Skip to main content

Privacy Policy

This privacy policy sets out the details of how data is collected and processed. I take the privacy rights of all its clients seriously and adopts a high standard of compliance and confidentiality when dealing with you/your child’s data. I want you to understand that this is a safe place for you to discuss your feelings and concerns and the service operates in a highly confidential environment.

It is important that you read this privacy policy when I am collecting or processing personal or sensitive data about you so that you are fully aware of how and why I are using you or your child’s data. This privacy policy supplements other notices and policies and is not intended to override them.

Data Security and Privacy Statement regarding sensitive data

Dr Maria O’Neill is the data controller and is responsible for your personal data (referred to as “I” in this privacy notice).

I will store personal and sensitive information which is relevant to our work together. I protect your privacy and the security of your data by using only password protected, encrypted products for data storage and electronic communication service providers that are compliant with the General Data Protection Regulation UK (GDPR-UK).

I am registered with the Information Commissioner’s Office (ref number C1232006).

I will collect and store personal data (name, address, email address, phone number, financial details, where applicable) for the purposes of identifying you or your child, reviewing our services, your payment details and to contact you with any changes to the service you receive (e.g., altered appointments). I use different methods to collect data from and about you including through direct and online interactions. You may give us your Identity, contact and financial data by filling in forms before or during an appointment, verbally during discussions at our practice, or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you apply for our services or any of our products; subscribe to our service or publications; or give us feedback or contact us.

  1. In order to reduce the risk of a data breach I request that you do not disclose sensitive information by text message, and I will not do so.
  2. I will not use your data for marketing purposes and will not sell it to any third party.
  3. I will collect sensitive data. Sensitive Data includes information about you or your child’s health, including information about your existing previous medical conditions, medication details, psychiatric history and any other relevant health information to enable us to carry out our services to you or your child. I require your explicit consent for processing sensitive data, so when you submit your details, I will ask you to confirm your consent to this processing via the consent tick boxes on our registration forms. Generally, I do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership and genetic and biometric data). However, it may be necessary to collect certain additional types of special category data about you during our assessment and/or therapy sessions. If so, I will ask you to confirm your consent to this processing via a consent tick box (either on our registration form or sent via email). The provision of this information forms part of your contract with us.
  4. This data may be shared with a third party you have informed us is already involved, where applicable, (e.g., solicitor or insurance company) to carry out the service which you or they have contracted with us. This sharing forms part of our contract as a psychological service provider and if I am legally obliged to do so e.g., if instruction to by the Court.
  5. Additionally, the Health Care Professions Council (HCPC) standards of ethics and the General Data Protection Regulations state that data processing may be vital in the legitimate interests of the data subject and in order for the service provider to complete their business; I may therefore need to contact you or your child’s general practitioner or other healthcare provider if I have any concerns about you or your child’s welfare or that of someone you have informed me about. If this is necessary, I will discuss this with you first and I will act in accordance with HCPC and British Psychological Society standards of ethics to ensure your welfare, or that of someone else.
  6. The British Psychological Society guidelines for clinical practice recommend that each Psychologist use a supervisor to ensure the quality and standards of their work. I will use supervision for this purpose with a HCPC registered practitioner who is bound by the same rules of confidentiality and who is compliant with the GDPR-UK. I will share sensitive data with this person to benefit the quality of the service you receive, but not personal data (names etc.).
  7. A basic health record will be stored in a secure location for 7 years (or 7 years after your 18th birthday if you are under 18 years currently). Sensitive information relating to the work completed will be destroyed 7 years after the end of our work together. By law, this is the length of time I am required to store this information.
  8. You have the right to request access to information I hold about you. You will receive scanned or electronic information in a portable format.
  9. You have the right to request changes to factually inaccurate information I hold about you/your child and the right to request the deletion of information. If it is no longer necessary for us to hold this data, in order to protect your or our current or future legitimate interests, and if I have no legal obligation to hold the data then I will comply with your request. I will discuss this with you at the time and explain if it is not possible to delete the data.

Changes to the privacy policy and your duty to inform us of changes

I keep our privacy policy under regular review. This version was last updated in March 2023. It is important that the personal data I hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

I may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. I do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, I encourage you to read the privacy policy of every website you visit.

How to complain

If you have a complaint about the way I manage your data please contact me in the first instance at maria@illuminateclinic.co.uk If you feel I cannot resolve your concerns adequately, please contact the InformationCommissioners Office: www.ico.org.uk.