Privacy Notice

Last updated: 10 November 2026

Who I am

Jennifer Darling, trading as CBT Mindfulness, is the data controller for personal information collected through this website and through my private practice. I am registered with the Information Commissioner's Office. You can contact me about privacy or data protection at cbtmindfulness@gmail.com.

Information I may collect

When you make an enquiry, I may collect your name, contact details and the information you choose to include in your message. Please do not include detailed or highly sensitive clinical information in an initial website enquiry.

If you become a therapy or supervision client, I may also collect information needed to provide the service safely and effectively. This can include assessment information, relevant health information, agreed goals, brief session records, correspondence, appointment details, payment information and an emergency contact where appropriate. Information about physical or mental health is special category data and receives additional protection.

If you join the mailing list, I collect your email address and your communication preferences. The website may also collect limited technical information through essential cookies and similar technologies used by Squarespace.

The PHQ 9, GAD 7 and other interactive tools on this website are provided for private self reflection. Nothing you enter into those tools is sent to CBT Mindfulness or saved on the website. If you choose to share a score or result with me, it will be treated as health information.

How I use your information

I use personal information to respond to enquiries, consider whether my services are suitable, provide CBT, supervision, training or consultancy, manage appointments and payments, maintain appropriate clinical and administrative records, protect safety, meet professional and legal responsibilities, and improve the website and resources.

I use your email address for newsletters or updates only where you have chosen to subscribe. You can unsubscribe at any time using the link in an email or by contacting me.

Lawful bases

Depending on the circumstances, I process personal information because it is necessary to take steps before entering into a contract, to provide an agreed service, to meet a legal obligation, or because I have a legitimate interest in running a safe and effective professional practice. I rely on consent for optional marketing communications.

Where health information is involved, I rely on your explicit consent and, where applicable, the provisions that allow health information to be processed for health or social care by a professional who is subject to confidentiality. In a serious emergency, information may be used where this is necessary to protect someone's vital interests.

Sharing information

I do not sell personal information. Information is shared only when necessary and proportionate. This may include trusted providers that support the website, email, secure record keeping, payments or administration, as well as professional advisers, insurers or accountants. Clinical supervision is conducted in a way that minimises identifying information wherever possible.

Information may also be shared with healthcare, safeguarding or emergency services, a regulator, or a legal authority where you have consented, where the law requires it, or where there is a serious and immediate concern about safety. I will normally discuss this with you first unless doing so would increase risk or would not be lawful.

Some service providers may process information outside the United Kingdom. Where this happens, I take reasonable steps to ensure that appropriate data protection safeguards are in place.

Security and retention

I take reasonable technical and organisational steps to protect personal information and limit access to people who need it. No internet or email system can be guaranteed to be completely secure, so please avoid sending unnecessary sensitive information by ordinary email or through the initial enquiry form.

Records are kept only for as long as there is a clear professional, legal, insurance, tax or safeguarding reason to retain them. Clinical records are retained in line with applicable professional and insurance requirements. Financial records are retained for the period required by tax and accounting law. Enquiries that do not proceed are deleted when they are no longer needed. Mailing list information is retained until you unsubscribe or ask for it to be removed.

Cookies and website services

Squarespace provides and hosts this website. Essential cookies help the website function and protect forms from misuse. Squarespace or connected services may also use limited analytics or similar technologies. You can manage cookies through your browser settings and, where available, the website cookie controls. Blocking essential cookies may affect how parts of the website work.

Your rights

Under UK data protection law, you may have the right to ask for a copy of your personal information, correct inaccurate information, request deletion, restrict or object to processing, and receive certain information in a portable form. Where processing is based on consent, you can withdraw that consent at any time. These rights are not absolute and some professional or legal records may need to be retained.

To make a request, email cbtmindfulness@gmail.com. I may need to confirm your identity before responding.

Questions and complaints

Please contact me first if you have a question or concern about how your information is used. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this notice

This notice may be updated when the website, services or legal requirements change. The date at the top of the page will show the latest update.