Privacy Policy

This privacy policy explains how Sarah Jordan Therapy collects, uses, stores and protects your personal information when you use this website, contact me, or receive counselling or psychotherapy services from me.

Last updated: 2 June 2026

1. Who I am

I am Sarah Jordan, a BACP-registered integrative counsellor and psychotherapist practising as Sarah Jordan Therapy (BACP membership number 01026519).

I am the data controller for the personal information described in this policy. If you have any questions about how your data is handled, please contact me:

• Email: hello@sarahjordantherapy.com
• Location: Mount St Denys, Cardiff CF14 0FJ

2. What information I collect

The information I collect depends on how you interact with me:

Website enquiries

If you use the contact form on this website, I collect the information you choose to provide, which may include:

• Your name
• Your email address
• Your phone number (optional)
• Your message and any other details you include

Counselling and psychotherapy

If you become a client, I may collect and hold additional information needed to provide safe and effective therapy. This may include contact details, emergency contact information, relevant health and wellbeing information, session notes, correspondence, and records relating to fees and appointments. Some of this information is special category data (health-related information) under UK data protection law.

Website use

This website does not use analytics or advertising cookies. When you visit the site, my hosting provider may automatically process limited technical information in server logs, such as your IP address, browser type, and the pages requested. The contact page includes an embedded Google Maps map, which may collect information according to Google's privacy policy.

3. How I use your information

I use personal information to:

• Respond to enquiries submitted through the website or by email
• Arrange and manage consultations and therapy sessions
• Provide counselling and psychotherapy services
• Maintain appropriate clinical and administrative records
• Meet professional, legal and regulatory obligations
• Operate and maintain this website securely

I do not sell your personal information and I do not use your information for direct marketing unless you have clearly asked me to contact you in that way.

4. Lawful bases for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, I rely on the following lawful bases:

• Consent — where you have given clear consent, for example when you submit the contact form or agree to therapy and the processing of health-related information
• Contract — where processing is necessary to take steps at your request before entering into a therapy agreement, or to perform that agreement
• Legitimate interests — to respond to enquiries, maintain professional records, and operate this website securely, provided your rights do not override those interests
• Legal obligation — where I am required to process or retain information by law

For special category (health-related) data processed in the course of therapy, I rely on your explicit consent and/or the provision of health or social care, as applicable.

5. Confidentiality in therapy

Confidentiality is fundamental to counselling and psychotherapy. What you share in therapy is treated as confidential, subject to the limits discussed with you at the outset of our work together.

There are limited circumstances in which I may need to share information without your consent, including where there is a serious risk of harm, where child or adult safeguarding concerns arise, or where I am required to do so by law or court order. I work in accordance with the BACP Ethical Framework for the Counselling Professions and will discuss confidentiality with you before or during your first session.

6. Sharing your information

I do not routinely share your personal information with third parties. Information may be shared only where necessary and appropriate, for example:

• With service providers who help me operate this website or send and receive email (such as my website host and email provider), under appropriate confidentiality arrangements
• With supervisors or professional bodies, in anonymised form where possible
• Where required for safeguarding, risk management, or legal reasons
• Where you have asked me to share information or given your consent

This website is hosted by Vercel. Enquiries submitted through the contact form are sent to me by email using the SMTP settings configured for the site. Embedded Google Maps content on the contact page is provided by Google.

7. International transfers

Some service providers I use may process data outside the UK. Where this happens, I take reasonable steps to ensure appropriate safeguards are in place, such as UK adequacy regulations, standard contractual clauses, or equivalent protections required under UK data protection law.

8. How long I keep your information

I keep personal information only for as long as necessary for the purposes described in this policy.

• Website enquiries: typically up to 12 months after our correspondence ends, unless a therapy relationship begins or longer retention is needed
• Client records: in line with professional guidance and good practice for counselling records, generally up to seven years after our work ends for adult clients, and for longer where required for clients who were under 18 when therapy began

When information is no longer needed, it is securely deleted or anonymised.

9. How I protect your information

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, or disclosure. These measures include secure storage of clinical records, password-protected devices, and limiting access to information on a need-to-know basis.

No method of transmission over the internet is completely secure. While I take reasonable care with information sent through the website contact form or by email, you may prefer to share sensitive details after we have made contact and discussed a secure way to communicate.

10. Your rights

Under UK data protection law, you have rights in relation to your personal information, including the right to:

• Request access to the personal information I hold about you
• Ask for inaccurate information to be corrected
• Ask for information to be erased in certain circumstances
• Restrict or object to processing in certain circumstances
• Request a copy of your information in a portable format where applicable
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact me using the details in section 1. I may need to verify your identity before responding. There is no charge for most requests.

Some rights may be limited where information is subject to professional confidentiality, legal privilege, or where retaining records is necessary for legal or professional reasons.

11. Complaints

If you are concerned about how I have handled your personal information, please contact me first so I can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

ico.org.uk/make-a-complaint

If you are receiving therapy from me, you may also raise concerns through my professional body, the British Association for Counselling and Psychotherapy (BACP).

12. Changes to this policy

I may update this privacy policy from time to time. The "Last updated" date at the top of this page will be revised when changes are made. Please check this page periodically for the latest version.