Privacy Policy
Mainstone Consulting
Last updated: 11 October 2026
1. Introduction
Mainstone Consulting is committed to protecting your privacy and handling personal information responsibly, securely and transparently.
This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us or access our professional services.
Our services include clinical supervision, EMDR consultation, professional training, neurodivergence consultancy and organisational support.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
2. Who We Are
Mainstone Consulting is operated by Jodie Mainstone, an accredited psychotherapist, EMDR Europe Accredited Consultant Supervisor and mental health trainer.
Website: www.mainstoneconsulting.co.uk
Email: jodie@mainstonecounselling.com
For the purposes of data protection legislation, Mainstone Consulting is the data controller for personal information collected and processed directly through its services, unless otherwise agreed in a specific contractual arrangement.
3. What Information We Collect
Depending on the nature of your enquiry or professional relationship with us, we may collect:
Your name, email address, telephone number and professional contact details.
Professional qualifications, registration details and organisational affiliations.
Information provided when enquiring about or booking supervision, consultation or training.
Information relevant to clinical supervision or professional case consultation.
Information about accessibility requirements or reasonable adjustments.
Booking, invoicing, payment and financial administration records.
Correspondence and other information voluntarily shared with us.
Limited technical information collected through our website, where applicable.
Where necessary, we may also process sensitive personal information, including information relating to health, disability or neurodivergence.
We only collect information that is relevant and necessary for the services being provided.
4. How We Use Your Information
We use personal information to:
Respond to enquiries and communicate about our services.
Arrange and deliver clinical supervision, EMDR consultation, training and consultancy.
Maintain appropriate professional and administrative records.
Manage appointments, bookings, payments and invoices.
Provide reasonable adjustments and support accessibility needs.
Meet legal, ethical, safeguarding and professional obligations.
Maintain the security and effective operation of our website and services.
We do not sell personal information to third parties.
We do not use personal information for unrelated marketing purposes without an appropriate lawful basis.
5. Our Lawful Basis for Processing Information
Under UK GDPR, we must have a lawful basis for collecting and using personal information.
Depending on the circumstances, we may rely on the following:
Contract: Where processing is necessary to provide services you have requested or to take steps before entering into a professional agreement.
Legal obligation: Where information must be processed to comply with applicable legal requirements.
Legitimate interests: Where processing is necessary for the reasonable operation and administration of our professional services, provided these interests do not override your rights and freedoms.
Consent: Where consent is the appropriate lawful basis, including certain optional communications or uses of information.
Where we process special category information, such as health or disability information, we will also identify an appropriate additional condition under Article 9 of UK GDPR.
This may include explicit consent or another applicable condition, depending on the nature and purpose of the processing.
6. How We Collect Your Information
We usually obtain personal information directly from you when you contact us, complete an enquiry or booking form, register for training or engage in supervision or consultancy.
Where appropriate and lawful, we may also receive relevant information from organisations, professional colleagues or other individuals involved in arranging or delivering our services.
Information relating to third parties discussed during supervision or professional consultation should be anonymised wherever reasonably possible.
7. How Long We Keep Your Information
Mainstone Consulting retains personal information only for as long as necessary for the purposes for which it was collected, including meeting legal, professional and contractual obligations.
Records relating to clinical supervision, professional consultation, training and organisational consultancy will generally be retained for seven years following the end of the professional relationship or completion of the service, in accordance with our record retention policy.
Information relating to enquiries, bookings and general correspondence may be retained for shorter periods where appropriate.
Financial records will be retained in accordance with applicable tax and accounting requirements.
Records may be retained for longer where necessary to meet legal obligations, safeguarding responsibilities, professional requirements or legitimate legal claims.
Once information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
8. Who We Share Your Information With
We treat personal information confidentially and only share it where there is a legitimate and lawful reason to do so.
This may include:
Administrative or technical service providers supporting the operation of our business.
Professional advisers, accountants or insurers where necessary.
Relevant organisations where information sharing is required under an agreed professional arrangement.
Regulatory, safeguarding or legal authorities where disclosure is required or justified by law.
Any information shared will be limited to what is necessary for the relevant purpose.
We do not share identifiable clinical information for training, supervision or consultation purposes without an appropriate lawful basis.
9. Confidentiality in Supervision and Consultation
Confidentiality is central to our professional practice.
Individuals accessing clinical supervision or professional consultation are expected to protect the confidentiality of their own clients and follow applicable professional and organisational requirements.
Clinical material should be anonymised wherever reasonably possible, with identifying details removed unless disclosure is necessary and lawful.
Information discussed during supervision or consultation will be handled in accordance with professional ethical standards and applicable data protection requirements.
Confidentiality may be limited where disclosure is legally required or necessary to address serious safeguarding concerns or risks of significant harm.
Where possible and appropriate, any such disclosure will be discussed with the individual concerned.
10. How We Protect Your Information
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include secure electronic storage, password protection, restricted access to confidential information and appropriate methods of communication.
Access to personal information is limited to those who have a legitimate reason to access it.
Although no method of electronic storage or communication can be guaranteed to be completely secure, we take data protection responsibilities seriously and review our arrangements where necessary.
11. Your Data Protection Rights
Under UK GDPR, you have certain rights regarding your personal information.
Depending on the circumstances, these may include:
The right to be informed: To understand how your information is collected and used.
The right of access: To request access to personal information held about you.
The right to rectification: To request correction of inaccurate or incomplete information.
The right to erasure: To request deletion of information in certain circumstances.
The right to restriction: To request restriction of processing in certain circumstances.
The right to object: To object to certain types of processing.
The right to data portability: To request transfer of certain information where applicable.
The right to withdraw consent: To withdraw consent where processing is based on consent.
These rights are not absolute and may be subject to legal or professional exceptions.
To exercise your rights, please contact Mainstone Consulting using the details provided in this policy.
We will respond without undue delay and generally within one month, subject to any applicable extension or exemption.
For more information about your rights, visit the Information Commissioner's Office (ICO) website: https://ico.org.uk/
12. Website Cookies and Analytics
Our website may use cookies or similar technologies to support its functionality, security and performance.
Where optional analytics or other non-essential cookies are used, appropriate information and consent mechanisms will be provided in accordance with applicable legislation.
You can manage cookies through your browser settings and any cookie preference tools available on our website.
13. External Websites and Third-Party Services
Our website may contain links to external websites or services.
Mainstone Consulting is not responsible for the privacy practices or content of external websites. We recommend reviewing the privacy policies of any external services you choose to access.
Where we use third-party providers for website hosting, communications, bookings or administration, we take appropriate steps to ensure personal information is handled securely and lawfully.
14. International Data Transfers
Some technology or service providers may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation.
15. Safeguarding and Legal Obligations
There may be exceptional circumstances in which information needs to be disclosed without consent.
These may include situations involving serious safeguarding concerns, significant risk of harm or a legal requirement to disclose information.
Any decision to share information will be considered carefully, taking account of confidentiality, professional responsibilities, proportionality and applicable law.
Only information necessary for the relevant purpose will be disclosed.
16. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in legislation, professional guidance, our services or how we process personal information.
The most recent version will be available on our website, together with the date of the latest update.
17. Contact and Complaints
If you have any questions about this Privacy Policy, how your information is handled or wish to exercise your data protection rights, please contact:
Jodie Mainstone
Mainstone Consulting
Website: www.mainstoneconsulting.co.uk
Email: jodie@mainstonecounselling.com
If you are dissatisfied with how your personal information has been handled, you also have the right to raise a concern with the Information Commissioner's Office (ICO).
Information Commissioner's Office
Website: https://ico.org.uk/
Telephone: 0303 123 1113