This privacy notice explains how I collect, use, store and protect personal information in my therapy practice.
I am Nina Jellinek, a counsellor working online. I am the data controller for personal information I collect through Nina Jellinek Counselling.
This means I am responsible for deciding how personal information is used and for keeping it safe.
If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:
Email: nina@jellinek.com
Phone: 07891 024 100
Website: NinaJellinek.com
This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.
I may collect and use the following information.
When you contact me, I may collect:
If we arrange an initial call or begin therapy, I may also collect:
Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion, or other sensitive areas where these are relevant to therapy.
I only collect information that is necessary for providing therapy safely, ethically, and professionally.
I use your personal information to:
I do not sell your personal information.
Under UK GDPR, I need a lawful basis for using personal information.
For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.
Where I process special category data, such as information about health or mental health, I must also identify a separate condition under Article 9 UK GDPR before I begin that processing and reflect this in my privacy information. Depending on the reason for processing, I may also need to meet additional conditions and safeguards under the Data Protection Act 2018.
Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.
Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical, or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.
There are some limits to confidentiality. I may need to share information if:
Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.
Like other ethical therapists, I use clinical supervision to support safe and effective practice.
In supervision, I may discuss aspects of client work to support safe and effective practice. I aim to minimise identifying detail where possible and appropriate, and my supervisor is also bound by confidentiality and professional standards.
I keep brief clinical notes to support safe and ethical therapy. These are usually factual, proportionate, and relevant to the work.
Clinical records may include:
I do not aim to keep a full transcript of sessions.
I keep information only for as long as necessary for the purpose for which it was collected. Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person. As a general guide:
There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.
Your information may be stored in the following systems:
I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access, and secure storage.
Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.
If we work online, sessions will take place using Zoom. I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted.
Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.
I do not record, transcribe, or use AI tools to process therapy sessions.
I may use digital tools for general practice administration, writing, planning or education. Where I do, I avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.
When you visit NinaJellinek.com, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics, or cookie tools.
My website is hosted by Timpani Group Ltd. The website may use cookies or similar technologies to make the site work, improve performance, understand visitor behaviour, or support security.
You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will endeavour to make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.
I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate, and lawful:
Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.
I aim to have arrangements in place so that clients can be contacted if I die or become seriously incapacitated.
This may involve a trusted professional colleague or clinical executor having access to the minimum information needed to contact current clients and manage records appropriately. That person would be bound by confidentiality, would only access information if necessary, and would not take on an ongoing therapeutic role unless separately agreed and appropriate.
Under UK data protection law, you have rights over your personal information. These may include the right to:
Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.
If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.
If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.
Please include:
I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.
If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:
Information Commissioner’s Office Website: www.ico.org.uk Telephone: 0303 123 1113 |
If you are not satisfied with my response, you can also contact my professional membership body here:
I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.
The latest version will be available on my website.