Who I am

I am Jeanne Vorster Naidoo, a Clinical Psychologist and Chartered Psychologist (HCPC registration PYL28147), in private practice in St John's Wood, London, and online.

Confidentiality is central to psychotherapy, and I take your personal information seriously. This notice explains what information I hold about you, why I hold it, how I keep it safe, and the rights you have over it.

I am the data controller for the information described here, which means I am responsible for deciding how it is used and for keeping it secure. I am registered with the Information Commissioner's Office (ICO) under registration number ZC093022, and I process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information I collect

I collect only the information I need to provide you with safe, effective, and well-coordinated care. This falls into three broad areas.

• Enquiry details. When you contact me by email, telephone or through my website, I collect your name, contact details and anything you choose to share about what has brought you to seek therapy.

• Clinical records. If we begin working together, I keep records that may include your date of birth, address, GP details, emergency contact, relevant medical and psychological history, assessment information, brief session notes, and correspondence with other professionals involved in your care. Information about your health is classed as special category data and has additional legal protection.

• Payment details. I keep records of invoices and payments, and, where relevant, your health insurer, policy or membership number and authorisation details. I do not store full card details; the payment provider processes card payments securely.

Why I use your information, and the legal basis

I use your information to respond to your enquiry, assess whether therapy with me is the right fit, provide and coordinate your care, manage appointments and invoicing, and meet my professional, legal, and regulatory obligations.

Data protection law requires me to identify a lawful basis for each of these purposes:

• Enquiries and providing therapy: processing is necessary to take steps at your request before entering into an agreement, and then to deliver the therapy we have agreed (UK GDPR Article 6(1)(b)).

• Health information: processing is necessary for the provision of health care by a registered health professional who is bound by a duty of confidentiality (UK GDPR Article 9(2)(h), and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2).

• Financial and professional records: processing is necessary to comply with my legal obligations, including tax law and the record-keeping standards of my professional regulator (Article 6(1)(c)).

• Running the practice: processing is necessary for my legitimate interests in operating a safe, well-organised practice and in establishing or defending legal claims (Article 6(1)(f) and Article 9(2)(f)).

• Serious risk: in rare circumstances, sharing information may be necessary to protect your vital interests or those of another person (Articles 6(1)(d) and 9(2)(c)).

Where I rely on your consent for something specific, such as writing to your GP or sharing information with your insurer, I will explain this to you, and you may withdraw your consent at any time.

Confidentiality and who I share information with

What you share in therapy is confidential. I share information only where it is necessary for your care, where you have agreed, or where the law requires it, and I share no more than is needed.

• Your GP and other professionals involved in your care. I may write to your GP, a psychiatrist, or another clinician to keep your care coordinated. I will usually discuss this with you first.

• Health insurers. If your therapy is funded by insurance, I share the information your insurer needs to authorise and pay for sessions, such as attendance dates and, where required, brief clinical information. I will discuss this with you at the outset.

• WriteUpp, my practice management system. WriteUpp, my practice management system.

• Squarespace, my website provider. If you contact me through my website, Squarespace processes your message, as it hosts the site. Some of this information may be processed outside the UK; where this happens, appropriate safeguards are in place as required by UK data protection law.

• Clinical supervision. In line with good professional practice, I discuss my work in confidential supervision. I do this without using your name or details that would identify you.

• AI-assisted note-taking. I may use a secure AI transcription tool (WriteUpp AI Scribe or Heidi Health) to help me prepare session notes. I may use the tool to process the audio of my summary of our session to produce a draft, which I then review, edit and approve; the final note is written in my own clinical judgement. The audio is used only to create that draft and is not kept as part of your record. With your explicit agreement, I may request to record our session. These providers act on my behalf as data processors under written agreements, and may not use your information for their own purposes. This is entirely optional: you may decline or withdraw your agreement at any time, and this will not affect your therapy in any way.

• There are rare circumstances in which I may need to share information without your consent: where there is a serious risk of harm to you or to another person, where there is a safeguarding concern about a child or vulnerable adult, or where I am required to do so by law or a court order. Wherever it is safe and appropriate, I would talk with you before doing so.

  I never sell your information or use it for marketing.

There are rare circumstances in which I may need to share information without your consent: where there is a serious risk of harm to you or to another person, where there is a safeguarding concern about a child or vulnerable adult, or where I am required to do so by law or a court order. Wherever it is safe and appropriate, I would talk with you before doing so.

I never sell your information or use it for marketing.

How your information is kept secure

I store your records electronically in WriteUpp, a secure, password-protected system designed for healthcare practitioners, with access limited to me. I keep paper notes to a minimum, store them securely, and destroy them confidentially once I've transferred them to your electronic record.

Email is not a fully secure form of communication. I would encourage you to keep sensitive material for our sessions, and I keep clinical detail in email correspondence to a minimum.

How long I keep records

I keep information only for as long as is necessary, in line with professional guidance and legal requirements.

Type of record

How long it is kept

Clinical records

7 years after our last contact

Financial and invoicing records

6 years after the end of the relevant tax year

Enquiries that do not lead to therapy

12 months after our last contact

At the end of these periods, I securely delete or destroy records confidentially. In some circumstances, such as an ongoing complaint or legal matter, I may need to keep records for longer.

Your rights

You have a number of rights over the information I hold about you:

• Access: you can ask for a copy of the personal information I hold about you.

• Correction: you can ask me to correct inaccurate or incomplete information.

• Erasure: you can ask me to delete your information. Please note that I am usually required to keep clinical and financial records for the periods set out above, so I may not be able to delete these straight away. I will always explain my reasons.

• Restriction and objection: you can ask me to limit how I use your information, or object to a particular use of it.

• Portability: you can ask for information you have given me to be transferred to you or to another provider in a commonly used format.

• Withdrawing consent: where I rely on your consent, you can withdraw it at any time.

To make a request, please contact me in writing. There is normally no charge, and I will respond within one month. I may need to confirm your identity before releasing information, and in rare cases some information may be withheld where releasing it could cause serious harm or would reveal information about another person.

Cookies on my website

My website, hosted by Squarespace, uses a small number of cookies. Cookies are small text files placed on your device when you visit a website.

• Essential cookies help the website to function securely and remember your cookie preferences. These are always active, as the site cannot work properly without them.

• Analytics cookies help me understand, in general terms, how visitors use the site, such as which pages are viewed. These are set only if you accept them through the cookie banner.

I do not use cookies for advertising or to track you across other websites. You can accept or decline non-essential cookies when you first visit, and you can also manage or delete cookies at any time through your browser settings.

Questions, concerns and complaints

If you have any questions about this notice or how I handle your information, please contact me at office@jeannevorsternaidoo.com or by post. I would always welcome the opportunity to address any concern directly.

You also have the right to complain to the Information Commissioner's Office, the UK's independent authority for data protection, at ico.org.uk or on 0303 123 1113.

I review this notice regularly and will update it if my practice changes. The date at the top shows when I last revised it.