Privacy Policy

SJ BUCHANAN PSYCHOTHERAPY

Privacy Notice and Confidentiality Policy

Version 1.0 | October 2026

This notice explains how I collect, use, store and protect your personal information when you contact me about therapy, throughout our work together and after our sessions have ended. I understand that therapy involves sharing personal and sometimes sensitive aspects of your life, and I treat that information with care, respect and discretion.

I handle personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, alongside my professional and ethical responsibilities as a psychotherapist.

1. Who is responsible for your information?

My name is Sarah Jayne Buchanan, and I am an integrative psychotherapist and a member of the British Association for Counselling and Psychotherapy (BACP). I practise face-to-face with women in Wimbledon.

I am responsible for the personal information I collect and hold in connection with my practice. In data protection law, this responsibility is described as being the data controller.

My professional contact details

· Practice name: Sarah Jayne Buchanan Psychotherapy

· Data controller: Mrs Sarah Jayne Buchanan

· ICO registration reference: ZB365227

· Email: sj@sjbuchanan.com

· Telephone: 07834 726 457

· Website: www.sjbuchanan.com

You are welcome to contact me if you would like to discuss any aspect of this notice or how your information is managed.

2. What information do I collect?

The information I collect will depend on the nature of our contact and the work we undertake together. It may include:

· Your name and contact details, including your telephone number and email address.

· Information you provide when making an initial enquiry.

· Relevant personal, family, relationship and social history.

· Information about your physical or mental health, wellbeing and personal circumstances where relevant to our work.

· Information shared during sessions and recorded in my clinical notes.

· Appointment, payment and administrative records.

· Relevant correspondence between us.

Some of this information is classed as special category personal data under data protection legislation because it is particularly sensitive, including information concerning your health. I aim to collect only information that is relevant and necessary for providing therapy, maintaining appropriate clinical records and managing my professional responsibilities.

3. How and why do I use your information?

I use your personal information for purposes connected with the safe and appropriate provision of psychotherapy and the running of my practice. This may include:

· Responding to your enquiry and discussing whether my service is suitable for you.

· Arranging and managing appointments.

· Establishing and maintaining our therapeutic agreement.

· Providing psychotherapy and keeping appropriate clinical notes.

· Communicating with you about practical matters relating to our work.

· Managing payments and maintaining necessary financial records.

· Meeting my professional, legal, ethical and insurance obligations.

· Addressing legitimate professional or legal concerns where necessary.

I do not use your information for unrelated purposes or sell your personal information to third parties.

4. The lawful basis for processing your information

Data protection law requires me to identify a lawful basis for collecting and using personal information. The basis I rely on depends on the purpose for which the information is being processed.

Before therapy begins

When you contact me, I use the information you provide to respond to your enquiry and, where appropriate, take steps towards establishing a therapeutic agreement. Depending on the circumstances, this processing is based on taking steps at your request before entering into a contract or on legitimate interests.

During our work together

I process information that is necessary to provide psychotherapy, manage our working agreement and maintain appropriate records. This will generally be based on the performance of our contract, where the relevant legal conditions are met.

Sensitive personal information

In psychotherapy, it may be necessary to process information concerning your physical or mental health, personal history and other sensitive aspects of your life. Where I process special category personal data, I must meet both the relevant general lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9, together with any applicable requirements of the Data Protection Act 2018.

For information necessary to provide health care or treatment, I rely on the applicable health or social care condition where its legal requirements are met, including the relevant safeguards concerning professional confidentiality.

After therapy has ended

I may need to retain records for professional, insurance, legal or administrative purposes. Depending on the circumstances, the lawful basis may include legitimate interests or compliance with a legal obligation. I only retain and use information where there is an appropriate purpose and lawful basis for doing so.

5. Confidentiality and its limits

Confidentiality is fundamental to the therapeutic relationship. I will not routinely disclose information about you or our work to other people without an appropriate lawful and ethical basis. However, confidentiality cannot be guaranteed in every circumstance. There are situations in which sharing information may be necessary, permitted or required by law.

Clinical supervision

I undertake professional supervision to reflect on my work, maintain good practice and support the quality of the therapy I provide. Relevant aspects of our work may be discussed with my supervisor. Wherever possible, I will avoid sharing identifying details and will take appropriate steps to protect your identity and confidentiality.

Risk of serious harm and safeguarding

If I have significant concerns that you or another person may be at serious risk of harm, or that a child or adult at risk may need protection, I may need to share relevant information with appropriate services.

Legal requirements and other exceptional circumstances

I may be required or legally permitted to disclose information in response to a legal obligation, court order or other lawful requirement. There may be other exceptional situations in which disclosure is justified by law or the public interest.

Where it is appropriate and safe to do so, I will aim to discuss a proposed disclosure with you before sharing information. There may be circumstances in which I cannot do this, particularly where doing so could increase risk, compromise safeguarding or conflict with a legal requirement. Any disclosure will be limited to the information reasonably necessary for the purpose.

6. Clinical notes and record keeping

I maintain clinical records as part of my professional responsibilities. These records help me maintain continuity in our work, reflect on the therapeutic process and meet appropriate professional and legal obligations.

My notes are intended to be relevant, proportionate and appropriate to the work we undertake. They are not intended to be a verbatim account of everything discussed in a session. I take care to keep clinical information confidential and to protect it from unauthorised access, loss or disclosure.

You have the right to request access to personal information I hold about you. Requests for access to clinical notes will be considered in accordance with data protection law, including any applicable exemptions or limitations.

7. Electronic records and information security

I use WriteUpp, a practice management system designed for healthcare and therapy professionals, to manage and store client information and clinical records.

WriteUpp processes personal information on my behalf as a data processor. I remain the data controller and am responsible for deciding why and how your personal information is used within my practice.

WriteUpp describes its security measures as including encryption of information in transit and at rest, two-factor authentication and information security management certified to ISO 27001 standards. It also provides features intended to help practitioners manage their data protection responsibilities.

I have chosen to use a dedicated practice management system to support the secure handling of sensitive client information. However, using WriteUpp does not remove my own responsibilities under data protection law. I remain responsible for ensuring that your information is processed lawfully, accessed appropriately and retained only for as long as necessary.

Further information is available in WriteUpp's Privacy Policy: https://www.writeupp.com/privacy and Security Information: https://www.writeupp.com/security.

8. Emails, telephone calls and text messages

I may use telephone calls, text messages and email to communicate with you about appointments and other practical matters relating to our work. I ask that you consider the privacy of your own devices and email account when communicating with me, particularly if other people have access to them.

I do not routinely retain correspondence indefinitely. Where a message contains information relevant to our work or needs to be retained for professional, legal or administrative reasons, I may keep the relevant information as part of my records. Other correspondence will be deleted when it is no longer necessary to retain it, subject to any applicable legal or professional requirements.

9. Who may have access to your information?

I do not sell your personal information or share it for commercial marketing purposes. In limited circumstances, information may be accessed or shared with:

· My clinical supervisor, where necessary for professional supervision.

· Professional, legal or insurance advisers, where necessary and appropriate.

· WriteUpp and other service providers who support the operation of my practice, where they need to process information on my behalf.

· Relevant authorities or services where disclosure is necessary and lawful.

Where a third-party provider processes personal information on my behalf, I take appropriate steps to ensure that suitable data protection arrangements are in place. I will only share information where there is an appropriate lawful basis and will take reasonable steps to limit disclosure to what is necessary.

10. International transfers and automated decision-making

Some digital service providers may store or process information outside the United Kingdom. Where this applies, I will take the steps required by data protection law to ensure that appropriate safeguards are in place.

I do not use your personal information to make decisions about you solely through automated processing, and I do not undertake automated profiling as part of my psychotherapy practice.

11. How long do I retain your information?

I aim to retain personal information only for as long as it is necessary for the purpose for which it was collected, taking account of my professional responsibilities and applicable legal requirements.

Clinical records

My retention policy is to keep clinical records for seven years after the end of our therapeutic work. This period is intended to provide an appropriate period for retaining records in connection with professional practice, insurance and potential legal matters. Where a particular legal obligation or other lawful and justifiable reason requires a different period, I may retain relevant information for longer.

At the end of the applicable retention period, records will be securely destroyed or permanently deleted.

Initial enquiries

If you contact me but decide not to proceed with therapy, I will generally delete your enquiry information within one month, unless there is a lawful and justifiable reason to retain it for longer.

Administrative and financial records

Some administrative and financial records may need to be retained for different periods to meet accounting, tax, insurance or other legal requirements.

12. Your data protection rights

You have rights under data protection law in relation to the personal information I hold about you. Depending on the circumstances, these include the right to:

· Access your information: request a copy of the personal information I hold about you.

· Correct your information: ask me to correct inaccurate or incomplete information.

· Request deletion: ask me to delete your information where the law permits.

· Restrict processing: ask me to limit how I use your information in certain circumstances.

· Object to processing: object to certain uses of your information where the relevant legal conditions apply.

· Data portability: request certain information in a structured, commonly used and machine-readable format where the legal conditions apply.

· Withdraw consent: where I rely on your consent for a particular activity, withdraw it. This does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are subject to legal conditions and exceptions. For example, I may need to retain certain clinical records even if you ask for them to be deleted.

If you wish to exercise any of your rights, please contact me at sj@sjbuchanan.com. I may need to verify your identity before responding. I will respond within the time limits required by law.

Further information about your rights is available from the Information Commissioner's Office at https://ico.org.uk/for-the-public/.

13. Questions, concerns or complaints

If you have any questions or concerns about how I handle your personal information, I encourage you to contact me directly in the first instance. I will take your concerns seriously and aim to respond openly and appropriately.

You also have the right to raise a concern or make a complaint to the Information Commissioner's Office (ICO), the independent authority responsible for upholding information rights in the United Kingdom. Further information is available at https://ico.org.uk/make-a-complaint/.

14. Updates to this notice

I may update this privacy notice from time to time to reflect changes in data protection legislation, professional guidance or the way my practice operates. The current version will be made available to clients.

Sarah Jayne Buchanan Psychotherapy

Mrs Sarah Jayne Buchanan | ICO registration reference: ZB365227

sj@sjbuchanan.com | 07834 726 457 | www.sjbuchanan.com

Privacy Notice | October 2026