Privacy policy

Who I am

Gem Kate CBT is the trading name of Gemma Wood, a CBT-informed coach based in Bexhill-on-Sea, East Sussex. I am the “data controller” for the personal information described here, which means I decide how it is used and I am responsible for protecting it.

If you have any questions about this policy or your information, email me at contact@gemkatecbt.co.uk.

What information I collect

When you contact me

If you use the contact form or email me, I receive your name, email address, phone number (if you give one), how you would like me to reply, and whatever you choose to tell me in your message.

When you book a consultation or session

Bookings are made through Konfidens, a secure practice management platform for therapists and coaches. When you book, Konfidens collects your name, contact details, appointment details and payment information on my behalf. Card payments are handled by Konfidens' payment provider; I never see or store your full card details.

When we work together

During coaching I keep brief notes so I can support you well from one session to the next. These may include what you would like to work on, your progress, and anything relevant you share about your wellbeing. Online sessions take place on Konfidens' secure video platform.

Session recordings

Sessions are not recorded or transcribed unless we have both agreed to it in advance. If you would like a session recorded, for example so you can listen back to it, I will only do this with your explicit agreement. Any recording is stored securely in Konfidens, used only for the purpose we agreed, and deleted within 30 days.

Health and other sensitive information

What you share with me may include information about your mental or physical health. The law treats this as “special category” data and gives it extra protection. I only use it to provide your coaching, and only with your explicit consent, which you give when you agree to work with me. You can withdraw that consent at any time, although I may then be unable to continue coaching you.

When you visit this website

This website does not use cookies for advertising, tracking or analytics. My website host keeps standard technical logs (such as IP address and browser type) to keep the site secure and working, and may produce anonymous visitor statistics that do not identify you. The website's fonts are loaded from Google Fonts, which means your browser shares your IP address with Google when a page loads.

How and why I use your information

Data protection law requires me to have a lawful reason (a “lawful basis”) for using your information. Mine are:

• To reply to your enquiry and arrange a consultation, because you have asked me to (steps before entering a contract).
• To provide coaching, including booking, taking payment, running sessions and keeping notes (performance of our contract).
• To use health information you share, with your explicit consent.
• To keep business and tax records, as the law requires (legal obligation).
• To keep coaching records after we finish, to meet my professional body's standards and so I can respond to any complaint or claim (legitimate interests and, for health information, the establishment or defence of legal claims).
• To keep this website secure and working properly (legitimate interests).

I will never sell your information, use it for marketing without asking you first, or use it to make automated decisions about you.

Confidentiality and its limits

Everything you share in coaching is confidential. The only exception is if I believe you or someone else is at serious risk of harm, or if the law requires me to share information. In that situation I may contact emergency services, your GP or another appropriate person. Wherever it is safe and possible, I will talk to you about this first.

Like many coaches, I may discuss my work with a professional supervisor, to make sure I am supporting you as well as I can. If I do, I will never share your name or anything that could identify you, and my supervisor is bound by confidentiality too.

Who your information is shared with

I only share your information with trusted service providers who help me run the practice. They act on my instructions and must keep your information secure:

• Konfidens, for bookings, payments, video sessions and client records
• My business email provider, for email correspondence
• My website host and its email delivery service, which pass contact form messages to me and keep a short technical record that each email was sent

Some of these providers may store or process information outside the UK. Where they do, the transfer is protected by UK adequacy regulations or approved contractual safeguards, as UK data protection law requires.

I may also share information if the law requires it, or with my professional indemnity insurer or professional body if needed to deal with a complaint or claim.

How long I keep your information

• Enquiries that do not lead to coaching are deleted within six months.
• Coaching notes and client records are stored securely while we work together, then kept for ten years after our coaching ends, as required by Foyht's Standards of Practice, before being securely deleted.
• Session recordings, if we have agreed to make one, are deleted within 30 days.
• Payment and invoice records are kept for six years, because HMRC requires it. These contain only what is needed for tax purposes, not anything you shared in sessions.

How I keep your information safe

Your information is stored electronically on secure, password-protected systems with two-factor authentication where available. I do not keep paper records. Only I have access to your client records.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information I hold about you
• ask me to correct anything that is wrong or incomplete
• ask me to delete your information
• ask me to limit how I use your information, or object to how I use it
• ask for your information in a format you can take elsewhere
• withdraw your consent at any time, where I rely on it

To use any of these rights, email contact@gemkatecbt.co.uk. There is no charge, and I will reply within one month. Some rights have legal limits (for example, I must keep tax records, and my professional body requires me to keep coaching records for ten years), and if so I will explain why.

Making a complaint

If you are unhappy with how I have handled your information, please tell me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Changes to this policy

I will update this page if anything changes about how I handle your information. The date at the top shows when it was last updated.