Privacy Policy

This Privacy Notice explains how I, Joanne Lawson-Webb, use and protect any information that you give me when you inquire about and/or use my psychotherapy services. I am registered with the Information Commissioner's Office (ICO), reference ZB504764, for safe keeping of this information. I understand UK GDPR practices and abide by them.

I am committed to ensuring that your privacy is protected. Should I ask you to provide certain information by which you can be identified, then it will only be used in accordance with this privacy statement.

Last updated: 18 October 2026.

Information I may collect

You may give me information about yourself such as, but not limited to: name, address, email, phone number, date of birth, GP contact details, brief information about you and your immediate family member(s) health history, family and support structures, medications prescribed and non-prescribed, eating and sleeping patterns, and goals for therapy. I will record session attendance and a brief general overview of what was covered in the session.

This website

This section explains how the website itself handles information. It applies to anyone who visits the site, whether or not they become a client.

Contact form. If you use the form on the Get In Touch page, I receive the name, email address, phone number (optional) and message that you type. The message is sent securely to my email inbox, which is provided by Zoho Mail (hosted in the UK), and is then handled as described in the rest of this notice. Please don't include sensitive health details in your message; there will be time to talk about those once we are in touch. If you would prefer not to use the form, you can email or phone me instead.

Spam protection. The form is protected by Cloudflare Turnstile, which checks that a message is sent by a person rather than an automated program. To do this, Cloudflare receives your IP address and some information about your browser. See the Cloudflare Privacy Policy. Your IP address is also used briefly to limit how many messages can be sent in a short time. I do not store it, and it is not included in the message I receive.

Website hosting. The site is hosted by Cloudflare. As with any website, Cloudflare processes visitors' IP addresses in order to deliver the pages and to keep the site secure. See the Cloudflare Privacy Policy.

Google Maps. The Get In Touch page shows a map from Google Maps. It loads automatically when you scroll to it, which means Google receives your IP address and may set its own cookies. If you prefer to avoid this, you can find the practice's postcode (DE65 5HY) in a map service of your choice. See the Google Privacy Policy.

Lily, the chat assistant. Lily runs entirely in your browser and answers from the text of this website. The questions you type are not sent anywhere and are not stored.

Google Analytics. If you click Accept on the cookie banner, the site uses Google Analytics to count visits and show which pages are read. Google sets cookies (named _ga and _ga_ followed by letters and numbers) and receives your IP address, browser and device details and the pages you view. Google states that Google Analytics 4 does not log or store IP addresses. Advertising features and Google signals are switched off, and the information is used only for understanding how the site is used. Nothing is sent to Google Analytics unless you accept. If you click Decline, or ignore the banner, no analytics cookies are set. You can change your choice at any time with the Cookie settings link at the bottom of every page. See the Google Privacy Policy.

Cookies and tracking. Apart from the optional analytics cookies above, this website does not use advertising or tracking cookies. Your analytics choice is remembered in your browser's local storage for 12 months, after which you will be asked again. The only other third-party services that load on the site are those described above.

Why is data processed and stored?

Contractual:

To manage my relationship with you
To fulfil our contract
To deliver services
To manage payments

Consent:

To manage sensitive data as a (UKCP) healthcare professional

Statutory/Legal:

To fulfil legal duties
To keep records
To ensure safeguarding
To comply with professional regulations and standards

How is data processed and stored?

Electronically, in accordance with UK GDPR. Computer storage of minimal data, such as emails from you, is only accessed by me through a password protected email account. Paper files are securely stored in a locked filing cabinet. Mobile phone contact details are held on a password protected mobile device.

When is data processed and stored?

During our contract
When it is in your best interest e.g. to fulfil our contract
When I have a legal duty e.g. safeguarding concerns
When it is in my legitimate interest e.g. running business, paying taxes
When you consent

How long and why is data kept?

When we have finished our work together, your information will be put in to archive storage, and subject to restricted processing. Records will be retained in line with my insurance company and governing body policies. Retention is a legal duty, necessary in case there are legal proceedings or complaints for which documentation is required. Records will be disposed of/deleted securely according to legal requirements.

Disclosure of your information

Any information I record about you is confidential and collected to carry out my professional and contractual obligations during our therapeutic relationship. I maintain confidentiality in accordance with the United Kingdom Council for Psychotherapy (UKCP) Code of Ethics and Professional Practice ; this can be viewed at the UKCP website.

If I have safeguarding concerns regarding either yourself, children or other people that you are in contact with, I may need to share this information with other agencies. I will endeavour to gain your consent if these situations arise, but I retain the right to break confidentiality without prior consultation with you, should I consider that the urgency of the situation requires me to act immediately to safeguard the physical safety of yourself or others.

I am obliged to share information if the courts order me to do so. Your consent will be sought where possible, and in writing. I have a legal obligation to report any information that relates to terrorism, money laundering and radicalisation.

Access to information

You can request access to the personal information that I hold about you, and you can transfer that information to a third party if you wish. I will provide this, except in the limited circumstances in which I am permitted not to. You may request amendments to the personal information I hold about you that is inaccurate or out-of-date. If you request that I delete your personal information, I will take all reasonable steps to do so unless I need to keep it for legal, auditing or internal business purposes.

Contact

Complaints, questions, comments and access requests should be addressed to info@jolawsoncounselling.com

You can contact the ICO on 0303 123 1113, or find other ways to contact the ICO via ico.org.uk.