PRIVACY NOTICE

Data Storage & Retention

This notice explains what personal information I hold about you, why I hold it, where it is kept, who else handles it on my behalf, how long I keep it, and what your rights are. Please read it before we begin working together. If anything is unclear, ask me and I will explain.

Privacy Notice

This notice explains what personal information I hold about you, why I hold it, where it is kept, who else handles it on my behalf, how long I keep it, and what your rights are. Please read it before we begin working together. If anything is unclear, ask me and I will explain.

Who I am

I am Dr Sherylin Thompson, a Counselling Psychologist in independent practice. I am the data controller for the information I hold about you. This means I decide how it is used and I am responsible for keeping it safe.

Address: Unit 68 Cannon Workshops, 3 Cannon Drive, Canary Wharf, London E14 4AS
Email: sherylin@psychologist.city
Telephone: 07940 516 806
ICO registration number: ZA057820
Professional Memberships: HCPC: PYL29559; BPS: 182895; BACP: 704779; UKCP: 2011162159

What information I hold

When you get in touch or book: your name, contact details, date of birth, and the reason you are seeking therapy.

During our work together: notes of our sessions, assessments, outcome measures, and correspondence about your care.

About other people, where you give them: for example the contact details of your GP or an emergency contact.

About payment: the fees you pay, and the name shown on your payments. If a health insurer or another organisation is paying for your therapy, your membership or policy details and authorisation number.

Because this information relates to your mental health, the law treats it as special category data and requires a higher standard of care. I apply that standard to everything I hold about you, including the simple fact that you are my client.

Why I hold it, and the legal basis

I hold your information so that I can provide therapy safely and effectively, keep accurate clinical records as my professional bodies require, manage appointments and payments, and meet my legal obligations.

The legal bases I rely on under the UK GDPR are:

to provide the service you have asked for, which is our agreement to work together (Article 6(1)(b))
to meet legal obligations, such as keeping financial records for HMRC (Article 6(1)(c))
for the provision of health care, by a professional under a duty of confidentiality (Article 9(2)(h), with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2)

I do not rely on your consent as the legal basis for keeping your clinical record. This means your record is kept for the period set out below, as my professional obligations require, rather than being deleted on request. Your rights are explained further down.

I do ask for your separate consent before using AI to help write my notes. This is a professional and ethical requirement, and you can decline or withdraw it at any time. See “Use of AI” below.

Where your information is kept, and who handles it for me

I use a small number of trusted services to run my practice. Each acts only on my instructions, under a written data processing agreement, and none may use your information for its own purposes.

Service	What it does	What it holds	Where it is stored
WriteUpp	Clinical record and practice management	Your clinical record, contact details and invoices	European Union (Microsoft data centres, including Dublin)
Heidi Health	Helps draft my session notes, only if you consent	Audio is processed in real time and never stored. A transcript and draft note are held briefly, then deleted. Your name is not entered	United Kingdom (London)
Bilateral Base	Video sessions, and online tools for EMDR	A client profile that does not include your name, and your EMDR settings. Video passes directly between us and is not recorded.	United Kingdom
SimplyBook.me	Online booking and email reminders	Your name, contact details and appointment times	France, with backups elsewhere in the EU
Microsoft 365	Practice email and secure document storage	Emails you send me, and practice documents, which may include letters and reports about your care	United Kingdom
Healthcode	Sending invoices to health insurers	The details your insurer needs to process a claim	United Kingdom
Stripe	Card payments	Your name, email, card details and the amount paid. I never see your full card number	United States (see “Transfers outside the UK”)
Xero	Accounts	The name shown on your payments, with amounts and dates. No clinical information	United States (see “Transfers outside the UK”)

My appointment reminders are sent by email only. They do not mention therapy or the nature of the appointment.

Stripe also uses payment information for its own legal purposes, such as preventing fraud. For that use it is responsible under its own privacy notice, at stripe.com/privacy.

If someone else is paying for your therapy

If a health insurer or another organisation paying for your therapy, such as an employer, is funding your sessions, I send it the information it needs to process the claim. This may include your diagnosis, symptoms, relevant history and current circumstances. I send only what is needed.

Insurers I work with include WPA, Bupa, Vitality and AXA. Once your information reaches your insurer or funder, it is responsible for it under its own privacy notice.

Use of AI

AI-assisted note-taking

With your consent, I use Heidi Health to help write my session notes. It can work in one of two ways, and you choose which, if either, I use:

From a recording of the session. The session is recorded on my phone, transcribed, and summarised into a draft note.
From my dictation. After the session, I speak my notes into Heidi, and it produces a draft. Your session is not recorded.

I do not use your name in either case. I read and correct every draft myself before anything enters your record, and I remain responsible for its content. The AI does not make decisions about your care.

Heidi Health has confirmed in writing that audio is never stored, that no session information is used to train any AI model, and that your data is held in the United Kingdom. Heidi Scribe is registered with the MHRA as a medical device. I delete each transcript once I have written up the note, and anything remaining is deleted automatically within 30 days.

If you prefer, I will type my notes myself without AI. Your care is not affected in any way by that choice.

Other AI tools

I sometimes use a general AI assistant for practice administration and professional development. I never enter information that could identify you.

No automated decisions

No decision about you is ever made by a computer without my involvement.

Who else I may share your information with

I keep what you tell me confidential. Apart from the services above, I will not share your information without your agreement, except in the limited circumstances set out in section 10 of my Terms and Conditions. In summary, these are a risk of serious harm, a safeguarding concern, or a legal requirement. Where I can, I will talk with you first.

I discuss my work in clinical supervision without using your name or details that could identify you. With your agreement, I may write to your GP or another professional involved in your care.

Transfers outside the UK

Almost all of your information stays in the United Kingdom or the European Economic Area, which the UK recognises as offering an equivalent standard of protection. There are three exceptions:

Xero stores accounting data in the United States. This is limited to the name on your payments, the amount and the date. It is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which requires Xero to protect it to UK standards.
Stripe processes card payments in the United States. It is protected by UK International Data Transfer Addendum, and the UK Extension to the EU-US Data Privacy Framework.
Heidi Health may occasionally allow its support staff outside the UK to access account data to resolve a technical problem. Any such access is protected by the same UK safeguards.

How long I keep your information

Information	How long
Clinical record	Seven years from the end of our work together, then securely deleted
Emails	Anything clinically significant is copied into your clinical record and kept with it. The emails themselves are deleted after two months
Booking records in SimplyBook	Three months, then deleted automatically
AI audio	Never stored
AI transcripts and draft notes	Deleted once the note is written up, and in any case within 30 days
Bilateral Base client profile	Deleted when our work ends
Financial records	For the period required by HMRC and applicable tax legislation.

How I keep it safe

Every service I use is protected by multi-factor authentication. My computer is encrypted. I keep clinical detail out of email wherever possible. I review each of these services at least once a year.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, I will comply with my obligations under UK GDPR, including notifying the ICO and, where required, informing you.

Your rights

You have the right to:

see the information I hold about you, by asking me. I will respond within one month
have inaccurate information corrected
ask me to delete your information. I will do so where I can, but I may need to keep your clinical record for the period above to meet my professional and legal obligations. I will explain if that applies
ask me to restrict how I use your information, or object to a particular use
receive a copy of information you gave me in a format you can take elsewhere, where this applies

If we work together as a couple, I keep one joint record. If one of you asks to see it, I will share what relates to you. I will share your partner’s information only with their agreement, or where the law allows it. Section 14 of my Terms and Conditions explains this further.

To use any of these rights, contact me at the email address above.