Privacy Policy and Data Retention Statement

Effective from 25th May 2018

I aim to be fully compliant with current GDPR legislation and to let you know how I use and protect any data you give to me.  GDPR replaces the previous Data Protection Act.  I wish to be transparent with regard to the processes I have in place.  Identifiable information, if shared, will only be used in accordance with this privacy statement.  I follow guidance from my governing bodies UKCP and IACP and my insurers Balens.

As a Private Practitioner I am considered to be both the Data Processor and Data Controller in my practice.   As the Data Controller, I process some of your personal data.  During the assessment process, information such as next of kin, GP, medication and in some cases family information may be gathered in written form and held.  This is then anonymised, coded and securely stored on a password-protected PC with encrypted backup.  Nobody but myself can access this information and the initial paper version is shredded immediately once typed up.

Data Processing means obtaining, recording or holding information.  The definition is very wide, and most of what I do involves a degree of processing.  I process the personal data I have collected as controller.  I maintain records of personal data and processing activities and hold responsibility should there be a breach.


This is a primary concern and as my client, I hope to offer you choice and control.  This means that you have the right to withdraw consent at any time for me to hold your data.  As a Therapist, who occasionally uses creative interventions, I want to ensure you that any drawings, writing or artwork done in the session are yours.  If you wish not to take these materials with you after the relevant session, I will store the material safely and anonymised for the duration of our time together, and following the ending of our sessions, I will shred the work in a timely manner.  I will never use any of your data/artwork for writing, publishing, and research or training purposes.

I have weekly supervision to support and ensure my practice is safe, as well as bi-monthly supervision for my separate clinical practice at Let’s Get Talking Galway.  Supervision is a legal and ethical requirement.  When I share client material, this is always done confidentially, protecting your identity.

Note Keeping

I sometimes take very brief process and content notes to help me reflect upon our session and connect sessions.  When I decide to do so, this is always typed up and kept on a password protected computer, and never handwritten.  I hold this minimal information, anonymised, for seven years, after which it is deleted securely.  You have a right to see the information I hold about you should you wish to.  You can also ask me to delete all or any of the information that I hold.  There are however some details I need to keep due to legal and professional obligations.

Data Storage

I promise to keep all sensitive data safely.  This involves my anonymising (via letters and numbers), using passwords and encrypting documents.  I keep all sensitive data on a password protected PC and in password protected files which nobody else is able to access.  I dispose of data by permanent deletion and shredding. I dispose of client emails on a yearly basis, unless there has been a specific request to receive a newsletter in which case I will store your email on MailChimp, through which there is always an ‘opt out.’

Whilst we work together, I will store your first name and phone number on my smartphone as ‘Client X.’  I will only contact you in response to you or concerning appointments.  When we agree to discontinue working, I will delete your number.

Social Media

I do not engage with any of my clients via Social Media.  I will not follow you on social media, nor will I accept friend requests to my private accounts.   Social Media includes WhatsApp and any other instant messaging service, EXCEPTING responding to messages through my business page Soul Focus Therapy on Facebook Messenger for new clients only.  Following initial contact, I will respond to messages about appointments through my website, by text or by email.

In the event of a complaint

Please contact me directly if you wish to make a complaint about the way your data is stored and used.  If we cannot resolve this, you could then contact  Therapists are not obliged to register with Data Protection Ireland (as of May 2018) but this may change.

Clinical Will

In the event of a sudden cessation of practice e.g., through an accident or death, I will be appointing a professional executor who manages things on my behalf.  This is arranged for your welfare as my client and every step is taken to ensure GDPR standards are met.


Having read and understood the above, I hope that you will be satisfied with regard to consent and data and privacy policies and that we agree on why I have collected and kept specific data and what I do with it.  Remember you may withdraw consent at any time without detriment.  Whilst we work together, I will regularly review consent with you to check that the relationship, the processing and the purposes have not changed.

Signing the Policy

If we begin work together after 25th May 2018, either face to face or online, I will send a copy of this policy for you to sign.


Kind Regards,

Jeni Whittaker

Soul Focus Therapy