This Privacy Policy explains how Jessica Ricci collects and uses personal information in connection with this website and her professional services.
 

1. Who I am

Jessica Ricci is the owner of this website and the person responsible for deciding how personal information collected through this website and in connection with my professional services is used. For data protection purposes, I act as the data controller.

This Privacy Policy explains how I collect, use, store and share personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
 

2. What personal information I collect

I may collect and process the following types of personal information:

• Contact and identification details: name, surname, email address, telephone number and other contact details you provide.

• Enquiry information: information you share when contacting me through my website, email or telephone, including information about the services you are interested in.

• Health-related information: information about your mental health, wellbeing, circumstances, needs and difficulties that you share when enquiring about or receiving psychological services.

• Therapy and appointment records: appointment details, relevant information shared during sessions, professional notes and other records needed to provide and manage psychological services.

• Professional collaboration information: contact details, correspondence, project information and other relevant information relating to workshops, training, consultancy or professional collaborations.

• Financial and administrative information: payment details, invoices and records needed for accounting and tax purposes.

• Complaints and legal matters: information needed to respond to complaints, disputes or legal claims, where applicable.

Please avoid including detailed or sensitive health information in your initial website enquiry.

3. Why I use personal information

I use personal information to:

• Respond to enquiries and discuss whether my services may be appropriate for your needs.

• Arrange, provide and manage psychological services, including appointments and relevant professional records.

• Organise and deliver workshops, training, consultancy and professional collaborations.

• Manage payments, invoicing, accounting and other administrative activities.

• Respond to complaints, disputes or legal claims where necessary.

• Meet legal and regulatory obligations and address safeguarding or safety concerns where appropriate.

• Operate, maintain and protect my website and professional services.

I process personal information only where I have an applicable lawful basis under the UK GDPR. Where I process special category personal data, such as health information, I also require an applicable condition under Article 9 of the UK GDPR and must meet any relevant requirements of the Data Protection Act 2018.

4. Special category personal information

Information about mental health and other health-related information is special category personal data under the UK GDPR and receives additional protection.

I process health-related information where necessary to provide psychological services, including assessment, care and treatment. For this processing, I rely on Article 9(2)(h) of the UK GDPR, together with Part 1, paragraph 2 of Schedule 1 to the Data Protection Act 2018, where applicable.

This processing is subject to the confidentiality requirements in Article 9(3) of the UK GDPR and section 11 of the Data Protection Act 2018. I handle health-related information in accordance with my applicable duties of confidentiality and data protection obligations.

5. Lawful bases for processing

I rely on the following lawful bases under Article 6 of the UK GDPR, as appropriate to the circumstances:

• Contract and steps before entering into a contract — Article 6(1)(b): to take steps you request before entering into an agreement and to provide services under an agreement.

• Legitimate interests — Article 6(1)(f): where necessary for legitimate professional and business purposes, such as managing enquiries and administering my practice, provided these interests are not overridden by your rights and freedoms.

• Legal obligation — Article 6(1)(c): where processing is necessary to comply with legal obligations, including applicable accounting and tax requirements.

• Consent — Article 6(1)(a): where I rely on your consent for a particular purpose.

Where I process special category personal data, including health-related information, I also identify an applicable condition under Article 9 of the UK GDPR and meet any additional requirements under the Data Protection Act 2018.

6. How I collect personal information

I collect personal information directly from you when you:

• Contact me by email, telephone or through my website.

• Make an enquiry about my services.

• Arrange or attend appointments.

• Provide information during the course of psychological services.

• Communicate with me about payments, administration or other matters relating to my services.

• Submit an enquiry through the website contact form.

• Enter into a therapy agreement and provide information during the course of therapy.

Please only provide personal information that is relevant to your enquiry or the services you receive.

7. How I store and protect information

I take appropriate steps to protect personal information against unauthorised access, loss, misuse or disclosure. Information may be stored or processed using the services of my website provider, Wix, and my professional email provider, Google/Gmail, as described in this policy.

No method of transmitting or storing information can be guaranteed to be completely secure, but I take reasonable steps to protect the information I hold.

8. How long I keep information

I keep personal information only for as long as necessary for the purposes for which it was collected, taking account of applicable legal and professional obligations.

Therapy records: I retain therapy records for five years after the end of the therapeutic relationship, in line with the retention period recommended by my Italian professional order, unless applicable legal or professional requirements require a different period.

Professional collaboration records: I retain relevant records relating to workshops, training, consultancy and other professional collaborations for five years after the end of the relevant collaboration, unless applicable legal or professional requirements require a different period.

Other information: Enquiry correspondence, financial records and other administrative information may be kept for different periods where necessary to meet the relevant purpose or legal requirements, including accounting and tax obligations.

When information is no longer required, I securely delete it or anonymise it where appropriate.

9. Who I share information with

I do not sell personal information. Where necessary and appropriate, I may share relevant information with:

• Wix.com Ltd, which hosts and provides functionality for this website, including the contact form.

• Google LLC/Gmail, which I use for professional email correspondence.

• An accountant or accountancy firm, where information is needed for accounting or tax purposes.

• Other professional support or supervision, where applicable, if you discuss case material with a supervisor or another professional. Any such sharing must be lawful and consistent with your confidentiality obligations.

• Professional advisers, where necessary for advice or to protect my legal rights.

• Emergency services, safeguarding organisations or relevant authorities where sharing is necessary and lawful, including to protect someone’s safety or where I am legally required to share information.

I share only information that is relevant and necessary for the purpose. I also take account of any applicable duty of confidentiality.

10. Sharing information outside the UK

My website and professional email services are provided by third-party providers that may process personal information outside the United Kingdom.

Wix.com Ltd: Wix may process personal information in countries including Israel, Ireland and the United States, depending on the services and processing arrangements applicable to my account.

Google / Gmail: Google may process personal information in different countries worldwide, including the United States, depending on the services and processing arrangements applicable to my account.

Where personal information is transferred outside the United Kingdom, the transfer must be covered by an applicable transfer mechanism under UK data protection law. Depending on the transfer and the provider's arrangements, this may include UK adequacy regulations or appropriate safeguards, such as approved contractual protections.

Further information about the applicable transfer arrangements and safeguards can be requested from me.

​

11. Your data protection rights

Under UK data-protection law, you may have the right to:

• Access: request a copy of your personal information.

• Rectification: ask me to correct inaccurate or incomplete information.

• Erasure: ask me to delete your personal information in certain circumstances.

• Restriction: ask me to restrict the processing of your information in certain circumstances.

• Object: object to certain types of processing.

• Data portability: request that information you provided be transferred to you or another organisation in certain circumstances.

• Withdraw consent: where I rely on consent, withdraw it at any time.

These rights are subject to legal conditions and exemptions, so they may not apply in every situation.

​

12. How to complain

If you have concerns about how I use your personal information, please contact me first so I can try to resolve them.

You also have the right to complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113.

​

13. Automated decision-making

I do not currently use personal information to make decisions about you solely through automated processing, including profiling, that have legal or similarly significant effects on you.

​

14. Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes to my services, website or legal obligations. The latest version will be published on this website, with the date of the most recent update.

​

15. Contact

If you have questions about this Privacy Policy or how I handle your personal information, please contact:

Jessica Ricci

Email: dr.jessica.ricci@gmail.com

Telephone: +44 7562 581120

Location: London, United Kingdom