Privacy Policy

How we handle your information

These documents explain how WST Ltd collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.

Last updated: 8 September 2026

Who I Am

This privacy policy explains how I, Denise Jemil of WST Ltd, collect, use, store, and protect your personal data when you engage with my therapy practice.

Practice name: WST Ltd

Therapist: Denise Jemil

Contact email: denise [at] wstltd.co.uk (please replace [at] with @ when emailing)

ICO registration number: ZB183669

I am registered with the Information Commissioner's Office as a data controller. I am committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What Personal Data I Collect

I collect and process the following categories of personal data:

Contact and identification information:

Your name, address, telephone number, and email address
Emergency contact details
Parent or guardian contact details (for clients under 18)

Health and therapy-related information:

Presenting issues and reasons for seeking therapy
Relevant medical history and current health conditions
Medication you are taking
Session notes recording our therapeutic work together
Treatment plans and progress notes
Risk assessments
Information about previous therapy or mental health support

Administrative information:

Appointment dates and times
Invoices and payment records
Correspondence between us
Consent forms and agreements

Special Category Data

Health and therapy-related information constitutes "special category data" under Article 9(1) of the UK GDPR. This includes any information relating to your physical or mental health. Special category data receives enhanced protection under data protection law, and I process it only under the strict conditions set out in the "Why I Process Your Data" section below.

Working with Children and Young People

My practice works primarily with clients under 18. When working with children and young people, I also collect:

Parent or guardian consent forms
Information about family circumstances relevant to therapy
School or educational setting details where appropriate
Safeguarding-related information

How I Collect Your Data

I collect your personal data directly from you in the following ways:

At first contact — when you enquire about therapy by telephone or email
During intake — when you complete initial assessment forms and provide background information before we begin working together
During sessions — through information you share with me in the course of our therapeutic work together
Via email or telephone — through ongoing correspondence about appointments, administrative matters, or therapeutic content between sessions

For clients under 18, I collect information from both the young person and their parent or guardian, as appropriate to the child's age and level of understanding.

I do not collect personal data about you from third parties unless you have given explicit consent for this, or in exceptional circumstances such as safeguarding referrals.

Why I Process Your Data — Lawful Basis

To process your personal data lawfully, I rely on the following legal bases under the UK GDPR:

Article 6 Basis (General Processing)

Article 6(1)(f) UK GDPR — legitimate interests.

Specifically, my legitimate interest in retaining information necessary to provide you with the best possible treatment and to comply with my professional indemnity insurance requirements as a practitioner in private practice.

This includes maintaining accurate records of our therapeutic work to ensure continuity of care, responding appropriately to any future queries or complaints, and meeting the requirements of my professional indemnity insurance.

Article 9 Basis (Special Category Data)

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health care treatment by a health professional subject to a professional obligation of confidentiality.

The additional DPA 2018 Schedule 1 condition is Part 1, paragraph 2 (health or social care).

My professional obligation of confidentiality is grounded in the common-law duty of confidence owed by health and wellbeing practitioners to their clients, and the standard professional practice expected of practitioners in private practice.

Processing Children's Data

When working with clients under 18, I rely on the same lawful bases as above. Additionally:

For children who can consent for themselves (Gillick competent): Where a child demonstrates sufficient understanding and maturity to make their own decisions about therapy — typically from around age 12 to 16, depending on the individual child — I may accept their consent directly. I assess Gillick competence on a case-by-case basis.
For younger children or those who are not Gillick competent: I require consent from a parent or person with parental responsibility before therapy begins. I explain clearly to both the parent and the child what information I will collect and how it will be used.

Even where a parent has provided consent, the child remains the data subject and has their own data protection rights.

Professional Obligations and Continuing Professional Development

I engage in ongoing continuing professional development (CPD) appropriate to my practice to maintain and enhance my skills.

I am not required to attend clinical supervision, but I may choose to engage in peer consultation to support my professional practice. Where I do:

Your name and any identifying details are never shared
I use anonymised or pseudonymised case material only
Any peer consultant I work with is bound by their own professional confidentiality obligations

Your confidentiality is maintained at all times during any professional development or consultation activities.

Clinical Will — What Happens to Your Records If I Am Unable to Practise

I am currently putting arrangements in place to appoint a clinical executor — a trusted fellow professional who would manage my client records securely in the event that I become incapacitated or die unexpectedly.

Once these arrangements are finalised, I will update this policy and inform current clients.

The purpose of a clinical will is to ensure that:

You would be contacted appropriately and sensitively
Your records would be handled securely and confidentially
You would receive support in finding alternative therapeutic provision if needed
Your records would continue to be retained for the required retention period and then securely destroyed

Who I Share Your Data With

I treat everything you share with me in therapy as confidential. However, I use certain third-party services to support my practice, and the following may process your data on my behalf:

Third-party service providers:

Zoom (Zoom Video Communications Inc) — for video therapy sessions
Microsoft Teams (Microsoft Corporation) — for video therapy sessions
Google Meet (Google LLC) — for video therapy sessions
Google Calendar (Google LLC) — for appointment scheduling

Each of these services is bound by a data processing agreement and publishes its own privacy policy with further detail.

Other parties with limited access:

An external accountant or bookkeeper — has access to invoice data only (your name and payment information for financial record-keeping purposes). They do not have access to any clinical information or session notes.
Administrative help — has access to calendar and contact details only for appointment scheduling purposes. They do not have access to clinical notes or health information.

Both the accountant or bookkeeper and administrative support are bound by confidentiality obligations.

I never sell your personal data.

International Data Transfers

The following third-party services I use may transfer personal data outside the United Kingdom:

Zoom (Zoom Video Communications Inc, USA)
Microsoft Teams (Microsoft Corporation, USA)
Google Meet (Google LLC, USA)
Google Calendar (Google LLC, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

The USA does not currently have a UK adequacy decision. Details of these safeguards are set out in each provider's own privacy documentation.

How Long I Keep Your Data

I retain your personal data for the following periods:

Therapy records (adult clients) - 7 years after our last session

In line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

Therapy records (clients under 18 at time of therapy) - Until the client reaches the age of 25

To allow the young person to access their records as an adult if they wish, and to meet professional indemnity requirements.

Financial records - 6 years

HMRC legal requirement

Website enquiries (non-clients)12 months

Legitimate interest in responding to enquiries

Extended Retention for Clients Under 18

If you were under 18 when we worked together, I retain your therapy records until you reach age 25. This extended retention period ensures that:

You can request access to your records once you become an adult
Records are available should any safeguarding concerns emerge later
Professional indemnity insurance requirements are met

After the applicable retention period ends, records are permanently deleted.

Your Rights Under UK GDPR

You have the following rights regarding your personal data. These rights apply whether you are an adult client, a young person, or a parent or guardian.

Right to be informed

You have the right to know how I collect and use your personal data. This privacy policy fulfils that requirement.

Right of access

You can request a copy of the personal data I hold about you. This is known as a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.

Right to rectification

If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct or complete it.

Right to erasure

You can ask me to delete your personal data in certain circumstances. However, this right is not absolute — I may need to retain your records until the end of the applicable retention period where this is required by professional guidelines, professional indemnity insurance requirements, or law.

Right to restrict processing

You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.

Right to data portability

Where technically feasible, you can ask me to provide your data in a structured, commonly used format so you can transfer it to another provider.

Right to object

You can object to processing based on legitimate interests. I will consider your objection and respond, though I may be able to demonstrate compelling legitimate grounds to continue processing.

Rights related to automated decision-making

I do not use automated decision-making or profiling in my practice.

Children's Rights

Children and young people have the same data protection rights as adults. Where a child is Gillick competent, they can exercise these rights themselves. For younger children, a parent or guardian may exercise rights on their behalf — but the child remains the data subject.

If a parent requests access to records of a child who is currently in therapy and is Gillick competent, I will generally need to consider the child's own views and best interests before disclosing information. The child's right to confidentiality may take precedence.

How to Exercise Your Rights

To exercise any of these rights, please contact me at: denise@wstltd.co.uk

I will respond to your request within one month. If your request is complex or I receive a high volume of requests, I may extend this by a further two months, but I will let you know within the first month.

Data Protection Complaints — Your Right Under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me if you are concerned about how I have handled your personal data.

To submit a complaint:

Visit https://wstltd.policydiary.co.uk (Make a complaint tab)
Or contact me at: denise@wstltd.co.uk

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality Exceptions

Everything you share with me in therapy is treated as confidential. However, there are limited circumstances in which I may need to share information without your consent:

Risk of serious harm

If I believe there is a serious and imminent risk to your life or the life of another person, I may need to share information with appropriate services to help keep you or others safe.

Safeguarding children or vulnerable adults

If I become aware of information suggesting that a child or vulnerable adult is at risk of significant harm, I have a professional and legal duty to share this with the appropriate safeguard.