Privacy & Data Protection Policy

What Personal Data We Collect:

I collect and process the following types of personal data:

• Contact Details: Your name, address, telephone number, and email address.

• Enquiry Details: Information you submit voluntarily via the contact form on the ON Psych website.

• Emergency Contact Details: The name and contact information for a trusted individual I can reach in an emergency.

• Health and Therapy-Related Information: Presenting issues, relevant medical history, mental health history, current medications, and GP details where clinically relevant.

• Session Notes: Records of our therapeutic work together, including clinical observations and any themes, goals, or progress discussed.

Health and therapy-related information is classified as Special Category Data under Article 9(1) of the UK GDPR. This data receives enhanced legal protection because of its sensitive nature, and I take strict additional care to keep it secure and confidential.

​

How We Collect Your Data:

I collect your personal data directly from you:

• When you first make contact with me (by phone, email, or through the website contact form).

• During our initial consultation and intake process.

• Throughout our therapeutic sessions together.

• Through any ongoing communication between sessions (email, telephone, or messaging).

I do not collect personal data about you from any other source without your explicit knowledge and consent.

​

Why We Process Your Data (Lawful Basis):

To process your personal data lawfully under UK GDPR, I rely on the following explicit legal bases:

1. Ordinary Personal Data (Article 6 basis): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage ON Psych, we enter into a contract for therapeutic services. I need to process your personal data to deliver those services effectively.

2. Special Category Health Data (Article 9 basis): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care purposes). This processing is carried out by me as a qualified practitioner subject to a professional obligation of confidentiality under the Ethical Framework of the BACP.

​

How Your Data is Secured and Stored:

As specified in our therapeutic contract, all session notes, clinical assessments, and correspondence are handled with maximum security:

• They are stored securely on a password-protected, encrypted digital device used solely by me.

• No physical paper notes are routinely kept; if any paper assessments are used, they are digitised and securely destroyed immediately.

​

Professional Obligations & Clinical Supervision:

I am required by the BACP to attend regular clinical supervision to maintain high standards of safety and practice. I may discuss our therapeutic work with my supervisor, under strict guidelines:

• Your name, identity, and any distinguishing personal details are never shared.

• I use entirely anonymised or pseudonymised case material only.

• My supervisor is a qualified professional bound by identical confidentiality obligations and their own professional body's ethical framework.

​

Clinical Will:

In accordance with professional guidelines, I have robust arrangements in place for a clinical will. If I become suddenly unable to practise due to serious illness, sudden incapacity, or death, your records will be securely handled and managed confidentially by a designated clinical colleague to ensure your safety and continuity of care boundaries.

​

Who We Share Your Data With:

I keep your personal data strictly confidential. However, ON Psych utilises specific third-party digital infrastructure services to run seamlessly:

• Wix: My website hosting and platform provider.

• Google Workspace: To manage secure incoming and outgoing emails (hello@onpsych.co.uk) and basic business operations.

• Google Analytics: To understand how visitors interact with the website layout.

Each of these services is bound by a strict data processing agreement requiring them to protect your data. Beyond these technical services, your data is never sold, traded, or shared with third parties for marketing purposes.

​

International Data Transfers:

Some of the cloud-based infrastructure providers utilised by ON Psych may transfer limited data outside the United Kingdom (such as Google or Wix). Where data is transferred outside the UK, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in full compliance with UK GDPR Chapter V and the requirements of the Data (Use and Access) Act 2025.

​

How Long We Keep Your Data:

I preserve your personal data only for as long as necessary to fulfil legal, insurance, and professional requirements.

Therapy records, including session notes and clinical assessments, are retained for seven years after our final session. This timeframe aligns with the Limitation Act 1980 and standard professional indemnity insurance requirements. Financial records, such as invoices and payment data, are kept for six years to comply with legal requirements under HMRC rules. For website enquiries where you do not go on to become a client, your data is retained for twelve months so that I can respond to your initial enquiry and follow up if needed.

After the applicable retention period ends, electronic records are permanently deleted using secure deletion software.

​

Your Rights Under UK GDPR:

You hold the following legal rights regarding your personal data:

• Right to be Informed: You have the right to know how I collect and use your data. This policy fulfils that right.

• Right of Access: You can request a copy of the personal data I hold about you (a Subject Access Request). In line with the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.

• Right to Rectification: If any data I hold is inaccurate or incomplete, you can ask me to correct it immediately.

• Right to Erasure: You can request that I delete your data. However, this right does not override my legal and insurance obligations to retain clinical therapy records for the mandatory 7-year period.

• Right to Restrict Processing: You can ask me to limit how I use your data in certain circumstances.

To exercise any of these rights, please contact me directly at hello@onpsych.co.uk.

​

Complaints & Confidentiality Exceptions:

- Confidentiality Exceptions

Everything you share with me in therapy is confidential. However, there are rare, statutory circumstances where I am legally or ethically required to share information without your consent:

• Risk of Serious Harm: If I believe you or another person is at immediate risk of serious physical harm.

• Safeguarding: If I become aware of concerns regarding a child or vulnerable adult being harmed or at risk of harm.

• Legal Duty: If ordered by a court of law to disclose information.

Wherever possible, I will discuss any disclosure with you completely before taking action, unless doing so increases the immediate risk of harm.

​

- Data Protection Complaints

If you ever have a concern or complaint regarding how your personal data is handled, please contact me directly at hello@onpsych.co.uk so that I can address, investigate, and rectify the matter promptly in accordance with statutory guidelines.

If you remain unsatisfied with my response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk

• Telephone: 0303 123 1113

• Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

​

Website Terms & Conditions:

- Domain and Liability Notice

• This website contains links to third-party material, the content over which ON Psych exercises no discretion or diligence, and explicitly indemnifies itself from liability.

• These links are provided for information purposes alone. ON Psych cannot be held responsible for any damage or loss as a result of any actual or perceived inaccuracy of the information contained across external links.

• ON Psych claims and confirms sole ownership of all material residing on the website domain name web space, unless explicitly specified otherwise. Copyright is protected by law both in the United Kingdom and overseas. All rights are reserved, and none of the content located on onpsych.co.uk should be reproduced without prior written consent.