Privacy Policy

Last updated: 30th August 2026

This policy explains what personal information I collect, why I collect it, what I do with it, and what rights you have. It covers people who visit this website, people who contact me with an enquiry, and people who become clients.

If anything here is unclear, please ask me. I would rather explain it than have you agree to something you do not understand.

1. Who I am

I am Jessica Brichto, a self-employed psychotherapist and counsellor practising in Deptford / Greenwich, London and online.

I am the “data controller” for the information described in this policy. That means I decide what information is collected and how it is used, and I am legally responsible for it.

Email: hello@jessicabrichto.com
BACP: Registered Member MBACP, membership number 421292
ICO registration number: ZC234568

2. Information I collect

If you visit this website

This website is built and hosted on Wix. When you visit, Wix automatically collects limited technical information such as your IP address, browser type, device type, the pages you view and the time of your visit. Wix uses cookies and similar technologies to do this. Section 10 explains cookies in more detail.

I do not use this information to identify individual visitors.

If you contact me

If you use the contact form, I collect your first name, last name, email address, and, if you choose to give them, your phone number, how you heard about me, and whatever you write in the message box.

If you email, phone or text me instead, I collect whatever you choose to tell me in that message, along with your contact details.

Please do not include detailed information about your health, history or circumstances in a first enquiry. A short note about what you are looking for is enough. We can talk properly on a call, which is a more private and secure setting than an online form.

If you become a client

Once we start working together, I hold:

your name, contact details and date of birth
your GP details and an emergency contact, where you agree to give them
brief written notes of our sessions
relevant information about your health, wellbeing and personal circumstances, which you share as part of the therapy
a record of appointments, payments and invoices
any correspondence between us

Some of this is what data protection law calls “special category data”, which includes information about physical or mental health, sex life, sexual orientation, ethnicity, religious beliefs and similar. The law gives this information extra protection, and so do I.

3. Why I use your information, and the legal basis for it

Website technical data

Why: To keep the site running, secure and working properly
Legal basis (UK GDPR): Legitimate interests (Article 6(1)(f)): running a functioning, secure website

Enquiry details

Why: To reply to you, arrange an initial call, and decide together whether I am the right person to work with
Legal basis (UK GDPR): Consent (Article 6(1)(a)). Where you volunteer health information in an enquiry, explicit consent (Article 9(2)(a))

Client contact and appointment details

Why: To arrange and deliver sessions
Legal basis (UK GDPR): Performance of a contract (Article 6(1)(b))

Session notes and health information

Why: To provide safe, competent therapy, reflect on the work, and use supervision as I am professionally required to do
Legal basis (UK GDPR): Article 6(1)(b), and Article 9(2)(h) (provision of health or social care by, or under the responsibility of, a person under a duty of confidentiality), read with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018

Payment and invoice records

Why: To take payment and meet tax and accounting obligations
Legal basis (UK GDPR): Legal obligation (Article 6(1)(c))

Records retained after therapy ends

Why: In case of a complaint, insurance claim or legal proceedings
Legal basis (UK GDPR): Legitimate interests (Article 6(1)(f)), and Article 9(2)(f) (legal claims)

Disclosures where someone is at serious risk

Why: To protect life or prevent serious harm
Legal basis (UK GDPR): Vital interests (Article 6(1)(d)), and Article 9(2)(c), or legal obligation where one applies

Where I rely on your consent, you can withdraw it at any time by emailing me. Withdrawing consent does not affect anything already done, and it does not automatically erase records I am required to keep for the reasons set out above.

4. Confidentiality and its limits

What you tell me in sessions is confidential. There are a small number of situations where I may need to break confidentiality, and I will always try to discuss this with you first where it is safe and possible to do so:

where there is a serious and immediate risk to your life or safety, or to someone else’s
where a child or a vulnerable adult may be at risk of harm
where the law requires disclosure, for example under counter-terrorism, money laundering or drug trafficking legislation, or under a court order
where I need to defend myself in legal proceedings or a professional complaint

I discuss my work in regular clinical supervision, which is a professional requirement for all BACP members. My supervisor is also bound by confidentiality. I do not use your full name in supervision.

We will talk through all of this properly before we start, and it will be set out in the agreement we make together.

5. Who else sees your information

I do not sell your information, and I do not share it for marketing.

I use a small number of trusted services to run my practice. These providers process information on my behalf and under contract, and they are not permitted to use it for their own purposes:

Wix (wix.com): website hosting and contact form submissions
Google Workspace: email
Google Workspace: online sessions
Meta: secure WhatsApp messaging
Microsoft / Revolut: payments and invoicing
Fonseka & Co: bookkeeping and tax returns

Beyond that, I may share information:

with my clinical supervisor, as described above
with your GP or an emergency contact, where there is a serious risk to your safety
with my professional indemnity insurer or a legal adviser, if there is a claim or complaint
with BACP, if a complaint is made about my practice
with anyone you have asked me to share it with, in writing

I have arrangements in place so that, if I were to die or become seriously unwell, a trusted colleague (“clinical executor”) would contact my current clients and securely handle my records. They would not read your notes except to the extent necessary to do this.

6. Where your information is stored

Session notes are held in encrypted digital form and are kept separately from your contact details wherever practical.

Some of the services I use, including Wix, may store or process information on servers outside the United Kingdom. Where that happens, those transfers are covered by the safeguards required under UK data protection law, such as the UK International Data Transfer Addendum or a finding of adequacy. You can read Wix’s own privacy notice on their website.

7. How long I keep it

Enquiries that do not lead to therapy: 12 months, then deleted
Client notes and records (adults): 7 years after our last session
Client notes and records (under 18s): Until the client’s 25th birthday, or 26th if they were 17 at the last session
Financial and tax records: 6 years after the end of the relevant tax year

Records are securely destroyed at the end of these periods.

8. Keeping it secure

I take practical steps to protect your information, including password protection and encryption on my devices, two-factor authentication on my email and online accounts and keeping identifying details separate from session notes.

No system is completely secure. Email and text are convenient but not fully private, and I will keep anything sent that way brief and practical. If something feels too sensitive for email, bring it to a session instead.

If a breach happens that is likely to put you at risk, I will tell you and, where required, report it to the Information Commissioner’s Office within 72 hours.

9. Your rights

Under UK data protection law you have the right to:

be informed about how your information is used, which is what this policy is for
access the information I hold about you, usually within one month and free of charge
have inaccurate information corrected
ask for information to be erased, though this does not apply where I am required to keep it
restrict or object to how I use it
withdraw consent, where consent is the basis I am relying on
data portability, in limited circumstances

Session notes are written in professional shorthand and are not intended as a record for you to read. If you ask to see them, I will go through them with you rather than simply handing them over, so that they make sense in context. Where notes refer to another identifiable person, I may need to remove or withhold parts of them.

To exercise any of these rights, email me at hello@jessicabrichto.com.

10. Cookies

Cookies are small files placed on your device by a website.

This site uses essential cookies set by Wix, which are needed for the site to function and to keep it secure. These do not require your consent.

This site also uses analytics cookies, which tell me how many people visit and which pages they look at. These are only set if you agree to them using the banner shown when you first visit. You can change your choice at any time by clearing your cookies / using the cookie settings link in the footer.

You can block or delete cookies through your browser settings, though some parts of the site may not work properly if you do.

11. Changes to this policy

I will update this policy if my practice or the services I use change. The date at the top shows when it was last revised. If a change materially affects current clients, I will tell them directly.

12. Complaints

If you are unhappy with how I have handled your information, please tell me first at hello@jessicabrichto.com so I have a chance to put it right.

You also have the right to complain to the Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

If your concern is about my professional conduct rather than my handling of data, you can raise it with the British Association for Counselling and Psychotherapy at bacp.co.uk.