top of page

Psychology Privacy Policy & Data Protection

Privacy Policy

Effective Date: 07-October-2026

Data Controller: Dr Jo-Ann Valentine, ByValentine Psychology Services Ltd.

ICO Registration Number: ZC116235

1. Introduction

At byValentine Psychology Services Ltd ("byValentine", "I", or "we"), your privacy and confidentiality are at the core of our therapeutic relationship. This Privacy Policy outlines how your personal and sensitive health data is collected, stored, and protected in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ethical guidelines of the Health and Care Professions Council (HCPC).

2. Website Analytics & Cookies

Our website is hosted on Wix. We use Usercentrics to manage your cookie preferences.

  • Essential Cookies: Automatically used for site security and stability.

  • Analytics Cookies (Microsoft Clarity & Wix Analytics): Only used if you provide explicit consent via our cookie banner. These tools help us understand site performance through anonymized heatmaps and session recordings (e.g., where users click or scroll).

  • Future Use: We may implement Google Analytics 4 in the future; if so, this notice and your cookie settings will be updated.

3. Lawful Basis for Processing Your Data

Under UK GDPR, I must have a lawful basis for processing your data. We collect and process personal data to provide safe and effective psychological assessment and therapy.

  • Contract: For standard personal data, processing is necessary to fulfill our agreement and provide the therapy services you have requested.

  • Legitimate Interests: To manage my practice efficiently and provide high-quality care.

  • Provision of Health or Social Care (Article 9(2)(h)): For health data (Special Category Data), as a health professional providing treatment.

4. What Data We Collect

To provide safe and effective psychological therapy, I need to collect and process the following:

  • Personal Information: Name, address, date of birth, contact details, and GP information.

  • Special Category Data (Health Data): Mental health history, clinical session notes, symptoms, psychological assessments, and GP details.

  • Third-Party Data: Emergency contact details (next of kin) provided on your intake form.

  • Financial Data: Payment history and invoicing details.

  • Website Data: Basic analytics and cookies collected via our website host (Wix) to ensure the site runs securely.

5. How We Store and Protect Your Data

I take the security of your highly sensitive information very seriously.

  • Secure Storage: Your data is stored within a secure Google Workspace environment, protected by Two-Factor Authentication (2FA) and encrypted to industry standards.

  • Pseudonymization: To maximize your privacy, client folders and clinical notes are pseudonymized using a unique Client Code (e.g., C-XXXXX) rather than your real name in file titles.

  • Physical Notes: Any handwritten notes are kept securely locked in a safe and destroyed or digitized securely as soon as possible.

  • Communication: Emails are hosted on secure servers; however, communication should be limited to administrative matters.

  • International Transfers: Your data is stored primarily in the UK/European region. Our cloud provider, Google (Google Workspace, and — only with your consent — Google Gemini for AI-assisted note-taking), stores Workspace data in the European region. Any AI processing may use Google's global infrastructure; it is covered by Google's Cloud Data Processing Addendum and the UK/EU Standard Contractual Clauses, and only pseudonymised (de-identified) text is sent to the AI.

6. Sharing Your Data

We do not sell your data or share it with third parties for marketing purposes. We only share information in the following circumstances:

  • Consent: You request us to share information with a third party (e.g., your GP).

  • Safeguarding & Risk: If there is a legal or ethical obligation to protect you or others from serious harm, or if a safeguarding concern arises regarding a child or vulnerable adult.

  • Legal Obligation: If compelled by a court of law or required by legislation (e.g., Prevention of Terrorism Act).

  • Professional Supervision: In line with HCPC and BABCP requirements, I discuss anonymized clinical work with a supervisor to ensure best practice.

7. Data Retention

In line with the NHS Records Management Code of Practice 2023 and HCPC/BABCP clinical record-keeping guidelines:

  • Adult Records: Retained for 20 years after the date of last contact (or 10 years after death, if sooner).

  • Child/Young Person Records: Retained until the client reaches their 25th birthday, or their 26th birthday if they were 17 when treatment concluded.

  • Financial Records: Retained for 6 years (HMRC).

After the applicable period, all identifiable data is securely destroyed.

8. Sharing Information with Health Insurers

If you are receiving treatment funded through a private medical insurance provider (e.g., AXA Health), we will share relevant personal and medical data with your insurer to process pre-authorisations, verify cover, and submit claims for payment.

 

This data includes your policy details, dates of service, billing/procedure codes, and relevant clinical details necessary to validate your claim. Data is transmitted securely, including via accredited electronic billing clearinghouses (such as Healthcode).

 

We will not disclose detailed clinical notes to your insurer unless required for claim auditing and with your knowledge.

9. Clinical Will

I maintain a clinical will appointing a professional executor. In the event of my death or permanent incapacitation, they will ensure the confidential storage and eventual destruction of your notes in accordance with this policy.

10. Your Rights

Under UK GDPR, you have the following rights:

  • Access: Request a copy of the records and data I hold about you (Subject Access Request).

  • Rectification: Ask to correct inaccurate information.

  • Erasure: Request deletion of data (subject to our legal retention obligations).

  • Restriction: Request temporary limits on how we process your data.

  • Portability: Receive your data in a structured, machine-readable format.

  • Objection: Object to processing in certain circumstances.

  • Withdraw Consent: The right to withdraw consent for non-clinical processing at any time.

11. Use of Artificial Intelligence (AI)

I only use these tools to process your health data with your explicit consent, which you can withdraw at any time without affecting your care. I use a small number of secure tools to run the practice and keep my records accurate.  My main tools are provided by Google, who process your information only on my written instructions under a signed Business Processing Record (BPR) / Data Processing Agreement - they cannot use it for their own purposes or to train AI models.

​

  • Practice system: Your records are held securely, with contact details stored separately from clinical notes and access-controlled.

  • AI note assistant (Google Gemini): Helps me draft and tidy my notes only. It never makes decisions about your care, I review and approve everything, and your information is never used to train AI models.

  • Automatic transcription (Google Meet): Used with your agreement in online sessions so I can be fully present; transcripts are stored securely and deleted once no longer needed.

  • Admin tools: Google Workspace (email, calendar, storage) and my accounting software.

  • Your choice: You can ask me to stop using the AI assistant or transcription at any time, and it will not affect your care.

  • Security: Every provider acts only on my instructions, and your information is kept secure under UK GDPR.

12. Complaints

If you have concerns, please contact me first at office@byvalentine.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

bottom of page