Privacy Policy

Who is responsible for your information

JemSpace is operated by Jemma Dennis, a psychotherapist registered with the British Association for Counselling and Psychotherapy, and registered with the Information Commissioner’s Office. She is the data controller.

You can contact her about anything on this page at jemma@jemmadennis.com.

What we collect

• Your name and email address, so you can sign in and be contacted.
• Your journal entries. These are likely to include information about your health and state of mind, which UK GDPR treats as special category data and protects more strictly.
• A record of your consent, including which boxes you ticked, the exact wording you agreed to, and the date, time and IP address of the request. This exists so we can show what you were asked and what you agreed.
• Your display preferences, meaning the font and colour you chose for your own journal.
• A log of every time Jemma opens your entries. This protects you, not us: it means access can be accounted for.

We do not collect your date of birth, your age, your gender, or whether you are in therapy elsewhere. We do not use analytics, advertising, or tracking of any kind. There are no third-party scripts, and fonts are served from our own servers rather than fetched from Google, so your visit is not disclosed to anyone else.

Why we are allowed to hold it

For your account and the running of the service, our basis is performance of our agreement with you.

For your journal entries, which may contain health information, our basis is your explicit consent, given at sign-up. You can withdraw that consent at any time by deleting your account. Withdrawing it does not undo processing that has already happened.

Who can see your entries

Jemma, and nobody else. Not other clients, and not other staff, because there are none.

This is enforced by the database itself, not merely by the app. Each person can only ever retrieve their own rows, so a fault in the website cannot expose one client’s journal to another. Jemma’s own account requires a second factor as well as a password.

Confidentiality has narrow limits. In exceptional circumstances Jemma may be required by law, or permitted by her professional obligations, to share information, for example where there is a serious and immediate risk of harm. Her therapy agreement sets out how she handles that.

Where your information is held

Your entries are stored in a database in London, encrypted at rest, and encrypted in transit whenever they travel.

The website itself currently runs on servers in the United States, which means your entries pass through the United States at the moment they are displayed to you, even though they are stored in the UK. This is being moved to London. Until then, that transfer relies on our hosting provider’s standard data protection terms.

Who else is involved

• Supabase stores the database, in London.
• Netlify runs the website.
• Resend sends emails, such as confirming your address or resetting your password. Emails never contain your journal entries.

Each acts only on our instructions. Your information is never sold, never used for advertising, and never shared with anyone else.

How long we keep it

Your entries stay until you ask us to delete them. There is no automatic expiry, because your journal is yours for as long as you want it.

When an account is deleted, the deletion is permanent and immediate: entries, account details and consent records are destroyed, and no backup copy is retained for later restoration. We keep one thing, a dated note that a deletion took place, containing nothing you wrote. Without it there would be no way to show a request had been honoured.

Your rights

You can ask us to:

• give you a copy of everything we hold about you
• correct anything that is wrong
• delete your account and everything in it
• stop processing your information, or restrict how we use it

You can start a deletion yourself in your settings. For anything else, email Jemma. We will respond within one month.

If you are unhappy with how your information has been handled you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.

Cookies

JemSpace sets one kind of cookie: the one that keeps you signed in. There are no analytics cookies, no advertising cookies, and nothing that follows you to other websites. That is why you are not asked to accept anything.