Privacy Policy

Welcome to Dr Jenny Cooper Psychology's privacy policy.

Dr Jenny Cooper Psychology takes the privacy rights of all its clients seriously and adopts a high standard of compliance and confidentiality when dealing with your data. We want you to understand that this is a safe place for you to discuss your feelings and concerns, and we operate in a highly confidential environment. This privacy policy sets out the details of how data is collected and processed through the use of our website.

1. Important information and who we are

Purpose of this privacy policy

This privacy policy aims to give you information on how Dr Jenny Cooper Psychology collects and processes your personal data through your use of this website, including any data you may provide through this website when you purchase our services, use the contact form or scheduling tool, or sign up to our newsletter.

This website is not intended for children and we do not knowingly collect data relating to children via our website.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal or sensitive data about you, so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Controller

Dr Jenny Cooper, trading as Dr Jenny Cooper Psychology, is the data controller and is responsible for your personal data (referred to as "we", "us" or "our" in this privacy notice).

Contact details for data protection queries

If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:

  • Full name of legal entity: Dr Jenny Cooper trading as Dr Jenny Cooper Psychology

  • Email address: jenny@drjennycooper.co.uk

  • Postal address: Penelope House, Westerhill Road, Coxheath, ME17 4DH

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this privacy policy

We keep our privacy policy under regular review. This version was last updated in September 2026.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications (for example, our online scheduling tool). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

  • Identity Data includes first name, last name, title, date of birth and gender.

  • Contact Data includes address, email address and telephone number.

  • Financial Data includes bank account and payment card details.

  • Transaction Data includes details about payments to and from you and other details of services you have purchased from us.

  • Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.

  • Profile Data includes your username and password (where applicable), appointments booked, your preferences and feedback.

  • Usage Data includes information about how you use our website and scheduling tool.

  • Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law, as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data, used in accordance with this privacy policy.

  • Sensitive Data includes information about your health, including information about your existing and previous medical conditions, medication details, psychiatric or psychological history, diagnoses, and any other relevant health information to enable us to carry out our services to you.

  • Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership).

  • We do not collect genetic or biometric data, nor do we collect any information about criminal convictions and offences.

We require your explicit consent for processing sensitive data. When you submit your details, we will send you a further communication asking you to confirm your consent to this processing.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

3. How is your personal data collected?

We use different methods to collect data from and about you, including through:

  • Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms before or during an appointment, verbally during discussions in session, or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

    • book an appointment or assessment;

    • use our online scheduling tool;

    • discuss your details during a session;

    • request marketing or newsletter updates to be sent to you; or

    • give us feedback or contact us.

  • Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data using cookies and other similar technologies. Please see the cookie section below for further details.

  • Third parties or publicly available sources. We may receive personal data about you from third parties, including:

    • analytics providers (such as Google);

    • our website hosting platform (Squarespace) and scheduling provider (Acuity Scheduling);

    • providers of payment services (such as [Stripe/your payment processor]).

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform the contract we are about to enter into or have entered into with you.

  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

  • Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will get your consent when collecting sensitive data (such as health information) and before sending any marketing communications to you via email. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

To register you as a new client, we use your Identity and Contact Data. Our lawful basis is performance of a contract with you.

To provide our services (therapy, assessment) and manage payment, we use your Identity, Contact, Financial, Transaction and Sensitive Data. Our lawful basis is (a) performance of a contract with you; (b) our legitimate interests, where necessary to recover debts due to us; and (c) your explicit consent, for Sensitive Data.

To manage our relationship with you, including notifying you of changes to our terms or this policy, we use your Identity, Contact, Profile, and Marketing and Communications Data. Our lawful basis is (a) performance of a contract with you; (b) compliance with a legal obligation; and (c) our legitimate interests.

To administer and protect our business and this website, including troubleshooting, data analysis, system maintenance and hosting, we use your Identity, Contact and Technical Data. Our lawful basis is (a) our legitimate interests, in running our business and maintaining IT and network security; and (b) compliance with a legal obligation.

To use data analytics to improve our website and services, we use your Technical and Usage Data. Our lawful basis is our legitimate interests.

Marketing

Our lawful ground for sending you marketing communications is either your consent or our legitimate interests. Under the Privacy and Electronic Communications Regulations, we may send you marketing communications if you made a purchase or asked for information from us about our services, or you agreed to receive marketing communications, and in each case you have not since opted out.

You can ask us to stop sending you marketing messages at any time by contacting us.

5. Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us provide you with a good experience when you browse our website and also allows us to improve our site.

A cookie is a small file of letters and numbers that we store on your browser or device if you agree. We use the following categories of cookies:

  • Strictly necessary cookies — required for the operation of our website (e.g. enabling secure areas or booking functionality).

  • Analytical or performance cookies — allow us to recognise and count visitors and see how visitors move around our website, helping us improve it.

  • Functionality cookies — used to recognise you when you return to our website and remember your preferences.

Because this website is built on Squarespace and uses Acuity Scheduling for appointment booking, the following cookies may be set:

acloggedin and client_acloggedin support login by an Acuity Scheduling client, if they have an account.

ddcookie_test and ddsite_test test whether cookies are supported, and expire instantly.

dds tracks browser errors and expires after four hours.

_grecaptcha is a local storage item that helps reduce spam in Acuity Scheduling, with no expiry.

client_username remembers a logged-in Acuity Scheduling client's username between visits, for one year.

clientUser stores the Acuity Scheduling client's username and access tokens, and is required for logged-in client functionality; it expires after 30 days.

Crumb and siteUserCrumb prevent cross-site request forgery (CSRF); Crumb lasts for the session, and siteUserCrumb lasts three years.

Locked prevents the password screen displaying once the correct site password is entered, for the duration of the session.

PHPSESSID securely authenticates a visitor during Acuity Scheduling checkout, for one month.

RecentRedirect prevents redirect loops, for 30 minutes.

remember_client remembers an Acuity Scheduling client's login details, for 365 days.

SiteUserInfo and SiteUserSecureAuthToken identify and authenticate a visitor who logs into a customer account, for three years.

squarespace-announcementbar is a persistent local storage item that prevents a dismissed announcement bar reappearing.

ss_cookieAllowed remembers a visitor's cookie consent choice, for 30 days.

ss_sd keeps visitors authenticated during their session.

ss_cid, ss_cpvisit, ss_cvisit, ss_cvr and ss_cvt identify unique visitors and track their sessions on the site, with expiries ranging from 30 minutes to two years.

TZ is a persistent local storage item that displays an Acuity Scheduling client's appointments in their correct time zone.

Test investigates browser cookie support and prevents errors, for the duration of the session.

We do not share the information collected by these cookies with any third parties beyond Squarespace and Acuity Scheduling, our website and booking providers.

You can block cookies by changing your browser settings. However, if you block all cookies (including essential ones), some parts of our website — such as online booking — may not work correctly. Except for essential cookies, all cookies will expire after three years.

6. Disclosures of your personal data

We may share your personal data with:

  • Service providers acting as processors, who provide IT, hosting and scheduling services (e.g. Squarespace, Acuity Scheduling).

  • Professional advisers, including healthcare professionals, supervisors, accountants and insurers, who provide consultancy, accounting or insurance services.

  • HM Revenue & Customs, regulators and other authorities, where required by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

7. International transfers

We may transfer your data outside the United Kingdom, for example where our website hosting or scheduling providers store data outside the UK. Whenever we do so, we ensure appropriate safeguards are in place, such as transferring only to countries deemed to provide an adequate level of protection, or using contracts approved by the UK Information Commissioner's Office.

8. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those with a business need to know, and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

9. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory or professional body requirements.

As general guidance: clinical records are typically required to be retained for a minimum period after treatment has finished (commonly cited as around 7 years for adults), with longer periods where a client was under 18 at the time of treatment. Basic contact, identity and financial data is typically retained for around six years after a client relationship ends, for tax purposes.

In some circumstances you can ask us to delete your data — see "Your legal rights" below.

10. Your legal rights

Under UK data protection law, you have the right to:

  • Request access to your personal data.

  • Request correction of personal data we hold about you.

  • Request erasure of your personal data, in certain circumstances.

  • Object to processing where we rely on legitimate interests, including for direct marketing.

  • Request restriction of processing of your personal data, in certain circumstances.

  • Request transfer of your personal data to you or a third party, where technically feasible.

  • Withdraw consent at any time, where we rely on consent to process your data.

If you wish to exercise any of these rights, please contact us using the details in Section 1.

No fee usually required

You will not normally have to pay a fee to exercise these rights. We may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded, repetitive or excessive.

Time limit to respond

We aim to respond to all legitimate requests within one month. If your request is particularly complex, this may take longer, in which case we will notify you and keep you updated.