​​

Who I am

 

Jenni McArthur Psychology Ltd, trading as Jenni McArthur Psychology and The Human Performance Studio, is the data controller for the personal information described in this notice. This notice applies to both trading names.

• Registered name: Jenni McArthur Psychology Ltd

• Registered in: England and Wales

• Company number: 17381904

• Registered office: Room 58, Northwood House, Ward Avenue, Cowes, Isle of Wight, PO31 8AZ

• Contact for data protection matters: jenni@jennimacpsychology.com

• ICO registration number: ZC222843

I am Dr Jenni McArthur, a Chartered Psychologist registered with the Health and Care Professions Council (registration PYL039818).

I am not required to appoint a Data Protection Officer. I handle data protection questions personally.

 

What this notice covers

 

This notice explains how I handle personal information about:

• visitors to my websites

• people who enquire about my services

• subscribers to my newsletter

• contacts at organisations I work with

• people who use my e-learning platform

• suppliers and professional contacts

 

If you are a one-to-one client, your client agreement explains in full how I handle your clinical records. You will receive it before we start working together, and it takes precedence over this notice for anything relating to your care.

If you are taking part in a programme commissioned by your employer, your employer may be the controller for some of your information. Their own privacy notice will explain their part, and I will tell you at the outset which information comes to me and on what basis.

 

What I collect, why, and my lawful basis

If you contact me or enquire about services

 

What: your name, email address, phone number, organisation, and whatever you choose to tell me about what you are looking for.

Why: to respond to you, to work out whether I am the right person to help, and to arrange an initial conversation.

Lawful basis: taking steps at your request before entering a contract (Article 6(1)(b)), or my legitimate interests in responding to enquiries about my practice (Article 6(1)(f)).

If your enquiry includes information about your health, I treat it as special category data. I rely on Article 9(2)(h), the provision of health care and treatment, together with the condition at Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Please do not send detailed health information by email before we have agreed how to work together securely.

 

If you subscribe to my newsletter

 

What: your email address, your name if you give it, and information about which emails you open and which links you click.

Why: to send you the newsletter and to understand which content is useful.

Lawful basis: your consent (Article 6(1)(a)). You can withdraw it at any time using the unsubscribe link in any email, or by contacting me. If you unsubscribe, I keep your email address on a suppression list so that you are not added back by mistake.

If you are a client, or a contact at a client organisation

 

What: contact details, role, contract and scheduling information, correspondence, invoicing and payment records, and records of the work delivered.

Why: to agree and deliver the work, to manage the relationship, to invoice, and to keep proper business records.

Lawful basis: performance of a contract (Article 6(1)(b)); my legitimate interests in managing client relationships (Article 6(1)(f)); and legal obligation for accounting and tax records (Article 6(1)(c)).

 

If you use my e-learning platform

What: your name, email address, the organisation you belong to, your progress through modules, and your responses to any assessments.

Where it comes from: your organisation usually provides your name, email address and role to set up your account.

Why: to give you access, to track completion, and to report to your organisation on participation.

Lawful basis: performance of a contract with your organisation, and my legitimate interests in delivering and improving the learning. Where reporting to your employer goes beyond participation data, I will tell you before the programme starts.

 

If you visit my websites

What: your IP address, browser and device information, and the pages you visit, collected through cookies and similar technologies.

Why: to keep the site working and secure, and to understand how it is used.

Lawful basis: my legitimate interests in operating a secure website, and your consent for any non-essential cookies (see Cookies below).

 

Do you have to give me your information?

You don't have to give me your information, but without your contact details I can't respond to an enquiry or provide services.

 

Cookies

My website uses cookies, which are small files stored on your device.

• Essential cookies keep the site working and secure, for example, remembering your cookie choices. These are set without consent because the site cannot work without them.

• Analytics cookies tell me how many people visit and which pages they use, so I can improve the site. These are only set if you agree.

I do not use advertising or marketing cookies.

I use Usercentrics to manage cookie consent. When you first visit, a banner lets you accept, reject or choose which cookies to allow. Non-essential cookies do not load unless you agree. You can change your choice at any time using the cookie settings link at the bottom of every page, where you will also find a full list of the cookies the site sets.

 

Who else sees your information

 

I use a small number of service providers who process personal information on my behalf, under contract:

​

• Wix: website hosting, enquiry forms and site analytics. Multiple countries, including the US.

• Usercentrics: cookie consent management. EU (Germany).

• Google Workspace: email and calendar. EU.

• Microsoft 365 (Outlook): email. UK.

• FreeAgent: invoicing and accounting records. UK.

• Mindflick: Spotlight psychometric profiles, where agreed in writing. UK. Mindflick acts as an independent controller of profile data, so its own privacy policy also applies.

• TalentLMS: e-learning platform. US.

• Beehiiv: newsletter delivery. US.

• Jacksons: statutory accounts and tax filing. UK.

 

I also share information where I have to:

​

• with my professional indemnity insurer, if a claim or potential claim arises

• with the HCPC or another regulator, if required

• with a court, or where the law otherwise requires disclosure

• where there is a serious risk to your safety or someone else's (the client agreement explains this in full for one-to-one clients)

 

I do not sell your information, and I do not share it for anyone else's marketing.

 

Information leaving the UK

 

Some of my providers store or process information outside the UK, in the European Union or the United States. Where that happens, the transfer is protected in one of these ways:

​

• European Union: the UK recognises EU data protection law as adequate, so no extra safeguards are needed.

• United States: the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), or the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

 

You can ask me for more detail on the safeguards for any provider.

 

How long I keep it

​

• Enquiries that do not become work: 12 months from our last contact.

• Newsletter subscriptions: until you unsubscribe. The suppression list is kept indefinitely.

• Client contracts and correspondence: 6 years after the work ends.

• Invoicing, accounting and tax records: 6 full financial years, as required by HMRC and the Companies Act.

• E-learning accounts: for the licence period agreed with your organisation, then deleted.

• Website analytics: held by Wix, my website provider, under its own retention policy. I only see this information in summary form, such as visitor numbers and popular pages.

 

Clinical records are kept under a different schedule, set out in the client agreement.

 

Automated decision-making

 

I do not make decisions about you using automated decision-making or profiling.

 

Your rights

 

Under UK data protection law, you have the right to:

• ask for a copy of the personal information I hold about you

• ask me to correct information that is wrong or incomplete

• ask me to delete information, where I have no continuing reason to keep it

• ask me to restrict how I use your information while a concern is resolved

• object to my using your information where I rely on legitimate interests

• receive information you gave me in a portable format, where it is held by consent or under a contract

• withdraw consent at any time, where consent is the basis I rely on

 

Some of these rights are limited. In particular, I cannot always delete clinical records on request, because professional standards and my insurer require me to keep them for a set period. I will explain if that applies to you.

To use any of these rights, email jenni@jennimacpsychology.com. I will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

 

Complaints

 

If you are unhappy with how I have handled your information, please tell me first at jenni@jennimacpsychology.com so I can try to put it right. I will acknowledge your complaint within 30 days and let you know the outcome.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint

 

Changes to this notice

​

I review this notice at least once a year and whenever my services or systems change. The date at the top shows when it was last updated. If I make a significant change to how I use your information, I will tell the people affected directly.

​

​