1. Introduction and Purpose
The Cotswold Psychologist is committed to protecting the privacy and security of your personal information. This policy describes how we collect and use personal data about you during and after your therapeutic relationship with us, in accordance with the UK General Data Protection Regulation (UK GDPR).
2. The Data Controller
The Cotswold Psychologist is the “data controller.” This means that we are responsible for deciding how we hold and use personal information about you.
• Contact Name: Sarah Whitson
• Email: Sarah@thecotswoldpsychologist.co.uk
3. The Type of Information We Hold
We may collect, store, and use the following categories of personal information:
• Personal Contact Details: Name, address, telephone numbers, and personal email addresses.
• Emergency Contact Information: Name and number of a next of kin or GP.
• Appointment and session records: Dates, times, duration and notes as required for clinical care.
• Special Category Data: Notes from therapy sessions, health/medical history, mental health information, and any relevant details regarding your personal life shared during treatment.
• Financial Information: Bank details or payment information for billing purposes.
4. How We Collect Your Data
The personal information we process is provided to us directly by you for one of the following reasons:
• You made an inquiry via our website or telephone.
• You completed a client registration form.
• Information shared during the course of your therapy sessions.
5. How We Use Your Data
We use your data for the following purposes:
- To provide and manage psychological therapy, ADHD assessment and post-diagnostic support services to you.
- For billing and administrative purposes.
- To communicate with you about appointments, bookings, queries and service-updates.
- To comply with legal, regulatory or professional obligations (for example record-keeping for clinicians).
- To improve our service and ensure quality and security of our online systems.
6. Why We Process Your Information
Under the UK GDPR, the lawful bases we rely on for processing this information are:
1. Explicit Consent: By completing our client registration form, including our terms of service, you explicitly agree to your data being processed in order to provide healthcare.
2. Contractual Obligation: We need your data to provide the psychological services you have requested.
3. Legal Obligation: We may need to process data to comply with the law (e.g., tax records).
4. Legitimate Interests: To manage our practice effectively.
5. Vital Interests: In extreme cases where there is a risk of serious harm to yourself or others.
For “Special Category Data” (health info), we process this under the condition of providing health or social care..
We ensure that we meet the GDPR principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.
7. Data Sharing
We do not share or sell your data. Your information is kept strictly confidential, except in the following limited circumstances:
• Professional Supervision: As per psychological best practice, cases may be discussed anonymously with a supervisor.
• Legal Requirement: If we are subpoenaed by a court.
• Safeguarding: If we believe there is a risk of significant harm to you or another person, we may share information with your GP or emergency services.
• Explicit Consent: If you explicitly agree to us sharing information with other professionals such as GP, mental health specialist, Neurologist.
• Third-Party Processors: See section 9 for full details.
8. Data Security and Retention
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way.
• Digital Records: Stored on encrypted, password-protected platforms.
• Paper Records: Kept in a locked filing cabinet.
• Retention: We typically retain clinical records for 7 years after the conclusion of therapy, in line with professional insurance and British Psychological Society (BPS) guidelines.
9. International Data Transfers & Third-Party Processors
To provide a modern and secure service, we utilise Google Workspace (including Google Forms, Drive, and Calendar) for administrative tasks and data collection. While our practice is based in the UK, data collected through these platforms may be stored or processed on servers located outside the UK, primarily within the European Economic Area (EEA) or the United States.
To ensure your data remains protected to UK standards, we have entered into Data Processing Agreements with these providers, incorporating Standard Contractual Clauses (SCCs) and relying on the UK-US Data Bridge where applicable. This ensures that your information is handled with the same level of security and privacy as required under UK GDPR.
When using AI-assisted clinical tools for note-taking, we use only providers that are UK GDPR compliant. Your explicit consent for this is sought separately, and you may withdraw that consent at any time without affecting your treatment.
10. Your Rights
Under data protection law, you have rights including:
• Your right of access: You have the right to ask us for copies of your personal information.
• Your right to rectification: You have the right to ask us to rectify information you think is inaccurate.
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
11. How to Complain
If you have any concerns about our use of your personal information, you can make a complaint to us at sarah@thecotswoldpsychologist.co.uk. You can also complain to the ICO if you are unhappy with how we have used your data.
• ICO website: https://www.ico.org.uk