Privacy & GDPR

Data & Privacy

How we handle your information

These documents explain how Kara Jackson Counselling collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.

1. Who we are

This privacy policy explains how Kara Jackson Counselling collects, uses, and protects your personal information. I am Kara Jackson, a qualified counsellor/psychotherapist in private practice.

Contact details:

Therapist: Kara Jackson

Email: karajacksoncounselling@gmail.com

Website: www. karajacksoncounselling.com

2. What personal data we collect

When you work with Kara Jackson Counselling, I may collect and process the following types of personal information:

Contact and identification details:

Your name, address, telephone number, and email address

Emergency contact details

Health and therapy-related information:

Your presenting issues and reasons for seeking therapy
Session notes documenting our therapeutic work together
Relevant medical history and any medications you share with me
Information about your mental and emotional wellbeing
Details of other healthcare professionals involved in your care

Administrative information:

Appointment dates and session records
Invoices and payment records
Communications between us (emails, messages)

Important: Your health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I take additional care to keep it secure and confidential.

Website enquiries:

When you submit our contact form, I collect your name and email address

This website runs on WIX. Any installed plugins may process personal data

This website is built on WIX who may collect certain technical data about visitors including basic analytics

3. How we collect your data

I collect your personal information directly from you:

When you first contact me to enquire about therapy (by email, telephone, or contact form)

During our initial consultation and intake process

Throughout our therapeutic sessions together

When you communicate with me between sessions

When you complete any forms or assessments I provide

I do not collect information about you from third parties unless you have given explicit consent for this, or where you have been referred through an Employee Assistance Programme (in which case limited referral information may be shared as part of the commissioning arrangement).

4. Why we process your data — lawful basis

Under UK data protection law, I must have a valid legal reason (known as a "lawful basis") to collect and use your personal information. I rely on the following bases:

Article 6 basis (ordinary personal data):

Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services. I need to process your personal data to fulfil that contract.

Article 9 basis (special category health data):

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional DPA 2018 Schedule 1 condition is Part 1, paragraph 2 (health or social care). Processing is carried out by a qualified counsellor/psychotherapist subject to the common-law duty of confidence and professional standards expected of counsellors and psychotherapists in private practice.

5. Professional obligations and supervision

To maintain high professional standards and ensure I am providing you with safe and effective therapy, I attend regular clinical supervision. This is an essential part of ethical therapeutic practice.

When I discuss our work in supervision:

Your name and any identifying details are not shared with my supervisor

I use anonymised or pseudonymised case material only

My supervisor is a qualified professional bound by the same confidentiality obligations as I am

My supervisor is bound by their own professional body's ethical framework

Supervision helps me reflect on my practice, identify blind spots, and ensure I am working in your best interests at all times.

6. Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor — a trusted colleague who is also a qualified therapist bound by professional confidentiality obligations. In the event of my death, serious illness, or incapacity that prevents me from continuing to practise:

My Clinical Executor will contact you to inform you that I am no longer able to provide therapy

They will offer you the opportunity to discuss how you wish your records to be handled

Your records will be managed confidentially and in accordance with this privacy policy

If you cannot be contacted, your records will be retained securely for the remainder of the retention period and then destroyed

My Clinical Executor will not read your clinical records unless absolutely necessary to fulfil their duties

This arrangement ensures continuity of care and protection of your confidential information in unforeseen circumstances.

7. Who we share your data with

I take your confidentiality seriously and keep your information within Kara Jackson Counselling wherever possible. However, the following parties may have access to certain information:

Clinical supervisor: My supervisor receives anonymised case material only. Your name and identifying details are never shared. This supports my professional practice and ensures I am providing you with safe, effective therapy.

Employee Assistance Programme (EAP) or referral platform: If you were referred to me through an EAP or similar referral service, limited information may be shared with them as part of the commissioning arrangement. This typically includes confirmation of attendance and session numbers. I will explain this to you at the outset if it applies to your situation.

Third-party service providers: I use the following third-party services which may process your data:

WIX — this website is hosted on WIX which may collect technical visitor data

Google Meet — used for online therapy sessions

Each of these services is bound by a data processing agreement. I can provide links to their privacy policies on request.

I never sell your personal data.

8. International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

WIX (Tel Aviv, Israel) — may transfer data to the Israel

Google Meet (Google LLC, USA) — may transfer data to the USA

The USA does not currently have a UK adequacy decision. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

You can request a copy of the relevant transfer safeguards by contacting me.

9. How long we keep your data

I retain your personal information only for as long as necessary. The retention periods are:

Type of record Retention period

Therapy records

7 years after our last session

In line with the Limitation Act 1980 and standard professional indemnity insurance requirements

Financial records (invoices, receipts)

6 years HMRC legal requirement

Website enquiries (non-clients)

12 months

Legitimate business interest

After the applicable retention period

Paper records are shredded using a cross-cut shredder

Electronic records are permanently deleted using secure deletion software

10. Your rights under UK GDPR

You have the following rights regarding your personal data. I have written these in plain language so you understand what each one means:

Right to be informed

You have the right to know how I collect and use your data. This privacy policy fulfils that right.

Right of access

You can ask me for a copy of the personal information I hold about you. This is sometimes called a "subject access request." Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search when responding to your request.

Right to Rectification

If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

Right to Erasure

In some circumstances, you can ask me to delete your personal information. However, this right does not apply where I am required to retain records in line with the Limitation Act 1980 and standard professional indemnity insurance requirements, or where I have a legal obligation to keep them.

Right to Restrict

processing You can ask me to limit how I use your data in certain situations, for example while I investigate a complaint you have made about accuracy.

Right to data Portability

Where I process your data based on contract or consent, you can ask me to provide it in a commonly used electronic format so you can transfer it to another service.

Right to Object

You can object to processing based on legitimate interests. I will stop processing unless I have compelling legitimate grounds to continue.

Rights related to automated decision-making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. I do not use automated decision-making in my practice.

To exercise any of these rights, contact me at: karajacksoncounselling@gmail.com

I will respond to your request within one month. There is no fee for most requests.

11. Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. If you are unhappy with how I have handled your personal information, please let me know so I can try to put things right.

Submit a complaint:

Email: karajacksoncounselling@gmail.com

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk

Telephone: 0303 123 1113

Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12. Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are limited circumstances where I may need to share information without your consent:

Risk of serious harm

If I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep people safe

Safeguarding concerns

If I become aware of concerns about the safety of a child or vulnerable adult, I have a professional and legal duty to report this to the relevant authorities

Legal requirement

If I receive a court order requiring me to disclose information, I am legally obliged to comply

Wherever possible, I will discuss any disclosure with you first and explain my reasons — unless doing so would itself put someone at risk of harm.

These exceptions are rare. The vast majority of what we discuss remains completely confidential.

13. Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make changes that affect how I handle your personal data, I will inform you directly.

The "last updated" date at the top of this policy shows when it was most recently revised.

Contact Kara Jackson Counselling

If you have any questions about this privacy policy or how I handle your personal data, please contact me:

Email: karajacksoncounselling@gmail.com

Website: www.karajacksoncounselling.com

Last generated: 12 June 2026