Client Privacy Notice - Jeff Dawson Coaching

Oct 19, 2026 · @Jeff Dawson

Last updated: 19 October 2026

This notice explains what personal information I hold about you as a coaching or supervision client, how I keep it safe, and the choices you have. Please read it alongside your client agreement.

1. Who am I

I am Jeff Dawson, a sole practitioner trading as Jeff Dawson Coaching. I am the data controller for your information, which means I decide how it is used and I am responsible for keeping it safe.

•  Address: Strawberry Cottage, Mill Hill Lane, Tavistock, PL19 8NH

•  Email: hello@jeffdawson.co.uk

•  ICO registration: ZB325627

•  Professional body: BACP Registered member. I follow the BACP Ethical Framework for the Counselling Professions 2026.

2. What I hold and why

I only hold what I need to work with you safely and run my practice.

Your contact details (name, address, phone, email, date of birth)

•  Why: to arrange and run our sessions.

•  Lawful basis: contract (UK GDPR Article 6(1)(b)).

Your emergency contact

•  Why: to keep you safe if I am seriously worried about you.

•  Lawful basis: legitimate interests, or vital interests in an emergency (Articles 6(1)(f) and 6(1)(d)).

Session notes, and anything you share about your health, wellbeing, relationships or beliefs

•  Why: to provide and review our work, and for supervision.

•  Lawful basis: your explicit consent (Article 9(2)(a)).

Messages and emails with me

•  Why: they form part of your client record.

•  Lawful basis: contract, and your explicit consent for anything health-related.

Payments and invoices

•  Why: accounts and tax.

•  Lawful basis: legal obligation (Article 6(1)(c)).

Safeguarding concerns

•  Why: to protect you or others from serious harm.

•  Lawful basis: legal obligation, and the Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding).

I never sell your information or use it for marketing without your separate permission. You can withdraw consent at any time, although some records must still be kept (see section 7).

3. Tools that handle your information

I use the services below. Each acts on my instructions under a data processing agreement, and I assessed each one before using it. Where data leaves the UK, it is protected by UK adequacy rules or approved contract terms.

Zanda Health

•  What it does: client records, session notes, bookings, client portal and invoices.

•  Where data is stored: Amazon Web Services data centres. Zanda is an Australian company; UK transfers are protected by the UK International Data Transfer Addendum in its data processing agreement.

Zoom (through Zanda telehealth)

•  What it does: online sessions. Sessions are encrypted and never recorded.

•  Where data is stored: connection data may be processed outside the UK under Zoom's data processing addendum.

Heidi Health

•  What it does: AI note-taking, only with your consent (see section 4).

•  Where data is stored: hosted in the UK; some processing may take place overseas.

Stripe

•  What it does: card payments through Zanda.

•  Where data is stored: may be transferred to the US, protected by the UK Extension to the EU-US Data Privacy Framework and the UK Addendum.

Apple Mail and Calendar (iCloud)

•  What it does: email and my appointment diary. Appointments show initials only.

•  Where data is stored: Apple servers, which may be outside the UK, under Apple's standard safeguards.

123-Reg

•  What it does: website, online shop and email hosting.

•  Where data is stored: UK-based provider (part of GoDaddy).

WhatsApp

•  What it does: messaging, if you choose it (see section 5).

•  Where data is stored: messages are end-to-end encrypted; Meta holds metadata.

TalkMobile

•  What it does: phone calls and text messages.

•  Where data is stored: UK mobile network.

I keep no paper records. Session notes are held only in Zanda. My laptop and phone are password-protected and encrypted.

4. How I use AI

I use AI in two limited ways. AI never makes decisions about you or your care. I review everything it produces and remain responsible for it.

Heidi Health (AI note-taking), only if you agree

Heidi listens during the session and drafts notes for me to check and edit.

•  I will ask you before each session where I'd like to use it. Saying no makes no difference to our work.

•  You can ask me to stop it at any point, including mid-session.

•  I move my checked notes into Zanda, then delete the audio and drafts from Heidi.

•  The benefit: I can give you my full attention instead of writing.

•  The risk: a recording exists briefly, held by a third party, and AI drafts can contain mistakes. That's why I check every note.

General AI assistants (such as Claude), for business tasks only

I use these for writing, admin and planning. I never enter your name or any information that could identify you. If I ever wanted to use AI with your information in another way, I would explain it and ask for your written consent first.

5. Messages and email

You choose how you'd like me to contact you. Each method has a different level of security.

•  Phone call: not recorded. Good for arrangements, or anything you'd rather say than write.

•  WhatsApp: end-to-end encrypted, though Meta can see that we messaged. Good for arrangements and brief messages.

•  Email: not end-to-end encrypted. Good for arrangements and invoices.

•  Text message: not encrypted. For reminders and changes of time only.

Please avoid sending detailed personal information by text or email. I don't offer support by message between sessions. All messages form part of your client record (see section 7), so I don't use disappearing messages.

6. Who else may see your information

What we discuss stays confidential, with these exceptions.

•  My clinical supervisor. I discuss my work in supervision, without your name or identifying details. My supervisor is bound by the same confidentiality.

•  My clinical executor. If I die or can't work, a BACP-registered colleague I have appointed will contact you and look after your records. They are bound by the same confidentiality.

•  Risk of serious harm. If I believe you or someone else is at risk of serious harm, I may share information with your GP, your emergency contact or the emergency services. Where I can, I will talk to you first.

•  Safeguarding and the law. I must share information to protect children or adults at risk, to help prevent or detect serious crime or terrorism, or when ordered by a court. My safeguarding policy is available on request.

•  With your written permission. For example, a letter to your GP.

•  TISCUK supervisees only. As set out in your supervision agreement, I may share information with TISCUK about your progress towards your qualification.

7. How long I keep information

•  Session notes, messages and your client record: 7 years after our last session. If you were under 18 when we worked together, until you turn 25 or for 7 years, whichever is longer. Then securely deleted.

•  Payment and invoice records: at least 5 years after the 31 January Self Assessment deadline for that tax year, as HMRC requires. Then securely deleted.

•  Heidi audio and drafts: only until I have checked the notes and copied them to Zanda. Then deleted by me.

•  Enquiries that don't lead to work: 12 months. Then deleted.

I keep notes for this long so I can respond to any complaint, claim or request from you.

8. Your rights

You have the right to:

•  see the information I hold about you (I reply within 1 month, free of charge)

•  ask me to correct anything inaccurate

•  ask me to delete your information, or limit how I use it, where the law allows

•  receive a copy of information you gave me, in a common format

•  object to how I use your information

•  withdraw consent at any time, including for Heidi

To use any of these rights, email hello@jeffdawson.co.uk.

If you're unhappy with how I handle your information, please tell me first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. Concerns about my practice can go to BACP's Get help with counselling concerns service: 01455 883300 or gethelp@bacp.co.uk.

9. Your consent

Before we start working together, I'll ask you to sign a short consent form. It covers this notice, the limits to confidentiality, whether you're happy for me to use Heidi, and how you'd like me to contact you. You can change any of these choices at any time by telling me.

I review this notice every April, and whenever I change the tools I use. I'll tell you about any significant change.