Privacy and data protection 

Privacy notice

Last updated: July 2026

Your privacy

Your privacy is important to me. I am committed to keeping your personal information safe and secure and to using it only for the purposes explained in this privacy notice.

I process personal information in accordance with applicable UK data protection legislation, including:

  • the UK General Data Protection Regulation (UK GDPR)

  • the Data Protection Act 2018

  • the Privacy and Electronic Communications Regulations 2003

  • the Data (Use and Access) Act 2025

This privacy notice explains:

  • what personal information I collect

  • why I collect and use it

  • my lawful basis for processing it

  • whether you are required to provide it

  • how long I keep it

  • who I may share it with

  • whether it may be transferred outside the UK

  • how I keep it secure

  • your data protection rights

Please contact me if you have any questions about how I collect, store or use your personal information.

Email: reflectionclinic@outlook.com

Who is responsible for your information

The person or organisation responsible for deciding how personal information is collected and used is called the data controller.

For the purposes of data protection law, I am the data controller for Reflection Clinic. I am registered with the Information Commissioner’s Office.

The information I collect

Depending on the circumstances, I may collect and process:

  • your name and contact details

  • your date of birth

  • your address

  • your GP’s contact details

  • emergency contact details

  • information provided by a parent, carer, referrer or healthcare professional

  • information about your physical and mental health

  • information about medication, treatment and previous therapy

  • information about risk, safety and safeguarding

  • appointment and attendance information

  • correspondence by email, telephone or text message

  • clinical assessment information and therapy notes

  • payment and invoicing information

  • information needed by an insurer or organisation funding your therapy

I will only collect information that is relevant and necessary for providing the service.

How I receive your information

I usually receive personal information directly from you when you contact me or attend an appointment.

In some circumstances, I may receive information from:

  • your GP or another healthcare professional

  • an insurer or organisation funding your therapy

  • a parent, carer or trusted person contacting me on your behalf

  • another professional involved in your care

Where appropriate, I will tell you that I have received information from another person or organisation.

Why I use your information

I may use your personal information to:

  • respond to an enquiry

  • assess whether my service is suitable for you

  • arrange and manage appointments

  • provide psychological assessment and therapy

  • communicate with you about your care

  • maintain appropriate clinical records

  • manage risk and safeguarding concerns

  • receive and record payments

  • communicate with an insurer or other funding organisation

  • meet my professional, legal, insurance and regulatory responsibilities

  • respond to complaints or legal claims

  • manage and improve my service

My lawful basis for using your information

Under Article 6 of the UK GDPR, I must have a lawful basis for processing your personal information.

When you contact me to enquire about therapy, or while I am providing therapy to you, I usually process your personal information because it is necessary to take steps at your request before entering into a contract or to perform the contract between us.

After therapy has ended, I may retain and use relevant information where this is necessary for my legitimate interests. These interests include maintaining appropriate clinical and business records, responding to complaints and establishing, exercising or defending legal claims.

In some circumstances, I may also process information because:

  • I have a legal obligation to do so

  • it is necessary to protect someone’s vital interests

  • it is necessary for safeguarding, responding to an emergency or preventing or investigating a serious crime

Special category information

Information about your physical or mental health is considered special category information and receives additional protection under data protection law.

My condition for processing health and other relevant special category information is Article 9(2)(h) of the UK GDPR. This allows information to be processed when it is necessary for the provision or management of health or social care or treatment.

This processing is also subject to the Data Protection Act 2018 and my professional duty of confidentiality.

Where necessary, other lawful conditions may apply, for example when information is required for safeguarding, legal proceedings or the protection of someone’s vital interests.

Whether you have to provide information

You are not required to provide personal information simply because I request it.

However, I need some information to:

  • consider whether I can offer you therapy

  • communicate with you

  • arrange appointments

  • provide therapy safely and effectively

  • meet my professional and legal responsibilities

I may be unable to offer or continue therapy if you do not provide information that is necessary for these purposes.

Initial enquiries

When you contact me about therapy, I may collect your name, contact details and basic information about the reason for your enquiry.

If another person or professional contacts me on your behalf, I may also receive information from them.

If you decide not to proceed with therapy, I will normally delete the personal information collected during your enquiry within one week, unless there is a legitimate or legal reason to retain it for longer.

You can ask me to delete this information sooner.

While you are receiving therapy

I will keep relevant personal, appointment and clinical information to allow me to provide therapy safely and effectively.

I will also make brief clinical notes following appointments. These may include:

  • the main issues discussed

  • relevant assessment information

  • therapy interventions

  • agreed plans

  • information about risk or safeguarding

  • relevant clinical decisions

Where possible, clinical notes are pseudonymised. This means that they are identified using a client code rather than your name. Information that connects your name with your client code is stored separately and securely.

Confidentiality

Information discussed during therapy is confidential.

However, confidentiality is not absolute. I may need to share relevant information when:

  • I believe that you or another person may be at serious risk of harm

  • there is a safeguarding concern involving a child or an adult at risk

  • disclosure is required by law or by a court order

  • disclosure is necessary to prevent or investigate a serious crime

  • information is required by an insurer or funding organisation under the terms of your agreement

  • you have given permission for information to be shared

Where possible, I will discuss this with you before sharing information. There may be circumstances where it is not appropriate or safe to do so.

I will only disclose information that is relevant and necessary for the purpose.

Clinical supervision

As part of safe and ethical professional practice, I attend regular clinical supervision.

I may discuss aspects of my clinical work with a suitably qualified supervisor. I will minimise identifying information and will not usually disclose your full name or contact details.

My clinical supervisor is also required to maintain confidentiality.

Communication by email and text message

Email and text messages may not always be fully secure. Please consider the amount and type of personal information you include when contacting me in this way.

I do not normally retain text messages for longer than six months.

Email correspondence will normally be deleted six months after our last therapy contact unless:

  • it forms part of the clinical record

  • it remains relevant to your care

  • it is needed for safeguarding

  • it is required for a complaint, legal matter or insurance purpose

  • I am required to retain it by law

How long I keep your information

I keep personal information only for as long as it is needed for the purpose for which it was collected.

Clinical records are normally retained for six years after therapy has ended. They are then securely deleted or destroyed.

Records may be kept for longer where this is necessary because of:

  • safeguarding concerns

  • an ongoing complaint or legal matter

  • professional or insurance requirements

  • a legal or regulatory requirement

Records relating to clients under the age of 18 may need to be retained for a longer period in accordance with professional and insurance requirements.

Financial and payment records will be retained for the period required by tax and accounting legislation.

The right to erasure does not always mean that clinical records can be deleted immediately. I may need to retain information where there is a lawful, professional, safeguarding or insurance reason to do so.

Who I may share information with

I do not sell your personal information.

Where necessary and proportionate, I may share relevant information with:

  • my clinical supervisor

  • your GP or another healthcare professional

  • emergency services

  • safeguarding services

  • an insurer or organisation funding your therapy

  • my professional indemnity insurer

  • my accountant or bookkeeper

  • legal or professional advisers

  • courts, regulators or law enforcement agencies

  • organisations providing secure email, video appointment, website, payment, data storage or administrative services

Where a service provider processes information on my behalf, I take reasonable steps to ensure that it has appropriate confidentiality, security and data protection arrangements.

Video appointments

I usually use Microsoft Teams for online appointments.

Microsoft may process limited personal and technical information when providing this service. Information about how Microsoft processes personal information is available in the Microsoft privacy statement:

https://privacy.microsoft.com/en-gb/privacystatement

I will not record an online appointment unless this has been discussed with you and you have given specific consent.

Transfers outside the UK

Some technology providers may process or store information outside the UK.

Where personal information is transferred outside the UK, I will use providers that have appropriate safeguards in place. These may include UK adequacy regulations, approved contractual protections or other lawful transfer mechanisms.

Automated decision-making and profiling

I do not use automated decision-making or profiling to make decisions about your therapy or access to my services.

Data security

I take reasonable steps to protect personal information from loss, unauthorised access, misuse, alteration or disclosure.

These measures include:

  • password-protected computers, mobile devices and email accounts

  • secure passwords and device access controls

  • antivirus and security software

  • keeping clinical and identifying information separate where possible

  • pseudonymising clinical notes

  • limiting access to personal information

  • securely deleting or destroying records when they are no longer required

No electronic communication or storage system can be guaranteed to be completely secure. I regularly review the measures I use to protect personal information.

Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • ask for access to the personal information I hold about you

  • ask me to correct inaccurate or incomplete information

  • ask me to delete your personal information

  • ask me to restrict how I use your information

  • object to how I use your information

  • receive certain information in a portable format

  • withdraw consent where consent is the lawful basis for processing

These rights are not absolute. In some circumstances, I may be required or permitted to continue retaining or processing information.

You can make a request verbally or in writing. You do not need to use any particular wording.

To make a request, contact:

reflectionclinic@outlook.com

I may need to ask for information to confirm your identity before responding. I will normally respond within one month.

If I hold information about you, I can:

  • explain what information I hold and where it came from

  • explain why I am using it

  • explain how long I intend to keep it

  • explain who it has been or may be shared with

  • provide a copy in a clear and understandable format

Your right to object

You have the right to object to certain uses of your personal information, particularly where I am relying on legitimate interests.

I will consider any objection carefully. I may continue processing the information if I have compelling legitimate grounds or if it is needed for the establishment, exercise or defence of legal claims.

Data protection complaints

Please contact me if you are concerned about how I have collected, stored, shared or used your personal information.

You can make a complaint by emailing:

reflectionclinic@outlook.com

I will:

  • acknowledge your complaint within 30 days

  • investigate it fairly and without undue delay

  • keep you informed where appropriate

  • explain the outcome without undue delay

I welcome feedback about how I can improve my data protection procedures.

You also have the right to complain to the Information Commissioner’s Office, which is the independent authority responsible for data protection in the UK.

Information Commissioner’s Office

Website: https://ico.org.uk/make-a-complaint

Telephone: 0303 123 1113

You can contact the Information Commissioner’s Office at any stage, although it may recommend that you raise the matter with me first.

Visitors to my website

My website is hosted by Squarespace.

When someone visits the website, Squarespace may collect standard technical information, such as:

  • the visitor’s internet protocol address

  • browser and device information

  • the pages visited

  • the date and time of the visit

  • information about how the website is used

This information may be used to maintain the security and operation of the website and to understand general visitor patterns.

I do not use website analytics information to identify individual visitors.

Cookies

My website may use cookies and similar technologies. Some cookies are necessary for the website to operate correctly. Other cookies, including some analytics cookies, may require your consent.

Where consent is required, non-essential cookies will not be used until you have made a choice through the website’s cookie settings.

You can change your cookie preferences through the website’s cookie settings or your browser settings.

Website contact forms

If you complete a contact form on my website, the information you provide may be temporarily stored by Squarespace before being sent to me by email.

Please avoid including highly sensitive or detailed clinical information in an online contact form. Further information can be discussed through an agreed communication method.

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to my practice, professional guidance, service providers or data protection law.

The date of the most recent update will be shown at the beginning of this notice.