Lisa Jones
Privacy Policy
Last updated: 8 June 2026
www.lisa-jones.co.uk

1. Introduction
Lisa Jones (“we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal information when you use our website at www.lisa-jones.co.uk, book our services, or communicate with us.
This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Please read this policy carefully. If you have any questions, our contact details are at the end of this document.
Lisa Jones is the data controller responsible for your personal data. We are registered with the Information Commissioner’s Office (ICO). Our ICO registration number is available upon request.

2. What Personal Data We Collect and Why
Personal data means any information that can identify a living individual. We may collect and process the following categories:

Communication Data
Any communications you send us through our contact form, email, telephone, social media, or any other channel. We use this to respond to your enquiries, keep records, and where necessary, establish, pursue, or defend legal claims.
Lawful basis: Legitimate interests (to communicate with you and maintain records).

Client and Appointment Data
When you book a therapy session, coaching appointment, training, or supervision, we collect your name, email address, telephone number, billing details, appointment history, and session-related notes. This includes data processed via Kiku, our practice management platform.
Lawful basis: Performance of a contract; and for therapy-related data, your explicit consent and/or the provision of health care services under Article 9(2)(h) UK GDPR.

Health and Sensitive Data
As a therapist and counsellor, we may collect and process sensitive personal data relating to your mental and physical health as part of providing our services. This data is handled with the highest level of care and confidentiality.
Lawful basis: Explicit consent and/or the provision of health or social care services. You will always be asked to consent before we process sensitive data of this kind.
Your therapy and session notes are held securely and confidentially in line with our professional obligations as a senior accredited therapist. They are never shared without your consent, except in the limited circumstances required by law or our regulatory body.

User and Technical Data
Information about how you use our website, including your IP address, browser type, pages visited, time on site, and referring URL. This data is collected automatically via cookies and analytics tools.
Lawful basis: Legitimate interests (to improve our website and understand how it is used); consent where required by PECR.

Marketing Data
Your preferences for receiving marketing communications from us. We will only send you marketing where you have given your consent or where we have a legitimate interest to do so.
Lawful basis: Consent or legitimate interests.

What We Do Not Collect
We do not carry out automated decision-making or profiling. We do not collect data about race, ethnicity, political opinions, trade union membership, genetic data, or information about criminal convictions unless there is a specific legal basis and you have been clearly informed.

My-Therapy-Suite Practice Management Platform

We use My-Therapy-Suite (mytherapysuite.com) to manage bookings, appointments, payments, client records, and secure communication. My-Therapy-Suite is a UK-based, GDPR-compliant practice management system designed specifically for therapists.

When you book with us or use the client portal, My-Therapy-Suite processes your data on our behalf as a data processor. This includes:

– Your name, contact details, and appointment information
– Intake forms and consent forms you complete before your first session
– Appointment reminders sent to you by email or text
– Invoicing and payment processing (card details are handled securely and not stored by us directly)
– Secure messaging between you and Lisa Jones through the client portal
– Session notes and records relevant to your care

My-Therapy-Suite stores all data on UK-based servers and uses encryption to protect it. We have a data processing agreement in place with My-Therapy-Suite, as required by UK GDPR.

For more information on how My-Therapy-Suite handles data, please visit mytherapysuite.com/Privacy-policy.

4. How We Collect Your Data
We collect data in the following ways:
– Directly from you: when you complete forms on our website, book an appointment, send us an email, or contact us by phone or social media
– Automatically: via cookies and analytics tools when you browse our website (see our Cookie Policy for details)
– Via My Therapy Suite: when you register for or use the client portal
– From third parties: analytics providers such as Google, who may be based outside the UK/EEA — see Section 6 on international transfers

For full details of how we use cookies, please read our Cookie Policy at www.lisa-jones.co.uk/cookie-policy.

5. Marketing Communications
We will only send you marketing communications where you have given your consent, or where we have a legitimate interest to do so under PECR (for example, if you are an existing client and we are contacting you about similar services).
You can opt out of marketing communications at any time by:
-Clicking the unsubscribe link in any marketing email
– Emailing us at hello@lisa-jones.co.uk
Opting out of marketing will not affect any other communications we are required to send you as part of our service to you.

6. Who We Share Your Data With
We may share your personal data with the following categories of recipient, strictly on a need-to-know basis and only where there is a lawful basis to do so:
– Service providers: including My Therapy Suite (practice management), payment processors, IT support, and website hosting providers
– Professional advisers: lawyers, accountants, and insurers where necessary
– Regulatory or government bodies: where required by law or our professional obligations
– Supervisors: as part of our professional clinical supervision (your data is anonymised wherever possible)
We will never sell your personal data to third parties. We require all third parties who process data on our behalf to respect the security of your data and comply with applicable data protection law.

7. International Data Transfers
Some of our service providers (for example, analytics providers such as Google) may be based outside the UK or European Economic Area (EEA). Where this is the case, we ensure appropriate safeguards are in place, including:
– Transfers to countries deemed adequate by the UK government or European Commission
– Use of UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs)
– Transfers only to providers who demonstrate equivalent protections to those required under UK GDPR
Please note: the EU-US Privacy Shield framework referenced in our previous policy has been invalidated. We have updated our arrangements accordingly. If you have questions about specific transfers, please contact us.

8. Data Security
We take the security of your personal data seriously. Measures we have in place include:
Encrypted storage of client records via My Therapy Suite, with two-factor authentication
Restricted access to personal data on a need-to-know basis
Secure email and communication practices
Regular review of our data handling procedures
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

9. How Long We Keep Your Data
We retain your personal data only for as long as necessary. Our retention periods are guided by:
– Legal requirements: HMRC requires us to keep financial records for 6 years from the end of the relevant tax year
– Professional obligations: our regulatory body may require us to keep therapy and clinical records for a minimum period (typically 5 years for adult clients, or until a minor client’s 25th birthday)
Where data is no longer needed, it is securely deleted or anonymised. Anonymised data may be retained for research or statistical purposes.

10. Your Rights Under UK GDPR
You have the following rights in relation to your personal data:
– Right of access: to request a copy of the data we hold about you
– Right to rectification: to ask us to correct inaccurate data
– Right to erasure: to ask us to delete your data in certain circumstances
– Right to restriction: to ask us to limit how we use your data
– Right to data portability: to receive your data in a structured, machine-readable format
– Right to object: to object to processing based on legitimate interests
– Right to withdraw consent: at any time, where processing is based on consent

To exercise any of these rights, please contact us using the details at the end of this policy. We will respond within one month. There is no charge for most requests, though we may charge a reasonable fee for requests that are manifestly unfounded or excessive.

We may need to verify your identity before processing your request.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
www.ico.org.uk
We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO.

11. Third-Party Links
Our website may contain links to third-party websites, including My Therapy Suite, Calendly, and others. Once you leave our site, this Privacy Policy no longer applies. We encourage you to read the privacy policy of any website you visit.

12. Cookies
We use cookies on our website. For full details of the cookies we use, why we use them, and how to control your preferences, please read our Cookie Policy at www.lisa-jones.co.uk/cookie-policy.

13. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. Where changes are significant, we will take reasonable steps to notify you (for example, by email or a prominent notice on our website).
We recommend you review this policy periodically.

14. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please get in touch:
Lisa Jones
www.lisa-jones.co.uk/contact
hello@lisa-jones.co.uk