Privacy Notice

At a glance

I treat the information you share with me as private and confidential. I collect only what I reasonably need to respond to enquiries, provide psychological services, maintain appropriate clinical and financial records, and run my practice safely and lawfully. This notice explains what I collect, why I use it, how it is protected, when it may be shared, and your rights.

1. Who I am

I am Dr Gemma Parry, a UK-registered Clinical Psychologist and sole practitioner providing online psychological services to adults. For data-protection purposes, I am the data controller for the personal information used in my practice. This means that I decide why and how that information is processed.

Privacy contact: info@drgemmaparry.com

ICO registration number: ZB358640

Website: www.drgemmaparry.com

2. Who this notice applies to

This notice applies to adults who enquire about or receive my services, including privately paying clients and clients whose work is authorised or funded by an insurer or other organisation. It also applies to people who visit my website or correspond with me in a professional capacity.

3. Information I may collect

Depending on the nature of our contact and the service being provided, I may collect:

  • identity and contact information, such as your name, date of birth, address, email address and telephone number;

  • details needed to arrange appointments and communicate with you;

  • your GP details and emergency-contact information, where collected;

  • information about your physical and mental health, personal history, relationships, circumstances, risk and wellbeing;

  • brief clinical records of assessments, sessions, formulations, decisions and agreed plans;

  • correspondence between us and any documents you choose to provide;

  • information supplied by, or shared with, an insurer or referrer, including authorisation, attendance, invoicing and extension-request information;

  • payment, invoicing and accounting information;

  • records of consent, preferences, concerns, complaints, safeguarding decisions and information-sharing decisions; and

  • technical information generated when you use my website, such as IP address, device/browser information, pages visited, approximate location and how you reached the website.

Information about health is treated as special-category personal data and receives additional legal protection.

4. Where information comes from

Most information comes directly from you, through email or through the contact form on my website, telephone or video conversations and during psychological work. Where work is insurer-funded or referred, I may also receive limited information from the insurer, case manager or referring organisation. In exceptional circumstances, information may come from another healthcare professional, an emergency contact, emergency services, a safeguarding body or another person involved in addressing a serious concern.

If I receive significant information about you from someone else, I will normally tell you, unless doing so would be unlawful, impossible, seriously undermine the purpose for which it was received, or create a significant risk of harm.

5. Why I use information and my lawful bases

UK data-protection law requires a lawful basis for using personal data and an additional condition for using health and other special-category data. The bases most relevant to my practice are set out below.

Responding to enquiries and considering whether I can offer a service
Article 6 basis: Legitimate interests
Special-category condition: Health or social care where health information is involved

Arranging and providing assessment, therapy or related professional services
Article 6 basis: Contract and legitimate interests
Special-category condition: Health or social care

Maintaining clinical records and practising safely and professionally
Article 6 basis: Legitimate interests and, where applicable, legal obligation
Special-category condition: Health or social care

Managing insurer authorisation, invoicing and extension requests
Article 6 basis: Contract and legitimate interests
Special-category condition: Health or social care where necessary

Accounting, taxation and legal/regulatory requirements
Article 6 basis: Legal obligation and legitimate interests
Special-category condition: Legal claims or health/social care where applicable

Protecting life, safety and wellbeing or responding to safeguarding concerns
Article 6 basis: Vital interests, legal obligation and/or legitimate interests, depending on the circumstances
Special-category condition: Vital interests, substantial public interest and/or health or social care, depending on the circumstances

Website security and essential operation
Article 6 basis: Legitimate interests
Special-category condition: Not ordinarily applicable

Optional website analytics
Article 6 basis: Consent for cookies; legitimate interests or consent for related personal-data processing as applicable
Special-category condition: Not intended to process health information

For health information used in providing psychological care, I generally rely on Article 9(2)(h) of the UK GDPR and the associated health and social care condition in Schedule 1 of the Data Protection Act 2018. Consent to receive therapy, permission to use an AI scribe, and consent as a data-protection lawful basis are distinct matters. I do not rely on data-protection consent for all clinical record-keeping because some records may need to be retained after consent is withdrawn.

6. How I use your information

I use personal information only where it is relevant and reasonably necessary to:

  • respond to your enquiry and assess whether my service is appropriate;

  • arrange and provide psychological services;

  • communicate about appointments and agreed aspects of the work;

  • prepare for sessions and maintain clear, accurate and proportionate clinical records;

  • monitor safety, continuity and the quality of my professional work;

  • obtain or extend insurer authorisation and administer insurer-funded work;

  • issue invoices, receive payment and meet accounting and tax requirements;

  • respond to requests, concerns, complaints or legal claims;

  • meet safeguarding, professional, regulatory and legal responsibilities; and

  • maintain, secure and understand use of my website.

I do not sell client information and I do not use it for email marketing.

7. Clinical confidentiality and when information may be shared

Information shared during psychological work is treated as confidential. I will not ordinarily share identifiable clinical information without your knowledge and permission.

Where work is funded or authorised by an insurer or another organisation, I may share the minimum information reasonably necessary for administration, invoicing, confirmation of attendance, authorisation or an extension request. I will discuss the nature of any clinically substantive disclosure with you.

I may discuss aspects of my clinical work in professional supervision or consultation. Information is minimised and, wherever practicable, discussed without using your name or direct identifiers. The professional consulted is also bound by duties of confidentiality.

There are exceptional circumstances in which I may disclose relevant information without your consent. These include where:

  • disclosure is required or permitted by law, a court, or another body with lawful authority;

  • it is necessary and proportionate to address a serious risk of harm to you or another person;

  • there is a safeguarding concern involving a child or an adult at risk;

  • disclosure is in your best interests or in the wider public interest;

  • it is necessary to establish, exercise or defend a legal claim; or

  • I need confidential professional advice from my indemnity insurer, solicitor or regulator.

I will consider each situation carefully, share only what is relevant and necessary, and explain the proposed disclosure to you beforehand wherever it is safe, lawful and practicable to do so.

8. AI-assisted transcription using Heidi

With your prior agreement, I may use Heidi Scribe to assist with clinical note-taking during a session. Heidi processes the words spoken in the session and creates a temporary transcript. Even when names and deliberate identifiers are omitted, this material may contain personal and special-category health information.

In my current configuration:

  • Heidi does not retain an audio recording;

  • the temporary transcript is retained for no longer than seven days and is then deleted;

  • I do not intentionally enter names or direct identifying details into Heidi;

  • patient information is not used by Heidi to train, develop or improve its AI models; and

  • I review the output and remain professionally responsible for the accuracy and content of the final clinical record.

You may decline or withdraw agreement to the use of Heidi without losing access to therapy. If you withdraw agreement, I will stop using it for future sessions. This does not require deletion of any final clinical record that I need to retain lawfully and professionally.

9. Service providers

I use carefully selected services to operate my practice. Depending on the service and context, these providers act as data processors under contractual obligations or as separate controllers for limited aspects of their work. They currently include:

  • Google Workspace for professional email, Google Meet video appointments and Google Calendar;

  • Proton Drive and Proton Docs for encrypted storage and preparation of clinical records;

  • Heidi Scribe for temporary AI-assisted transcription and note support, when agreed;

  • FreeAgent for invoicing and accounting;

  • Squarespace for website hosting and website analytics.

I may also share limited information with insurers or referrers, professional supervisors or consultants, accountants, IT support, legal advisers, my professional indemnity insurer, regulators, emergency services or safeguarding bodies where relevant and lawful.

10. International processing

Some technology providers or their subprocessors may process information outside the United Kingdom. Where personal data is transferred internationally, I take reasonable steps to ensure that an applicable UK adequacy decision, the UK International Data Transfer Agreement/Addendum, or another lawful safeguard is in place. Proton is based in Switzerland and provides contractual safeguards for its processing and any relevant onward transfers. Heidi states that UK patient data is stored in the UK, although limited supporting services may involve international providers.

11. Website analytics and cookies

My website uses Squarespace. Squarespace may process device and browsing information, such as IP address, approximate location, browser/device type, pages visited, referral source and interactions with the website. I use this information to understand how people find and use the site and to improve its content and accessibility. I do not use website analytics to identify individual therapy clients or to infer information about a particular person's mental health.

Non-essential analytics technologies should operate only where you have made the relevant choice through the website's cookie controls. You can reject or withdraw consent for non-essential cookies. More detailed information about the cookies in use and their retention is available in my Cookie Notice.

12. How I protect information

I use proportionate technical and organisational safeguards, including:

  • password-protected business accounts and multi-factor authentication where available;

  • encrypted services and encrypted storage appropriate to the sensitivity of clinical information;

  • secure devices, software updates and automatic device locking;

  • data minimisation and separation or pseudonymisation of clinical information where practicable;

  • restricted access to records;

  • secure sharing and deletion procedures; and

  • continuity and recovery planning.

No method of electronic storage or communication can be guaranteed to be completely secure. If a personal-data breach occurs, I will assess it promptly and notify affected individuals and the Information Commissioner's Office where legally required.

13. How long I keep information

I retain information only for as long as it is reasonably needed for the purpose for which it was collected and to meet professional, legal, insurance and accounting responsibilities.

Enquiries that do not lead to work
Usually six months after the last meaningful contact, unless there is a reason to retain the correspondence for longer.

Adult clinical records
Usually seven years after the final appointment, subject to any longer period required by law, an insurer, an active complaint or legal proceedings.

Heidi temporary transcript
No longer than seven days. The final clinical record is retained separately under the clinical-record period.

Insurer/referrer correspondence
Normally retained with the relevant clinical or financial record according to its purpose.

Invoices and accounting/tax records
Usually six years after the end of the relevant financial year, or longer where legally required.

Complaints, incidents and legal matters
For as long as reasonably necessary to investigate, respond, learn from the matter and meet legal, regulatory and insurance requirements.

Website analytics and technical logs
According to the configured retention periods and legitimate security requirements of Squarespace; aggregate reports may be retained for trend comparison.

Backups
Until securely overwritten or deleted in the ordinary backup cycle, subject to access restrictions while retained.

At the end of the applicable period, records are securely deleted or confidentially destroyed. A request for erasure does not always override lawful clinical, financial, safeguarding or legal retention requirements.

14. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • be informed about how your information is used;

  • request access to your personal information;

  • ask for inaccurate or incomplete information to be corrected;

  • request erasure in certain circumstances;

  • request restriction of processing in certain circumstances;

  • object to processing based on legitimate interests;

  • receive certain information in a portable format where the legal conditions apply;

  • withdraw consent where a particular activity relies on consent; and

  • complain about the way your information has been handled.

These rights are not absolute. For example, I may need to retain a clinical record despite a request for erasure. I will explain any applicable limitation if you make a request.

To exercise a right, email info@drgemmaparry.com. I may need to take reasonable steps to confirm your identity. I will normally respond within one month, although the law permits an extension in limited circumstances.

15. Complaints and concerns about privacy

If you have a question or concern about how I have handled your personal information, please contact me first at info@drgemmaparry.com. I will take the concern seriously and try to respond clearly and promptly.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator:

  • Website: www.ico.org.uk/make-a-complaint

  • Telephone: 0303 123 1113

Concerns about the psychological services you have received, rather than the handling of personal information, are covered by my separate Complaints Procedure. Please email me at info@drgemmaparry.com if you require a copy.

16. Changes to this notice

I review this notice periodically and whenever there is a material change to my practice, technology or use of personal information. The current version will be published on my website. If a change materially affects existing clients, I will take reasonable steps to bring it to their attention.

Version information

Effective date: September 2026

Next scheduled review: September 2027