Privacy Policy and Data Retention Statement

Effective from 25th May 2018

I aim to be fully compliant with current GDPR legislation and to let you know how I use and protect any data you give to me.  GDPR replaces the previous Data Protection Act.  I wish to be transparent with regard to the processes I have in place.  Identifiable information, if shared, will only be used in accordance with this privacy statement.  I follow guidance from my governing body IACP and my insurer Balens.

As a Private Practitioner I am considered to be both the Data Processor and Data Controller in my practice.   As the Data Controller, I process some of your personal data.  During the assessment process, information such as next of kin, GP, medication and in some cases family information may be gathered in written form and held.  This is then coded and securely stored on a password-protected PC with encrypted backup.  Nobody but myself can access this information and the initial paper version is shredded immediately once typed up.

Data Processing means obtaining, recording or holding information.  The definition is very wide, and most of what I do involves a degree of processing.  I process the personal data I have collected as controller.  I maintain records of personal data and processing activities and hold responsibility should there be a breach.


This is a primary concern and as my client, I hope to offer you choice and control.  This means that you have the right to withdraw consent at any time for me to hold your data.  As a Therapist, who occasionally uses creative interventions, I want to ensure you that any drawings, writing or artwork done in the session are yours.  If you wish not to take these materials with you after the relevant session, I will store the material safely and anonymised for the duration of our time together, and following the ending of our sessions, I will shred the work in a timely manner.  I will never use any of your data/artwork for writing, publishing, and research or training purposes.

I have weekly supervision to support and ensure my practice is safe.  Supervision is a legal and ethical requirement for all accredited therapists.  When I share client material, this is always done carefully in order to fully protect your identity.

Note Keeping

I sometimes take very brief process and content notes to help me reflect upon our session and connect sessions.  When I do so, this is always typed up and kept on a password protected computer.  I hold this minimal information, anonymised, for a maximum of seven years, after which it is deleted securely.  You have a right to see the data I hold about you should you wish to.  You can also ask me to delete all or any of the information that I hold.  There are however some details I need to keep due to legal and professional obligations.

Data Storage

I promise to keep all sensitive data safely.  This involves my anonymising (via letters and numbers), using passwords and encrypting documents.  I keep all sensitive data on a password protected PC and in password protected files which nobody else is able to access.  I dispose of data by permanent deletion and shredding. I dispose of client emails on a yearly basis, unless there has been a specific request to receive a newsletter in which case I will store your email on MailChimp, through which there is always an ‘opt out.’

Whilst we work together, I will store your first name and phone number on my smartphone as ‘Client (name).’  I will also store your email address.  I will only contact you concerning appointments or to send you information I may have promised during a session.  When we agree to discontinue working, I will delete your number.

Social Media

I do not engage with any of my clients via Social Media.  I will not follow you on social media, nor will I accept friend requests to my private accounts.   In terms of instant messaging services, I will respond to messages through my business page Soul Focus Therapy on Facebook Messenger for new clients only.  Following initial contact, I will respond to messages about appointments by text or by email.  I will also respond to WhatsApp messages only when this is directly concerning an appointment.

In the event of a complaint

Please contact me directly if you wish to make a complaint about the way your data is stored and used.  If we cannot resolve this, you could then contact  Therapists are not obliged to register with Data Protection Ireland (as of May 2018) but this may change.


Having read and understood the above, I hope that you will be satisfied with regard to consent and data and privacy policies and that we agree on why I have collected and kept specific data and what I do with it.  Remember you may withdraw consent at any time without detriment.  Whilst we work together, I will regularly review consent with you to check that the relationship, the processing and the purposes have not changed.

Signing the Policy

If we begin work together after 25th May 2018, either face to face or online, I will send a copy of this policy for you to sign or will ask for your consent via email.


Kind Regards,

Jeni Whittaker

Soul Focus Therapy