Last updated: October 2026

Who I am

I'm Jess Henley, a BACP-accredited psychotherapist and EMDR Accredited Therapist, practising as Henley Psychotherapy.

I'm responsible for the personal information collected and held in connection with my practice. For the purposes of UK data protection law, I'm the data controller.

If you have any questions about how your information is used or stored, you can contact me at:

Email: henleypsychotherapy@gmial.com
 
What information I collect

When you contact me through my website, by email or by telephone, I may collect your name, contact details and any information you choose to share about why you're seeking therapy.

If we begin working together, I may also collect information relevant to our therapeutic work, including your personal history, health and wellbeing, and clinical notes.

I only collect information that is necessary for providing therapy, managing my practice and meeting my professional responsibilities.

How I use your information

I use personal information to respond to enquiries, arrange appointments, provide psychotherapy and EMDR, maintain clinical records, communicate with clients, manage payments and meet my legal and professional obligations.

I do not sell your information or use it for marketing.

Legal basis for processing your information

Under UK GDPR, I process personal information where necessary to take steps towards entering into a therapeutic agreement, fulfil that agreement, comply with legal obligations or pursue legitimate interests in running my practice responsibly.

Information about mental health is classed as special category data and receives additional protection. Where applicable, I process this information because it is necessary for providing health-related care or treatment, subject to my professional duty of confidentiality and relevant legal safeguards.

Confidentiality

What you share with me is treated confidentially in accordance with my professional and ethical responsibilities.

There are limited circumstances in which I may need to disclose information, such as a serious concern about someone's safety or a legal requirement to share information. Wherever possible and appropriate, I would discuss this with you first.

I also attend professional supervision. When discussing my clinical work, I protect clients' identities wherever possible, and my supervisor is bound by confidentiality.

How your information is stored

Handwritten clinical notes are kept in a locked cabinet. Electronic records are password-protected, with access restricted.

I use a dedicated professional Gmail account for correspondence relating to my practice and Wix to receive enquiries through my website contact form.

Therapy sessions usually take place online via Zoom. If there are technical difficulties, I may use WhatsApp video or conduct a session by telephone instead.

These service providers may process limited personal information needed to deliver their services, subject to their own privacy and security arrangements.

How long I keep your information

Clinical records: I retain adult client clinical records securely for seven years after our therapeutic work ends, after which they are confidentially destroyed or securely deleted, unless there is a legal or professional reason to retain them for longer.

Initial enquiries: If you contact me about therapy but we do not go on to work together, I retain our correspondence for up to 12 months after our last contact, after which it is securely deleted, unless there is a legitimate reason to keep it for longer.

Financial records: I retain financial records for the period required by applicable tax and accounting rules.

Sharing your information

I do not routinely share your personal information with other professionals or organisations without an appropriate legal basis.

Information may be shared where necessary to meet legal obligations, respond to serious safeguarding concerns or obtain confidential professional supervision.

Providers involved in running my practice, including Wix, Google and video-conferencing services, may process information in accordance with their respective roles and privacy arrangements.

Some providers may process information outside the UK. Where international transfers take place, the relevant UK data protection safeguards apply.

Your rights

Under UK data protection law, you have rights concerning your personal information. Depending on the circumstances, these include the right to access your information, request corrections, ask for deletion or restriction of processing, and object to certain uses.

Some rights are subject to exceptions, including where information must be retained for legal or professional reasons.

You can contact me using the email address above if you would like to exercise your rights.

You also have the right to raise a concern with the Information Commissioner's Office at www.ico.org.uk.

Cookies

My website is hosted by Wix, which uses cookies and similar technologies to operate the website and provide its services.

You can manage your preferences for optional cookies through the cookie consent banner. Further information is available in my Cookie Policy.

Changes to this policy

I may update this Privacy Policy to reflect changes in my practice, the services I use or relevant legal requirements. The latest version will be available on this website.