Privacy Policy

Kayatz Counselling & Psychology | Last updated: 26 November 2026

1. Who I am and how to contact me

I am Dr Jonna Kayatz, an independent Psychological Counsellor (MBACP, SGfB), Chartered Counselling Psychologist (BPS, HCPC), and a therapist based in Zürich, Switzerland. I am responsible for deciding how your personal information is used (the “controller”).

Business registration: CHE-141.390.791. You can contact me at info@kayatzcounselling.ch or +41 79 817 0097.

This policy explains how I handle information about website visitors, people who enquire about my services, and clients. Swiss data protection law applies. The EU/UK GDPR may also apply where its territorial rules are met. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. 

 

2. Information I collect

Depending on how you interact with me, I may collect contact information, health and therapy-related information, and administrative information.

  • Website information, such as IP address, browser and device details, pages visited, referring website, and cookie or analytics information.

  • Enquiry information, such as your name, contact details (email, address, telephone number), appointment preferences and anything you choose to tell me about why you are seeking support -- please avoid including detailed health or other highly personal information in a website form or ordinary email. You can share what is needed during an initial conversation.

  • Client information, such as contact and emergency details, relevant health information, session notes, correspondence and information needed to provide safe, appropriate care, relevant medical history that you choose to share

  • Session notes about our therapeutic work together

  • Payment records and invoices

  • Information provided by someone referring you or acting on your behalf, or by a healthcare professional, where relevant and lawful.

3. Why I use your information

I use information to respond to enquiries, arrange consultations and appointments, provide and manage counselling or psychological services, keep appropriate clinical and administrative records, meet legal and professional obligations, protect safety, and maintain and secure this website.

I handle health information with particular care. Under Swiss law, I process information where justified by the provision and management of care, my legal or professional duties, or another lawful justification. If the GDPR applies, I rely on the relevant contractual, legal or legitimate-interest basis and, for health information, an applicable special-category condition. Where consent is the appropriate basis, I will ask for it and you may withdraw it; this does not affect earlier lawful processing.

4. Website hosting, forms, analytics and cookies

This website is hosted by Squarespace. Squarespace may process technical and usage information needed to deliver, protect and maintain the website. The site’s published privacy information also describes Squarespace analytics, which may use details such as your IP address, device and browser, pages visited, clicks and timestamps.

The website describes essential cookies as necessary for the site to function and analytics/performance cookies as used after you acknowledge the cookie banner. Cookie behaviour can change with settings and provider updates.

If you contact me through a website form, the information you submit may pass through or be temporarily stored by the website host before being delivered to me by email. The precise storage and deletion behaviour depends on the live form configuration. If you email or telephone me directly, I receive the information through that channel.

I do not use website enquiry information for advertising or newsletters.

I do not intentionally try to identify individual website visitors from analytics.

5. Online sessions and other service providers

Online sessions may take place using Zoom. Zoom and other providers involved in email, website hosting or communications may process information on my behalf to provide their services. Their own privacy terms also apply. I use providers and settings appropriate to the service, but information handled by online services may be processed outside Switzerland. Where required, I take legally appropriate steps for international transfers.

I do not share client information with insurers or other third parties. I may share relevant information with another healthcare professional or a person you authorize, when clinically needed and where appropriate, and with your permission. I may also disclose information where required or permitted by law, or where necessary to address a serious safety concern. I discuss such limits to confidentiality with clients as appropriate.

6. Confidentiality and supervision

I am required by BACP, SGfB, BPS and HCPC to attend regular clinical supervision. Supervision is essential part of safe and ethical therapeutic practice. It helps me reflect on my work and ensures I am providing you with the best possible care.  When discussing clinical work in professional supervision or consultation to support safe and ethical practice, I take reasonable steps to avoid identifying you. Supervision discussions focus on the therapeutic process and my professional development, not on identifying you as an individual.

  • Your name and any identifying details are not shared with my supervisor

  • I use anonymized or pseudonymized case material only

  • My supervisor is a qualified professional bound by the same confidentiality obligations as I am

  • My supervisor is bound by their own professional body’s ethical framework

 

I am committed to protecting your privacy and maintaining confidentiality at every stage, but confidentiality is not absolute: information may need to be disclosed in circumstances such as a legal requirement, child-protection concern or serious risk of harm.

  • Risk of serious harm: if I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep people safe.

  • Safeguarding concerns: if I become aware of concerns about the safety of a child or a vulnerable adult, I have a duty to report this to the relevant authorities.

  • Court order: if I receive a court order requiring me to disclose information, I am legally obliged to comply.

I will share only what is reasonably necessary in the circumstances. I will always try to discuss this with you first, unless doing so would itself put someone at risk.

 

7. Who I share your data with

I take your confidentiality seriously and only share your date where necessary and appropriate.

  • Clinical Supervisor: I discuss my clinical work in supervision. Only anonymized case material is shared. Your name and identifying details are never disclosed.

  • External bookkeeper: I use an external bookkeeper to help manage my accounts. They have access to invoice data only (your name and amounts you paid). They do not have access to any clinical information about you.

  • Third-party service providers: I use the following third-party services which may process your data: Squarespace (my website platform); Zoom (for online sessions). Each of these services is bound by data processing agreement.

I never sell your personal data.

8. Clinical will – what happens to your records if I am unable to practice:

I have appointed a Clinical Executor, a trusted fellow therapist, who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly.

If this happens, my Clinical Executor will:

  • Contact you to let you know I am no longer able to practise

  • Offer you a referral to another therapist if appropriate

  • Handle your records confidentially in accordance with this privacy policy

  • Ensure all client records are securely stored or destroyed according to the retention periods set out below

 My Clinical Executor is bound by professional confidentiality and will only access the minimum information necessary to contact you and manage records appropriately. They will not read your clinical notes unless absolutely necessary for safeguarding purposes.

 

9. How long I keep information

I retain clinical records for at least ten years after your last treatment, in accordance with applicable professional and legal requirements in Canton Zürich. Where appropriate, records may be retained for up to 20 years to protect legitimate legal interests, including in connection with potential liability claims.

Enquiry information from people who do not proceed with therapy is normally deleted within 12 months, unless there is a lawful reason to retain it for longer.

As a registered company, financial records are retained for 10 years.

I securely delete or anonymise personal information when it is no longer required, subject to applicable retention obligations. Paper records are schredded using cross-cut schredder. Electronic records are permanently deleted using secure deletion software.

10. Keeping information secure

I take reasonable technical and organisational steps to protect information against loss, misuse and unauthorised access. No website, email or online communication can be guaranteed completely secure. Please use an email account you trust and avoid sending detailed health information or unprotected sensitive documents through ordinary email. If a data breach affects your information, I will take the steps required by applicable law.

11. Your choices and rights

Depending on the law that applies, you may ask what personal information I hold about you, request a copy, ask me to correct inaccurate information, or request deletion or limits on use. These rights are not absolute; for example, I may need to keep certain records for legal or professional reasons. Where processing is based on consent, you may withdraw it. If the GDPR applies, you may also have rights to object to certain processing and to data portability.

To make a request or ask a question, contact me using the details in section 1. I may need to confirm your identity before providing information. You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC); if the GDPR applies, you may have the right to complain to a relevant data protection authority.

12. Changes to this policy

I aim to keep this policy updated when my practice, website or legal requirements change. If I make any significant changes that affect how your data is processed, I will inform you directly. The latest version will be published on this website www.kayatzcounselling.ch.