Version: 2.0
Date: 28th August 2026
Review date: 28th August 2027
Owner: LJD Music

1. About this Privacy Notice

This Privacy Notice explains how LJD Music collects, uses, stores, shares and protects personal information in connection with my professional work.

LJD Music is operated by a single practitioner; Laura Jayne Duncan. I provide music therapy, music tuition and related professional services, including professional supervision, consultancy and associated educational or professional activities including professional networking.

This notice applies to personal information processed through these activities.

Different types of processing may have different purposes and lawful bases. I do not rely on a single lawful basis for all processing.

Where I provide services within an organisation, the organisation and LJD Music will establish the appropriate data-protection responsibilities for the relevant processing. Depending on the circumstances, the organisation may be the controller, I may be an independent controller, or different arrangements may apply to different processing activities.

I aim to process personal information in a way that is lawful, fair, transparent, proportionate and appropriate to the nature and risks of my work.

2. Who is responsible for your information?

LJD Music is operated by a single music therapist and practitioner.

Name: Laura Jayne Duncan

Email: laura.duncan@ljdmusic.com 
Telephone: 07711 798 968
 

Address: Office 1786, 3 Fitzroy Place, 1/1 Sauchiehall Street, Finnieston, Glasgow Central, G3 7RH 

LJD Music uses a virtual office address for mail receipt only. This address is not a therapy, tuition or appointment location.

Mail is collected in person by LJD Music and should not be opened by the virtual office provider. All correspondence relating to LJD Music Services should be made by email or telephone directly with Laura Jayne Duncan.

Depending on the circumstances, I may act as:

• an independent controller, where I determine the purposes and means of processing; 
• a processor, where an organisation determines the purposes and means of processing and I process information on its documented instructions; 
• a joint controller, where the legal requirements for joint controllership are met. 

The appropriate relationship will be determined according to the actual circumstances rather than simply the type of service being provided.

3. What personal information may I collect?

The information I collect depends on the service and the circumstances. It may include:

Identification and contact information

• name; 
• contact details; 
• address where necessary; 
• date of birth or age where necessary; 
• emergency contact information where appropriate; 
• information about parents, carers or representatives where relevant. 

Service information

This may include:

• referral information; 
• enquiries; 
• appointment information; 
• attendance; 
• music therapy goals; 
• tuition requirements; 
• lesson planning; 
• professional supervision or consultancy arrangements; 
• relevant correspondence; 
• feedback; 
• reports; 
• other information necessary to provide the service. 

Professional information

Where I provide supervision or consultancy, this may include information about:

• professional role; 
• area of practice; 
• professional development; 
• work-related circumstances; 
• professional questions or issues brought for discussion; 
• information necessary to provide supervision or consultancy. 

I will seek to keep information about third parties to what is reasonably necessary for the professional purpose.

Special-category information

Music therapy records may contain information concerning:

• health; 
• disability; 
• care or support needs; 
• psychological or emotional wellbeing; 
• communication needs; 
• other information falling within the special categories of personal data. 

I seek to minimise the collection of sensitive information where it is not necessary.

4. How I collect information

I may receive information:

• directly from you; 
• from a parent, carer or representative; 
• from a referrer; 
• from a school, care provider, healthcare professional or other organisation; 
• from another professional appropriately involved in your care or support; 
• from a commissioning organisation; 
• through enquiries or correspondence; 
• through online service arrangements; 
• from other appropriate professional sources. 

I may receive personal information about another individual from someone else where this is relevant to providing or administering a service.

I do not currently receive audio recordings, video recordings or photographs from other people as part of my practice.

Where recordings or photographs are made within my practice, they are recordings or photographs made by me during music therapy or music tuition and are subject to the applicable consent arrangements.

5. Music therapy

I may process personal information to:

• assess whether music therapy is appropriate; 
• receive and consider referrals; 
• plan therapy; 
• provide music therapy; 
• maintain appropriate professional records; 
• monitor and review therapy; 
• communicate with clients, families, carers and relevant professionals; 
• manage payments; 
• arrange sessions; 
• support safeguarding; 
• coordinate appropriate care or support; 
• meet professional, legal and regulatory responsibilities. 

Music therapy records may contain special-category information.

Where I am acting as an independent controller, the applicable lawful basis will depend on the particular processing purpose and circumstances.

Where I act as a processor for an organisation, the organisation determines the purposes and lawful basis and I process information in accordance with its documented instructions and the applicable data-processing arrangements.

6. Online music therapy

Where appropriate, music therapy may be provided online. Online sessions may use platforms such as:

• Microsoft Teams; or 
• Zoom. 

Where these platforms are used, I will take reasonable steps to maintain appropriate security.

This may include:

• unique meeting IDs; 
• meeting passwords; 
• restricting access to invited participants; 
• requiring participants to sign in where appropriate; 
• avoiding publicly accessible meeting links where reasonably practicable; 
• using available platform security settings appropriate to the session. 

I will not record an online therapy session unless recording is specifically appropriate and the applicable consent requirements have been met.

7. Music tuition

I may provide individual or other appropriate music tuition.

I may process information to:

• arrange lessons; 
• communicate with students, parents or representatives; 
• understand tuition requirements; 
• plan lessons; 
• provide tuition; 
• record attendance; 
• monitor progress; 
• manage payments; 
• communicate about lessons; 
• maintain appropriate professional and business records. 

The information processed for tuition will normally be less extensive than information processed for music therapy.

Where health or other special-category information is volunteered or is necessary to make appropriate arrangements, I will handle it in accordance with the applicable data-protection requirements.

8. Online music tuition

Where appropriate, music tuition may be provided online. Online lessons may use platforms such as:

• Microsoft Teams; or 
• Zoom. 

Where these platforms are used, I will take reasonable steps to maintain appropriate security.

This may include:

• unique meeting IDs; 
• meeting passwords; 
• restricting access to invited participants; 
• requiring participants to sign in where appropriate; 
• avoiding publicly accessible meeting links where reasonably practicable;
• using available platform security settings appropriate to the lesson. 

I will not record an online music lesson unless recording is specifically appropriate and the applicable consent requirements have been met.

9. Recording and photography

I may make audio recordings, video recordings or photographs during music therapy or music tuition. Recording or photography is generally optional and not a condition of receiving therapy or tuition. Where recording is necessary for risk management or safeguarding, it is considered separately from optional recording. Consent for public use of recordings is always separate and optional.

There must be a specific professional reason for recording or photography.

Where consent is the appropriate basis, I will obtain the relevant consent through the LJD Music Recording, Photography and Media Consent Form.

The consent form distinguishes between:

• audio recording; 
• video recording; 
• photography; 
• professional use; 
• publicity use. 

I do not assume that consent to one of these activities automatically provides consent to another.

10. Recordings and photographs from music therapy

Therapy recordings or photographs may be used for purposes covered by the applicable consent, such as:

• professional reflection; 
• supervision; 
• professional development; 
• clinical review; 
• training or education; 
• professional presentation.

Identifiable therapy recordings and photographs are normally stored on an encrypted, password-protected hard drive and are not routinely stored in Microsoft 365/OneDrive under the current LJD Music data system.

Recordings and photographs are normally securely deleted within 6 months after therapy ends, unless:

• there is another lawful reason to retain them; or 
• specific written consent covers continuing professional or publicity use. 

Where specific written consent covers continuing professional or publicity use, material may be retained for up to 30 years, where there remains a genuine documented professional or publicity purpose. Thirty years is a maximum, not an automatic retention period.

11. Recordings from music tuition

Music lessons may be audio or video recorded where there is a specific professional reason and explicit written consent or other appropriate permission has been obtained.

Possible purposes may include:

• supporting teaching and learning; 
• reviewing musical performance; 
• feedback; 
• exam preparation and submission;
• another specifically identified professional purpose. 

Where there is no continuing legal, professional or other lawful reason to retain a tuition recording, it will normally be securely deleted within 6 months after tuition ends. Where specific written consent or permission permits continuing retention of a tuition recording, it may be retained for up to 30 years, subject to there being a continuing documented purpose. Thirty years is a maximum and does not mean that recordings will automatically be kept for that period.

12. Professional and publicity use

I may wish to use identifiable recordings or photographs for specific professional or publicity purposes.

These may include:

• professional presentations; 
• professional education or training; 
• professional publications; 
• professional portfolio material; 
• the LJD Music website; 
• LJD Music social media; or 
• LJD Music publicity or marketing. 

This is separate from ordinary recording for therapy or tuition.

Where identifiable material is to be used for these purposes, I will rely on specific explicit consent or another appropriate lawful basis. I will not assume that consent to recording or photography automatically permits public or external use.

Where consent is withdrawn, I will stop new processing that relies on that consent and consider whether existing material can or should be deleted, taking account of any other applicable lawful reason for retention.

13. Professional supervision

I may provide professional supervision to other professionals and musicians as part of my professional practice. Supervision may support professional practice, reflection, development, ethical decision-making, therapeutic or musical practice and other appropriate professional matters.

People using this service may include, for example:

• community musicians; 
• arts therapists; 
• allied health professionals; 
• professional musicians;  
• recording musicians; 
• other professionals whose work is relevant to my areas of expertise. 

Information discussed during supervision will normally relate to the supervisee's professional practice. Where information about another individual is discussed, I will encourage appropriate anonymisation or de-identification wherever reasonably practicable.

Where identifiable personal information genuinely needs to be discussed for a professional reason, I will consider the applicable lawful basis and special-category condition. I will not use supervision as a basis for unnecessarily collecting identifiable information about clients or service users.

14. Consultancy

I may provide professional consultancy to professionals, organisations and musicians.

Consultancy may concern areas such as:

• professional practice; 
• music practice; 
• therapeutic or arts-based practice; 
• professional development; 
• service development; 
• education; 
• recording or music-related professional practice; or 
• other matters within my professional competence. 

I will process only information reasonably necessary for the consultancy purpose.

Where information about third parties is provided, I will seek to minimise identifiable information where this is reasonably practicable.

15. Professional networking

I may participate in professional networking and maintain professional contacts.

This may involve processing:

• names; 
• professional contact details; 
• professional roles; 
• organisation information; 
• correspondence; 
• networking information; and 
• other information reasonably necessary for professional communication. 

This information may be held in appropriate business systems. Professional networking information will not be treated as clinical information simply because the contact may also work within health, social care, education, music or the arts.

16. Information received from other people

I may receive personal information from:

• parents or carers; 
• referrers; 
• healthcare professionals; 
• education professionals; 
• care providers; 
• commissioning organisations; 
• other professionals; 
• people appropriately involved in an individual's care or support. 

This may be necessary for:

• referral; 
• assessment; 
• therapy planning; 
• tuition arrangements; 
• safeguarding; 
• communication; 
• professional coordination; 
• administration. 

I do not currently receive audio, video or photographic material from other people as part of my practice.

17. Professional reflection, supervision and anonymised material

I may use genuinely anonymised professional material for:

• professional reflection; 
• supervision; 
• continuing professional development; 
• training; 
• education; 
• quality improvement; 
• service development; and 
• development of professional or therapeutic resources. 

Where information has been genuinely anonymised so that an individual is no longer identifiable, it is no longer personal data for UK GDPR purposes.

Where information remains identifiable, I will treat it as personal data and apply the relevant data-protection requirements.

18. Safeguarding

Safeguarding is an important part of my professional responsibilities. I may process and share personal information where this is necessary and lawful to protect a child, young person or adult at risk from harm. 

I may share relevant information with appropriate:

• safeguarding professionals; 
• social work services; 
• healthcare professionals; 
• education professionals; 
• emergency services; 
• Police Scotland; 
• local authorities; or 
• other relevant authorities or professionals. 

I will normally seek to share only information that is relevant and necessary for the purpose.

Consent is not always required for safeguarding disclosures.

Where I work within an organisation, I will also follow the organisation's safeguarding and information-sharing procedures.

Further information is provided in the LJD Music Safeguarding Children, Young People and Adults at Risk Policy.

19. Legal, professional and regulatory responsibilities

I may process personal information where necessary to:

• comply with legal obligations; 
• maintain professional records; 
• meet professional standards; 
• respond to regulatory matters; 
• maintain appropriate insurance; 
• establish, exercise or defend legal claims; 
• respond to complaints; 
• manage incidents; 
• cooperate with appropriate authorities; or 
• protect legitimate professional interests. 

I am registered with the Health and Care Professions Council (HCPC) as an Arts Therapist (Music) / Music Therapist and maintain appropriate professional responsibilities, including continuing professional development and professional accountability. I may process information necessary to meet those responsibilities.

20. Financial and business administration

I process personal information to manage: 

• invoices; 
• payments; 
• accounting; 
• taxation; 
• business administration; 
• professional expenses; 
• related financial matters. 

I use FreeAgent accounting software and Mettle business banking as part of my financial and business administration. These connected systems may hold or share personal information where necessary for invoices, receipts, payments, expenses, accounting, taxation and related administration. Any sharing of personal information is minimised and limited to what is necessary for those purposes.

I do not routinely collect or retain clients' bank-account or payment-card details. Where payment is made by bank transfer, my own bank details are provided to the payer. Information about payments received may form part of my financial records.

Financial and tax information may also be shared with HMRC or other relevant authorities where legally required, or with clients, commissioning organisations or other relevant parties where appropriate. 

Financial and tax records are retained in accordance with applicable legal requirements.

21. Microsoft 365, OneDrive and other systems

I may use Microsoft 365/OneDrive for appropriate business and administrative information.

This may include:

• routine correspondence;  
• general business administration; 
• professional networking information; 
• appropriate non-clinical records; and 
• genuinely anonymised professional material. 

Identifiable therapy records and retained identifiable therapy recordings containing special-category information are not routinely stored in Microsoft 365/OneDrive under the current LJD Music data system.

I may also use other appropriate business systems, including FreeAgent accounting software and Mettle business banking, for financial and business administration.

If the systems I use change, I will review the associated security, privacy and international-transfer implications.

22. Encrypted storage and backup

Where I store identifiable therapy records or other appropriate sensitive information for my independent practice, these are normally stored using an encrypted hard drive with a separate encrypted backup. Access is restricted to me, unless another lawful or professional reason requires access.

Where records are created, stored or accessed as part of work with an organisation, the storage, access and backup arrangements may depend on the relevant organisational arrangements, service agreement, data-protection responsibilities or documented instructions.

Backup copies exist to provide resilience against accidental loss, damage or technical failure. Backup copies follow the applicable retention and deletion arrangements.

23. Security

I take reasonable and proportionate technical and organisational measures to protect personal information.

These include, as appropriate:

• encrypted storage; 
• password protection; 
• device security; 
• restricted access; 
• multi-factor authentication where available; 
• secure communication methods; 
• data minimisation; 
• anonymisation or de-identification; 
• controlled information sharing; 
• retention periods; 
• periodic retention review; 
• secure deletion or destruction. 

No electronic system can be guaranteed to be completely secure. I nevertheless take reasonable steps appropriate to the nature and sensitivity of the information I process.

24. International transfers

I do not currently anticipate transferring identifiable clinical or special-category information outside the UK. I aim to keep such information within the UK wherever reasonably practicable.

If a service, software provider, support provider, organisation or other arrangement involves personal information being stored, accessed or processed outside the UK, I will assess the applicable UK data-protection requirements. This may include considering where the information is processed, why this is necessary, what safeguards are in place and whether any additional measures are required.

International-transfer arrangements will be reviewed if the systems, services or organisational arrangements I use change.

25. Who may receive personal information?

Depending on the circumstances, information may be shared with:

• clients or students; 
• parents, carers or representatives; 
• referrers; 
• schools or education providers; 
• healthcare professionals; 
• care providers; 
• commissioning organisations; 
• safeguarding professionals; 
• local authorities; 
• emergency services; 
• professional supervisors; 
• professional advisers; 
• accountants or bookkeepers; 
• insurers; 
• legal advisers; 
• regulators; 
• HMRC; 
• virtual office providers, used only for receiving unopened business mail for collection in person by LJD Music; 
• other authorities or professionals where there is an appropriate lawful reason. 

I do not sell personal information.

I aim to share only information that is relevant, necessary and proportionate to the purpose.

26. Your data-protection rights

Depending on the circumstances, you may have rights under UK data-protection law, including rights to:

• be informed about how your information is used; 
• access your personal information; 
• request correction of inaccurate information; 
• request erasure in certain circumstances; 
• request restriction of processing in certain circumstances; 
• object to certain processing; 
• request data portability where applicable; and 
• withdraw consent where processing relies on consent. 

These rights are not absolute. Whether a particular right applies depends on the circumstances, including the lawful basis for processing and whether there is another legal, professional or regulatory reason for retaining or processing the information.

27. Subject Access Requests

You may request access to personal information I hold about you. A request can be made by contacting me using the details at the end of this notice. I may need to take reasonable steps to confirm your identity before providing information. I will normally respond within the applicable legal time limit.

A Subject Access Request may require me to:

• identify which records relate to you; 
• search relevant systems; 
• review records; 
• consider information about other people; 
• consider confidentiality; 
• consider legal restrictions or exemptions; 
• consult relevant organisations or processors where necessary; and 
• prepare information for disclosure. 

For this reason, responding to a request is not necessarily as simple as producing or exporting a single electronic file. Where therapy records contain information about other people, or where records are held within an organisational arrangement, I may need to consider the rights and confidentiality of others and the respective responsibilities of the organisation and LJD Music.

Where another organisation is the controller of the relevant information, I may need to direct the request to that organisation or coordinate with it as appropriate.

Further information is contained in the LJD Music Subject Access Request (SAR) Procedure.

28. Requests for deletion

You may have a right to request deletion of personal information in certain circumstances.

However, the right to erasure is not absolute. I may need to retain information where there is another lawful reason to do so, including where information is required for:

• legal obligations; 
• professional accountability; 
• regulatory requirements; 
• safeguarding; 
• establishing or defending legal claims; 
• financial or tax requirements; 
• insurance purposes; 
• other lawful purposes. 

Deletion may also not be straightforward where information forms part of a wider record, includes information about other people, is held by an organisation as controller, or exists in backup systems.

Where deletion is appropriate, I will take reasonable steps to delete or securely destroy the relevant information in accordance with the LJD Music Data System, Retention and Deletion Policy.

29. Retention of personal information

I do not retain personal information indefinitely simply because it has been collected.

Retention depends on:

• the purpose for which information was collected; 
• the type and sensitivity of the information; 
• professional requirements; 
• legal requirements; 
• regulatory requirements; 
• safeguarding considerations; 
• contractual circumstances; 
• whether there remains a genuine reason for retaining it. 

Current retention arrangements include:

• Independent-practice music therapy records; Normally 7 years after therapy ends, subject to the LJD Music Data, Retention and Deletion Policy and any circumstances requiring a different period.
• Tuition records; Where there is no legal, professional or other lawful requirement to retain them, tuition records will normally be deleted within 6 months after tuition ends.
• Therapy and tuition recordings and photographs; Normally deleted within 6 months after therapy or tuition ends, unless another lawful reason applies. Where specific written consent or permission covers continuing professional or publicity use, relevant recordings or photographs may be retained for up to 30 years, subject to a continuing documented purpose.
• Financial and business records; Retained for the applicable legal and HMRC requirements. For self-employed records, relevant business and tax records will generally be retained for at least the applicable HMRC period.
• Organisational records; Where an organisation is the controller, records will normally be retained according to the organisation's applicable arrangements.

Retention periods are reviewed periodically.

30. Deletion and destruction

When information reaches the end of its applicable retention period, and there is no continuing lawful reason to retain it, I will securely delete or destroy it as appropriate.

This may involve:

• secure electronic deletion; 
• physical destruction; 
• deletion from relevant systems; or 
• other appropriate measures. 

Backup copies may not always be capable of immediate individual deletion. Where this applies, they will be managed in accordance with the LJD Music Data System, Retention and Deletion Policy and will be deleted through the applicable backup process.

31. Consent and withdrawal of consent

Where I rely on consent, consent will be voluntary and will be capable of withdrawal. You can withdraw consent by contacting me. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawal also does not automatically require deletion where another lawful basis or legal, professional or regulatory obligation requires information to be retained. For recording and photography, consent is separate from the provision of therapy or tuition.

32. Children and young people

Where I work with children and young people, I take particular care with privacy, safeguarding, consent and appropriate communication.

Depending on the circumstances, I may communicate with:

• parents/carers/people with parental responsibility; 
• schools; 
• healthcare professionals; 
• commissioning organisations; or 
• other appropriate professionals. 

The appropriate arrangements depend on the child's age, circumstances, legal rights, the nature of the service and the relevant organisational arrangements.

My safeguarding responsibilities may require information to be shared without consent where this is necessary and lawful to protect a child or another person from harm.

33. Online communication and social media

I may use electronic communication and professional social media as part of my work. I will seek to maintain appropriate professional boundaries and will avoid unnecessary sharing of confidential or sensitive information through social media.

LJD Music social media may contain professional information, educational material, music-related material, professional updates or publicity.

Identifiable photographs, audio or video recordings of clients or students will only be used for publicity or professional purposes where the appropriate explicit written consent or other lawful permission has been obtained.

34. Automated decision-making and AI

LJD Music does not currently use AI transcription, AI analysis or automated note-taking in therapy sessions, tuition sessions or professional meetings, and I do not currently make decisions about individuals using solely automated decision-making.

If I introduce AI, automated transcription, automated analysis or similar processing in the future, I will assess the privacy, security, lawful-basis, transparency and other data-protection implications before introducing it. Where necessary, the ROPA, Privacy Notice, DPIA and other relevant governance documents will be updated.

35. Complaints

If you have concerns about how I have handled your personal information, please contact me in the first instance so that I can investigate and respond appropriately.

Email: laura.duncan@ljdmusic.com 
Telephone: 07711 798 968
 

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your personal information has been processed unlawfully or that your data-protection rights have not been respected. The ICO's website provides information about making a complaint and exercising data-protection rights.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113 
Website: https://www.ico.org.uk/make-a-complaint

36. Changes to this Privacy Notice

This notice will be reviewed at least annually and sooner I where:

• my services change; 
• I introduce new technology or software; 
• my information systems change; 
• my recording or photography practices change; 
• I introduce AI or automated processing; 
• international-transfer arrangements change; 
• legal or regulatory requirements change; or 
• my actual processing activities materially change. 

The current version will be made available through the appropriate LJD Music channels.

37. Related LJD Music documents

This policy should be read alongside, where relevant:

• LJD Music Short Privacy Notices; 
• LJD Music Record of Processing Activities (ROPA); 
• LJD Music Lawful Basis Map; 
• LJD Music Data System, Retention and Deletion Policy (LJD Music data system); 
• LJD Music Music Therapy Agreement; 
• LJD Music Professional Supervision and Consultancy Agreement; 
• LJD Music Recording, Photography and Media Consent Form; 
• LJD Music Subject Access Request Procedure; 
• LJD Music Safeguarding Children, Young People and Adults at Risk Policy;
• relevant organisational Service Agreements; 
• applicable Data Protection Appendices. 

28. Review and approval

Policy reviewed by: LJD Music

Date: 28th August 2026

Next review date: 28th August 2027

Owner: LJD Music