Privacy Notice

1. About this Privacy Notice

This Privacy Notice explains how Psychology Connections on the Coast Ltd (“I”, “me”, “my” or “the Practice”) collects, uses, stores and protects personal information relating to clients and prospective clients.

I am committed to protecting your privacy and handling your personal information lawfully, fairly and transparently. I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection legislation and professional requirements, as amended from time to time.

I am the data controller for the personal information I process in connection with the provision of psychological services.

Data controller: Psychology Connections on the Coast Ltd
Contact: coastpsychologyconnections@hotmail.com
Postal address: [your practice postal address]
ICO registration number: ZC040599

2. Information I collect

Depending on the nature of the psychological services provided, I may collect and process:

  • your name and contact details;

  • date of birth and other identifying information;

  • emergency contact details;

  • information about your physical and mental health;

  • psychological and psychiatric history;

  • information about symptoms, diagnoses, medication and previous or current treatment;

  • information provided during psychological assessment, therapy or consultation;

  • clinical notes and records of appointments;

  • information provided by other healthcare or professional practitioners involved in your care;

  • information contained in referrals, reports or correspondence;

  • information about your GP or other healthcare professionals where relevant;

  • appointment and attendance information;

  • billing and payment information;

  • correspondence with you, including email communications; and

  • information relating to safeguarding or risk where relevant.

Some of the information I process, particularly information concerning your physical or mental health, is special category personal data under the UK GDPR and is subject to additional legal protections.

Where I receive information about you from another source, such as a referring professional or healthcare provider, I will process that information in accordance with this Privacy Notice.

3. How I use your information

I use your personal information where necessary to:

  • provide psychological assessment, therapy and related services;

  • assess your psychological needs and formulate appropriate treatment;

  • maintain accurate and appropriate clinical records;

  • communicate with you about appointments and your care;

  • communicate with other professionals involved in your care where appropriate and lawful;

  • prepare reports or other clinical documentation where appropriate;

  • arrange and administer payments and invoices;

  • obtain professional supervision and/or clinical consultation;

  • manage safeguarding or significant concerns about your safety or the safety of another person;

  • comply with legal, professional, regulatory or insurance requirements;

  • respond to complaints or requests concerning your personal data;

  • maintain the security and effective operation of my systems and services; and

  • establish, exercise or defend legal claims where necessary.

I will only collect and use information that is reasonably necessary for these purposes.

4. Lawful basis for processing

I will identify an appropriate lawful basis under Article 6 UK GDPR for processing your personal information.

Depending on the circumstances, this may include:

  • contract – where processing is necessary to provide the psychological services you have requested or to take steps at your request before entering into a contract;

  • legitimate interests – where processing is necessary for my legitimate interests, such as administering and managing my private practice, provided those interests are not overridden by your rights and interests;

  • legal obligation – where processing is necessary for me to comply with a legal or regulatory requirement; or

  • consent – where I have specifically asked for your consent for a particular processing activity and consent is the appropriate lawful basis.

Where I process health information or other special category personal data, I will also rely on an applicable Article 9 condition.

For the provision of psychological services, this may include Article 9(2)(h), where processing is necessary for the provision of health care or treatment and the relevant requirements of UK law are satisfied.

Consent to psychological treatment is separate from consent as a legal basis for processing personal data.

Where I rely on consent for a particular processing activity, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

5. Confidentiality

I take the confidentiality of psychological information very seriously.

Information discussed during psychological services will normally remain confidential and will not ordinarily be disclosed to third parties without your knowledge and, where appropriate, your consent.

There are circumstances in which information may need to be disclosed without your consent where this is permitted or required by law, or where necessary to protect you or another person.

This may include circumstances where:

  • there is a serious concern about your safety or the safety of another person;

  • there are safeguarding concerns;

  • disclosure is required by law, court order or another legal obligation;

  • disclosure is necessary to establish, exercise or defend legal claims;

  • disclosure is necessary to comply with professional, regulatory or insurance requirements; or

  • information needs to be shared with another professional involved in your care and this is lawful and necessary.

Where possible and appropriate, I will discuss significant disclosures with you beforehand. However, this may not always be possible where doing so could increase risk or would otherwise be unlawful or inappropriate.

6. Professional supervision and consultation

As a clinical psychologist, I undertake professional supervision and may seek clinical consultation regarding my work.

Where cases are discussed in supervision or consultation, I will take reasonable steps to minimise the personal information shared and, wherever practicable, anonymise or pseudonymise information so that you are not identifiable.

Where identifiable information needs to be shared, I will ensure that this is lawful, necessary and subject to appropriate confidentiality and data-protection safeguards.

7. Sharing information with other professionals

Where appropriate and lawful, I may communicate with professionals involved in your care, such as your GP, psychiatrist, psychologist, therapist or other healthcare professional.

I will generally discuss this with you and seek your agreement where appropriate.

However, there may be circumstances where information can or must be shared without your consent, for example where required by law or where necessary to protect someone's vital interests or address a significant safeguarding concern.

I will only share information that is reasonably necessary for the relevant purpose.

8. Email and electronic communication

I use Microsoft Outlook / Microsoft 365 for email and related practice communications.

Email may be used for appointment arrangements, administrative matters and, where appropriate, communication relating to your psychological care.

Electronic communication is not completely risk-free. I take appropriate security measures, but you should avoid including highly sensitive clinical information in ordinary email communications unless necessary.

9. Online appointments

Where psychological appointments are conducted remotely, I may use Microsoft Teams or Google Meet.

These services involve the processing of certain personal information necessary to arrange and conduct appointments. I use appropriate privacy and security settings and take reasonable steps to protect the confidentiality of remote appointments.

I do not routinely record psychological appointments.

If an appointment were to be recorded, I would discuss this with you in advance and ensure that an appropriate lawful basis and any required consent were in place.

You are responsible for taking reasonable steps to ensure that you are in a private and secure environment when participating in a remote appointment.

10. Clinical records and reMarkable

I maintain clinical records relating to psychological assessment and therapy. These records include notes made during or following appointments and other information necessary to provide safe and effective psychological care.

I create and maintain my clinical records electronically using a reMarkable tablet.

Where the device is configured to synchronise with the reMarkable cloud service, copies of clinical records may also be stored within that cloud environment.

I use appropriate security measures to protect clinical records, including device security, access controls and secure handling of the tablet.

Clinical records are confidential and are not made available to third parties except where there is a lawful and necessary reason to do so.

11. Bilateral Base

I use Bilateral Base as part of my clinical practice.

Bilateral Base is not used as the primary storage location for my clinical records.

Where personal information is processed through Bilateral Base, I will ensure that its use is consistent with applicable data-protection requirements and that appropriate safeguards are in place.

I will not enter identifiable client information into Bilateral Base unless this is necessary, lawful and appropriately protected.

12. Other service providers

I use a limited number of trusted third-party providers to support the operation of my private practice. These may include providers of:

  • email and IT services;

  • video-conferencing services;

  • cloud storage;

  • payment processing;

  • accounting and bookkeeping services;

  • website hosting; and

  • technical support.

Where third parties process personal data on my behalf, I take appropriate steps to ensure that suitable data-protection and confidentiality safeguards are in place.

Some service providers may process information outside the UK. Where this occurs, I will ensure that any international transfer is made in accordance with applicable UK data-protection requirements and that appropriate safeguards are in place.

13. Information security

I take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, damage or unlawful processing.

These measures may include password protection, multi-factor authentication where available and appropriate, encryption, access controls, secure devices, software updates, secure storage and secure disposal of information.

No method of transmitting or storing information can be guaranteed to be completely secure. However, I take reasonable and proportionate steps to protect your information.

14. How long I keep your information

I retain clinical records for 7 years following the end of the therapeutic relationship, unless there is a lawful, professional, regulatory or other legitimate reason to retain information for longer.

Other administrative information may be retained for a different period where required for legal, accounting, insurance or other legitimate purposes.

When personal information is no longer required, it will be securely deleted or destroyed.

15. Your data protection rights

Depending on the circumstances and subject to applicable legal exemptions, you have rights under UK data-protection law, including:

  • the right to be informed about how your personal information is used;

  • the right to access personal information I hold about you;

  • the right to request correction of inaccurate or incomplete information;

  • the right to request restriction of processing in certain circumstances;

  • the right to object to certain processing;

  • the right to request erasure of personal information in certain circumstances; and

  • the right to data portability where this applies.

These rights are not absolute and legal exemptions may apply, particularly in relation to clinical records and legal or professional obligations.

16. Requests for access to your records

You may request a copy of the personal information I hold about you by contacting me using the contact details at the beginning of this Privacy Notice.

I may need to verify your identity before providing information.

I will deal with requests in accordance with applicable data-protection legislation.

There may be circumstances in which information cannot be disclosed, or in which some information is withheld or redacted, where a legal exemption applies.

17. Requests from third parties

If a solicitor, insurer, employer, healthcare professional, family member or another third party requests information about you, I will consider whether I have a lawful basis to disclose the information and whether doing so is consistent with my professional duty of confidentiality.

Where appropriate, I will seek your consent before providing information.

However, consent will not necessarily be required where disclosure is otherwise permitted or required by law.

18. Data breaches

I have procedures for identifying, managing and responding to personal-data breaches.

If a personal-data breach occurs, I will assess the risk to affected individuals and take appropriate action in accordance with applicable data-protection law, including notifying the Information Commissioner's Office and/or affected individuals where legally required.

19. Complaints

If you have concerns about how I have handled your personal information, please contact me in the first instance using the contact details provided above.

I will consider and respond to your concerns in accordance with applicable requirements.

You also have the right to complain directly to the Information Commissioner's Office (ICO).

Information about making a complaint is available from the ICO's website.

20. Changes to this Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in legislation, professional requirements, technology or the way in which I process personal information.

The most recent version will be made available to clients, and the date at the beginning of this Privacy Notice will indicate when it was last updated.

Where changes materially affect how I use your personal information, I will take reasonable steps to bring those changes to your attention.

Last updated: 2 September 2026