under UK GDPR you have the right to:

• Be informed about how your personal data is used (this notice).
• Access the personal data I hold about you.
• Rectification — ask me to correct any inaccurate or incomplete information.
• Erasure — ask me to delete your personal data ("right to be forgotten"), subject to my legal and professional record-keeping obligations.
• Restrict processing of your personal data in certain circumstances.
• Object to my processing of your personal data in certain circumstances.
• Data portability — ask for a copy of your data in a structured, commonly used format.
• Rights related to automated decision-making — I do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
• Withdraw consent at any time, where consent is the basis for processing.

You can read more about your rights at www.ico.org.uk/your-data-matters.

If I do hold information about you I will:

• Give you a description of it and where it came from.
• Tell you why I am holding it, how long I will store it for, and how I made this decision.
• Tell you who it could be disclosed to.
• Let you have a copy of the information in a clear form.

You can also ask me at any time to correct any mistakes there may be in the personal information I hold about you.

To make a request for any personal information I may hold about you, please put the request in writing addressing it to jplcounselling@protonmail.com. I will respond within one month, in line with UK GDPR.

There are two limits on the right of access that are worth knowing about. I may withhold information where releasing it would be likely to cause serious harm to your physical or mental health, or to someone else's — I would consider that carefully and take it to supervision. I will also redact information that identifies another person, unless they agree or it is reasonable to disclose it.

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in the way I work or in the law. The "last updated" date at the top of this notice will tell you when it was most recently revised. If the changes are significant, I will let current clients know directly.

This notice was updated to reflect the BACP Ethical Framework for the Counselling Professions 2026, which applies from 3 November 2026. Next review: November 2027.

How to complain

This section covers complaints about how I handle your personal data. For concerns or complaints about the counselling service itself, please see the complaints procedure.

If you have any concerns about my use of your personal information, you can make a complaint to me at jplcounselling@protonmail.com.

You can also complain to the ICO if you are unhappy with how I have used your data. My Information Commissioner's Office (ICO) reference number is ZB394792.