Data Controller: Jo Woodman – Sakura Therapy
Your privacy is important to me. This notice explains how I collect, use, store and protect your personal information when you access psychotherapy, counselling or clinical supervision through Sakura Therapy.
Information I may collect
To provide a safe and professional service, I may collect information including:
● Your name, contact details and date of birth
● Emergency contact and GP details where appropriate
● Information you provide on assessment, consent or therapy forms
● Relevant information about your wellbeing, personal history and circumstances
● Brief clinical or supervision notes
● Appointment and attendance information
● Payment and invoicing records
● Emails or other correspondence relating to our work together
Some information shared within therapy may be classed as special category data under UK GDPR, including information relating to your physical or mental health.
I only collect information that is reasonably necessary for providing and managing the service.
Why I use your information
Your information may be used to:
● Provide psychotherapy, counselling or clinical supervision
● Communicate with you about appointments
● Maintain appropriate professional records
● Manage payments and accounts
● Support safe and ethical practice
● Meet professional, insurance, safeguarding and legal obligations
Lawful basis for processing
I process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Depending on the information and circumstances, my lawful bases may include contract, legitimate interests, and legal obligation.
Where I process special category health information, this is done under UK GDPR provisions relating to the provision of health or social care services, alongside other applicable conditions under data protection law.
Professional standards, insurance and regulatory compliance
I am registered with the Information Commissioner’s Office (ICO) as a data controller and comply with UK data protection requirements. Registration reference ZB501220.
I work in accordance with the ethical frameworks and professional standards of the National Counselling and Psychotherapy Society (accredited member) and British Association Counsellors and Psychotherapy (individual member).
I am insured through Holistic Insurance, which requires appropriate record-keeping, confidentiality, and data protection standards.
Confidentiality and sharing information
What you share with me is treated as confidential.
I will not routinely share your personal information with other individuals or organisations without your knowledge or consent.
There are limited circumstances where confidentiality may need to be broken, for example where:
● There is a serious concern about your safety or the safety of another person
● There is a safeguarding concern involving a child or vulnerable adult
● I am legally required to disclose information
● Disclosure is otherwise necessary to meet my professional, ethical, or legal responsibilities
Where possible and appropriate, I will aim to discuss this with you first.
As part of ethical practice, I attend clinical supervision. Client work may be discussed in supervision, but identifying information is minimised wherever possible.
How your information is stored
I take reasonable and appropriate steps to keep your personal information secure.
Electronic records and forms are stored using secure, password-protected systems, including the Konfidens practice management platform, a secure, GDPR-aligned system used to support safe handling of client data.
In addition, some written notes may be kept in paper form. These are stored securely in a locked cabinet within a locked room in an alarmed building at Cromford Mills, with access strictly limited to me.
I do not sell your personal information or use therapy data for marketing purposes.
How long information is kept
Client records are retained only for as long as reasonably necessary to meet professional, legal, insurance, and regulatory requirements, typically 7 years after the end of therapy (or longer where required by law or insurance guidance).
After this period, records are securely deleted or destroyed.
Your rights
Under UK data protection law, you may have the right to:
● Request access to the personal data I hold about you
● Request correction of inaccurate information
● Request deletion or restriction of your data in certain circumstances
● Object to certain types of processing
● Request data portability where applicable
● Raise a concern about how your data has been handled
Some rights may be limited by legal, insurance, or professional record-keeping requirements.
Contact and concerns
If you have any questions about how your personal information is used, please contact:
Jo Woodman – sakuratherapy@hotmail.com
If you are unhappy with how your data has been handled, you also have the right to raise a concern with the Information Commissioner’s Office (ICO).
Agreement
By submitting your information through Sakura Therapy’s forms, you acknowledge that you have been given the opportunity to read and understand this Privacy & Data Protection Notice.
Last reviewed: August 2026