Privacy policy
Last updated: September 2026
I’m Chesney Jefferson, a self-employed person-centred counsellor based in Norwich. I’m the data controller for the personal information I collect and use in connection with my counselling practice and this website.
I’m registered with the Information Commissioner’s Office (ICO) as a data controller.
I take your privacy seriously. This policy explains what personal information I collect, why I collect it, how I use and protect it, who I share it with, and how long I keep it.
What information I collect
Depending on how you interact with me and whether you become a client, I may collect:
your name and contact details;
information you provide when you contact me about counselling;
information needed to arrange and manage appointments;
counselling notes and other records relating to our work together;
information you choose to share during counselling, which may include sensitive or special category information;
payment and invoicing information;
information I need to meet my professional, legal, regulatory and insurance obligations.
I only collect information that I reasonably need for these purposes.
How I collect your information
I may receive personal information directly from you when you:
email me;
speak to me during an introductory call;
arrange or attend counselling;
provide information during counselling;
make or arrange payments.
If you contact me through social media, I’ll ask you to move the conversation to email rather than discussing counselling or sensitive personal information through social media messaging.
I don’t use a contact form on this website, and I don’t operate a mailing list or newsletter.
Why I use your information
I use your information to:
respond to enquiries;
arrange and provide counselling;
manage appointments and maintain appropriate records of our work;
communicate with you about practical matters relating to counselling;
process payments and maintain financial records;
meet my professional, legal and regulatory responsibilities;
maintain appropriate records for professional and insurance purposes;
protect the security of my systems and practice;
deal with complaints, legal matters or other situations where I have a legal obligation to do so.
For ordinary personal data, I rely on the lawful bases that apply to the particular purpose, including contractual necessity where processing is necessary to provide the counselling service, legitimate interests where necessary to run and administer my practice, and legal obligation where I am required by law to process information.
Some of the information you may share with me is special category data because counselling can involve particularly sensitive information about your life and circumstances. I process this information only where the law allows me to do so. This includes the provisions for confidential counselling and advice in the Data Protection Act 2018, alongside the relevant lawful basis under the UK GDPR.
I do not use your personal information for advertising or sell it to anyone.
Counselling records
I use Sessionly to manage client records, appointments and counselling notes.
Sessionly states that client records and clinical data are stored on UK/EU servers in the London region and are encrypted both in transit and at rest. It also provides a system for separating client identity information from clinical records.
I keep counselling notes brief and factual. I use a unique identifier rather than your name in my counselling notes, and I avoid including unnecessary identifying information such as names, places of work or specific details of situations.
The information linking your name and contact details to your unique identifier is kept separately.
I also keep a secure hard-copy record containing the master list of clients and their unique identifiers. This is kept offline and separately from counselling notes.
I use Google Workspace for professional email.
Information you send to me by email is processed by Google on my behalf as part of providing and administering my counselling service. Google may process personal information in countries outside the UK, subject to the contractual and legal safeguards that apply to international data transfers.
I keep counselling-related email correspondence for as long as I reasonably need it for the purposes of providing the service, maintaining appropriate records, dealing with financial or administrative matters, or meeting legal and professional obligations.
I delete correspondence when there is no longer a legitimate reason to retain it, subject to any applicable retention requirements.
I use two-step verification on my counselling-related accounts and take reasonable steps to protect access to my email and other systems.
Supervision
As part of my professional practice, I discuss my counselling work with a supervisor.
I do not share information that could identify you unnecessarily. I do not provide identifying details such as your name, workplace or other information that would allow you to be readily identified.
Confidentiality
What you share with me is confidential. I won’t talk about you or the things you tell me with other people without your permission, except in circumstances where I have a professional or legal responsibility to do so.
These may include situations where there is a serious risk of harm to you or someone else, safeguarding concerns involving children or adults at risk, or where I am legally required to disclose information.
Unless I’m legally prevented from doing so, I would always aim to discuss any potential breach of confidentiality with you first.
I’ll talk through confidentiality and its limits with you when we first meet, so you know what to expect.
How long I keep your information
I keep adult counselling records for at least seven years after counselling ends.
This applies to the records I need to retain as part of my professional record-keeping responsibilities. I do not automatically retain every piece of information for seven years simply because it relates to an enquiry.
Information that does not need to be retained for professional, legal, financial or other legitimate purposes is deleted when it is no longer needed.
When information is no longer required, I securely delete or dispose of it.
Who I share your information with
I do not sell or share your personal information for advertising or marketing.
Where necessary to run my practice, personal information may be processed by organisations that provide services to me, such as:
Sessionly, for client records, counselling notes, appointments and practice management;
Google Workspace, for professional email;
professional advisers or insurers, where necessary;
my supervisor, where necessary for professional supervision and without unnecessary identifying information;
public authorities or other organisations where I am legally required to provide information.
These organisations only receive information that is relevant to the service or purpose for which it is being processed.
International data transfers
Some of the services I use may process personal information outside the UK.
For example, Google Workspace may process information in countries outside the UK as part of providing its services. Where this happens, the relevant provider is responsible for applying the contractual and legal safeguards required for international data transfers.
Sessionly states that client records and clinical data are stored on UK/EU servers in the London region.
How I protect your information
I take reasonable technical and organisational measures to protect your personal information from loss, misuse, unauthorised access, alteration or disclosure.
These include:
password protection and two-step verification;
using established professional services with appropriate security measures;
limiting access to personal information;
keeping counselling notes and identifying information separate where practical;
using secure storage for physical records;
regularly reviewing the information I hold and deleting information that is no longer needed.
No method of storing or transmitting information is completely secure, but I take the protection of your information seriously.
Cookies and this website
This website is hosted by Squarespace.
The website uses cookies and similar technologies that are necessary for the website to function, maintain security and remember your cookie preferences.
Squarespace may also use non-essential cookies and similar technologies for analytics and other purposes. These are restricted unless you choose to allow them through the cookie settings.
I currently do not use Google Analytics, the Meta Pixel or other third-party advertising or behavioural tracking tools on this website.
My Squarespace cookie banner gives you the option to accept all cookies or manage your cookie choices.
Non-essential cookies require appropriate consent before they are used.
Your rights
Depending on the circumstances, you have rights under UK data protection law, including the right to:
ask for a copy of the personal information I hold about you;
ask me to correct inaccurate or incomplete information;
ask me to delete information where there is no longer a lawful reason for me to keep it;
ask me to restrict how I use your information in certain circumstances;
object to certain types of processing;
ask about how your information is being used and who it is shared with.
These rights are not absolute, and there may be circumstances where I am legally entitled or required to retain or use information.
If you want to exercise any of your rights, please contact me using the details on the Contact page.
Complaints
If you have a concern about the way I have handled your personal information, please contact me first so I have an opportunity to address it.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your personal information has not been handled in accordance with data protection law.
Changes to this policy
I may update this privacy policy from time to time to reflect changes to my practice, the services I use or data protection requirements.
The date at the top of this page shows when it was last updated.