Privacy Policy

Your privacy

I take the privacy and security of your personal information seriously. This privacy policy explains what information I collect, why I collect it, how I use and store it, and the circumstances in which I may need to share it.

I am committed to handling your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the professional standards that apply to my practice as an HCPC-registered Art Psychotherapist.

Who is responsible for your information?

I am the data controller for the personal information I hold about you.

Name: Jessica Kirkpatrick
Practice: JK Art Therapy
Email: mjkirkpatrick@proton.me
Website: jkarttherapy.com

If you have any questions about how I use your information, or would like to exercise any of your data protection rights, you can contact me using the details above.

What information do I collect?

In the course of providing therapy, I may collect information including:

  • your name and contact details;

  • your address and, where relevant, your location during online sessions;

  • emergency contact details;

  • information you provide about your mental or physical health;

  • relevant medical, social or personal history;

  • information discussed during therapy sessions;

  • brief clinical or administrative notes relating to our work together;

  • appointment, attendance and payment information;

  • correspondence between us; and

  • artwork or photographs of artwork where these form part of our therapeutic work.

Some of the information you share with me may constitute special category data, including information relating to your physical or mental health. This information is subject to additional protections under data protection law.

I aim to collect only information that is relevant and necessary for providing safe and appropriate therapy.

Why do I use your information?

I use your information to:

  • provide and manage your therapy;

  • communicate with you about appointments and practical matters;

  • maintain appropriate clinical records;

  • assess and manage risk and safeguarding concerns;

  • meet my professional, legal and regulatory responsibilities;

  • seek supervision and professional consultation where appropriate;

  • process payments and maintain financial records;

  • respond to requests about your personal information; and

  • maintain the security and administration of my practice.

I do not use your therapy information for advertising or sell your personal information to third parties.

How is your information stored?

I take reasonable and appropriate steps to protect your information from loss, misuse, unauthorised access or disclosure.

Electronic information is stored using password-protected and appropriately secured systems. Where third-party services are used to support my practice, I take reasonable steps to ensure that they provide appropriate security and data protection.

Paper records, where used, are stored securely and are not left accessible to others.

When using online therapy, sessions take place through Doxy.me, a platform designed for healthcare communication. Please contact me if you would like further information about the platform or the practical steps you can take to protect your privacy online.

Who might I share your information with?

Your information is treated as confidential. I will not routinely share information about you with other people without your knowledge and, where appropriate, your consent.

There are circumstances in which information may need to be shared, including:

  • with my clinical supervisor, where relevant to professional supervision and in accordance with professional confidentiality requirements;

  • with another professional or service involved in your care, where this is appropriate and you have given consent;

  • where I have a professional, ethical or legal responsibility to share information in order to protect you or another person from serious harm;

  • where there are safeguarding concerns relating to a child or another person at risk; or

  • where disclosure is otherwise required or permitted by law.

Where information is shared, I will aim to share only what is necessary and proportionate to the situation. My supervisor is also bound by professional confidentiality requirements.

How long do I keep your information?

I retain clinical and administrative records for the period required by relevant professional, legal and insurance requirements.

My current retention period is seven years. Please confirm this period against your record-retention policy, professional guidance and insurance requirements before issuing this pack.

Once information is no longer required, it will be securely deleted or destroyed.

Your rights

Under data protection law, you have a number of rights in relation to your personal information. Depending on the circumstances and the lawful basis for processing, these may include the right to:

  • ask for a copy of the personal information I hold about you;

  • ask me to correct inaccurate or incomplete information;

  • ask me to restrict how your information is used;

  • object to certain types of processing;

  • request deletion of your information in certain circumstances; and

  • request transfer of certain information to another organisation where the right to data portability applies.

These rights are not absolute and there are circumstances in which I may be legally entitled or required to retain or use information. If you would like to exercise any of your rights, please contact me using the details above.

Lawful basis for processing

Before issuing this pack, add a short explanation of the Article 6 lawful basis or bases you rely on and the Article 9 condition for processing health information under UK GDPR. These should be confirmed against your actual practice and data-protection advice rather than guessed or copied from a template.

Data breaches

I take appropriate measures to protect your information. If a personal data breach occurs, I will assess it and take the appropriate steps in accordance with data protection requirements, including notifying the Information Commissioner's Office (ICO) and/or affected individuals where this is legally required.

Complaints about data protection

If you have concerns about how I have handled your personal information, I would encourage you to contact me first so that I have an opportunity to address your concerns.

You also have the right to make a complaint directly to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Information is available at: https://ico.org.uk/make-a-complaint/

Keeping this policy up to date

I may occasionally update this privacy policy to reflect changes in my practice, technology, professional requirements or data protection law. The most recent version will be made available to clients and on my website where appropriate.

Last updated: 12 October 2026