Privacy Policy

1. About This Policy

This Privacy Policy explains how I collect, use, store and protect your personal information when providing psychological assessment and therapy services. 

I am committed to protecting your privacy and handling your personal information in accordance with the United Kingdom (UK) General Data Protection Regulation (GDPR), the Data Protection Act 2018, and relevant professional standards. 

My aim is to keep this information clear and transparent, so you understand how your personal information is used and feel able to make informed decisions. 

If you have any questions or concerns about this policy or how your information is handled, please contact me directly at drdaveheavens@protonmail.com.

2. Who I Am

I am Dr Dave Heavens, a registered Clinical Psychologist with the Health and Care Professions Council (HCPC) in the UK. For the purposes of data protection legislation, I am the Data Controller responsible for your personal information. 

3. What Information I Collect

I collect information that helps me provide safe, effective psychological assessment and treatment. I collect and store only the information necessary to provide psychological services. This may include: 

  • Personal details – e.g., name, date of birth, contact information, GP details, emergency contact details. 

  • Background information – e.g., relevant personal history, mental health history, current concerns and difficulties. 

  • Clinical information – e.g., information shared during assessment and therapy sessions, treatment goals, progress and outcomes, brief clinical notes to support your care. 

  • Administrative information – e.g., invoices, payment records, appointment history, correspondence relating to your care. 

  • Digital communication information – e.g., emails, basic technical information relating to digital services used within my practice. 

Some of the information I collect, particularly information relating to your mental health and healthcare, is considered special category data under the UK GDPR. 

This type of information requires additional protection and is only processed where necessary to provide psychological services and with appropriate safeguards in place. 

4. How Your Personal Data Are Used

Your information is used to: 

  • Provide psychological therapy - including psychological assessment, formulation and treatment. 

  • Communicate with you – e.g., scheduling appointments, responding to queries, sharing relevant resources. 

  • Maintain accurate clinical records – to support your care, monitor progress and meet professional responsibilities. 

  • Meet legal and professional obligations – e.g., managing clinical risk, addressing safeguarding concerns, responding to lawful requests for information. 

  • Manage payments - including invoicing and financial administration. 

  • Improve service quality – e.g., reviewing feedback and patterns within my practice to improve services. This will never include identifiable information. 

I do not use your personal information for marketing purposes. I do not sell your personal information or provide it to third-party organisations for commercial purposes. 

5. How Your Personal Data May Be Disclosed

Your information is confidential. I only share information when there is a lawful and appropriate reason to do so. This may include: 

  • Where there are safeguarding concerns or risk of serious harm – e.g., to you or another person, in relation to the safety or welfare of a child or vulnerable adult. 

  • When legally required – e.g., court orders, legal requirements, statutory safeguarding responsibilities. 

  • For professional supervision and peer consultation - as a Clinical Psychologist, I undertake regular professional supervision and may engage in peer consultation to support safe and effective clinical practice. Where clinical information is discussed, I will take steps to protect your confidentiality. Information will be anonymised or minimised wherever possible so that you are not identifiable. 

  • With your explicit consent – e.g., sharing relevant information with your GP or another healthcare professional, involving family members or carers where appropriate. 

Where possible, I will discuss information sharing with you before this occurs. 

6. Data Security

I take data security seriously. Your information is protected through: 

  • Secure, password-protected digital systems. 

  • Appropriate encryption and security measures where available. 

  • Restricted access to clinical records. 

  • Electronic processing and storage wherever possible. 

  • Secure handling and destruction of paper records. 

  • Regular review and updating of security measures and tools. 

Only I will have access to your clinical records, unless there is an appropriate legal, professional or clinical reason for information to be shared. 

7. Clinical Records and Practice Management Systems

I maintain clinical records to support safe and effective psychological assessment and treatment. My clinical records and practice administration are managed using WriteUpp, a secure practice management system designed for healthcare professionals. 

WriteUpp is used for purposes such as: 

  • Managing appointments. 

  • Maintaining clinical records and notes. 

  • Storing relevant documents. 

  • Supporting the administration of my practice. 

WriteUpp acts as a data processor on my behalf. I am responsible for ensuring that your personal information is handled appropriately and in accordance with UK GDPR requirements. 

I carefully select digital systems used within my practice and regularly review their suitability, security arrangements and compliance with professional and data protection requirements. 

8. Use of AI and Digital Tools

The use of AI and digital tools is becoming increasingly widespread. 

I may use appropriate digital tools within my clinical practice to support and enhance administrative processes and service delivery. 

Where digital systems include optional AI-assisted functionality, I will only use these features where appropriate safeguards are in place and they are consistent with my professional, ethical and data protection responsibilities. 

I will not use AI tools to independently make clinical decisions, replace my professional judgement, or determine your care. 

Any digital tools I use (for example, practice management software or video platforms) will be selected carefully with consideration given to security, confidentiality and UK GDPR requirements. 

If I introduce significant new digital tools or change how they are used, I will review whether additional information or consent is required. 

9. Website, Cookies and Online Services

My website is hosted using Squarespace. 

If you visit my website, limited technical information may be collected automatically, such as information about website usage, device type, browser type and general technical information. This information helps maintain website security, monitor website performance and improve website functionality. 

My website may use cookies or similar technologies. Cookies are small text files stored on your device that help websites function effectively and provide information about website usage. 

Where required, information about cookies and choices available to you will be provided. Please see my Cookies Policy on my website for further information.  

If you contact me through my website, any information you provide will be used only for the purpose of responding to your enquiry and considering whether my service is appropriate for your needs. 

Squarespace acts as a third-party service provider for website hosting and related services. I carefully select digital services used within my practice and consider their security and suitability in line with my professional and data protection responsibilities. 

10. Automated Decision-Making Tools

I may use automated systems or digital tools to support administrative processes within my practice. Examples include appointment reminders, scheduling systems, or other administrative functions. These tools will never replace my professional judgement as a Clinical Psychologist or independently determine decisions about your care. 

If automated systems are used: 

  • They will support, not determine, clinical decisions. 

  • They will comply with relevant HCPC and UK GDPR requirements. 

  • Only the minimum necessary information will be used. 

  • Your personal details or identifiable clinical information will not be used unless there is an appropriate lawful basis and appropriate safeguards in place. 

You have rights relating to automated decision-making under the UK GDPR, including the right to object to certain forms of automated processing and request human involvement where applicable. 

11. Data Retention

I keep your clinical records for an appropriate period in accordance with professional guidance, legal requirements and good clinical practice. 

My current retention periods are: 

  • Adults: Seven years after our work together ends. 

  • Children and young people: Until the person turns 25 years of age (or 26 years if they were aged 17–18 when treatment ended). 

Records may be retained for longer where there is a legal, professional or clinical reason to do so. 

After the relevant retention period has ended, your information will be securely destroyed and will no longer be available. 

12. Keeping Your Information Up to Date

It is important that your information is accurate and up to date. 

Please let me know if the following changes: 

  • Contact details. 

  • GP information. 

  • Emergency contact details. 

  • Other relevant personal information. 

I will update your records as appropriate. 

13. Your Data Rights

Under the UK GDPR, you have rights relating to your personal information. 

These include: 

  • The right to access your information. 

  • The right to request corrections to inaccurate information. 

  • The right to request deletion of information in certain circumstances. 

  • The right to restrict or object to processing in certain circumstances. 

  • The right to request data portability. 

  • Rights relating to automated decision-making. 

If you would like to exercise any of these rights, please contact me at drdaveheavens@protonmail.com. I will respond to requests within one month. 

Please note that requests for access to clinical records may require appropriate consideration to ensure that information is shared in a way that is consistent with legal requirements, professional responsibilities and your wellbeing. 

14. Children and Young People

For children and young people, I will discuss how information is shared at the beginning of psychological work. How information is shared will depend on age, level of understanding, psychological maturity, legal rights and clinical circumstances. 

14.1. Children under 16

A parent or legal guardian will be asked to provide consent for assessment and/or treatment for children and young people under 16 years of age. 

I will involve parents and/or guardians in the child or young person’s care where appropriate, including providing updates about clinical progress and risk. 

If a child or young person understands what assessment and treatment involves, and they can make informed decisions, I will support them to be involved in decisions about their care. I will also support them to communicate their preferences to parents and/or legal guardians.  

14.2. Young people aged 16–18

Young people aged 16–18 may be able to make their own decisions about psychological input and their personal information. This will be discussed with the young person and their parents and/or legal guardians before clinical input begins. 

I will not automatically share information with parents and/or guardians of people aged 16-18 years of age without discussion or consent, unless there is a clinical, safeguarding or legal reason to do so. 

Where appropriate, I will support involvement of parents and/or legal guardians in a way that promotes the young person’s wellbeing. 

If I believe a young person is struggling to understand important information, I will work with them to support decision-making and involve parents and/or legal guardians where appropriate. 

14.3. Sharing information without consent

For all children and young people, information may need to be shared with parents, guardians or other professionals (for example, GP, Police, social worker or safeguarding services) without consent where: 

  • There is a risk of serious harm to the young person or someone else. 

  • There is a safeguarding concern involving a child or vulnerable adult. 

  • I am required to share information by law. 

Where possible, I will discuss this with the child or young person before information is shared. 

15. Communication and Digital Security

Email and online communication can never be completely secure. 

I use Proton Mail as my professional email provider for communication relating to my practice. Proton Mail provides secure email services designed to support privacy and confidentiality. 

I take reasonable steps to protect the confidentiality and security of email communications; however, please avoid sending highly sensitive clinical information by email where possible. 

Email may be used for purposes such as: 

  • Responding to enquiries. 

  • Arranging appointments. 

  • Sharing information relating to your care. 

  • Communicating about administrative matters. 

Proton Mail is a third-party service provider and has its own privacy policy and security arrangements. I carefully select digital services used within my practice and consider their suitability, security and confidentiality arrangements. 

If we use online therapy, I will use an appropriate secure video conferencing platform. Details of the platform used will be provided before online therapy begins. 

Third-party digital providers have their own privacy policies and security arrangements. I carefully select services appropriate for professional use but cannot guarantee the operation or security of systems outside my direct control. 

16. Payments

Fees for psychological services are normally payable by bank transfer. If you prefer to pay by debit or credit card, card payments will be processed using Tyl by NatWest. 

Tyl by NatWest acts as a payment service provider to process card transactions. Information required to complete payments will be processed by Tyl by NatWest in accordance with their own privacy and security arrangements. 

I do not store full payment card details. 

17. Complaints

If you have concerns about how your personal information is handled, please contact me in the first instance so that I can try to address your concerns. 

You can contact me at drdaveheavens@protonmail.com.

You also have the right to raise concerns with the Information Commissioner’s Office (ICO), which is the UK’s independent authority responsible for upholding information rights. 

Information about making a complaint can be found at: 

Information Commissioner’s Office (ICO)https://ico.org.uk

18. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in my practice, the services I provide, technology, legal requirements or professional guidance. 

Last updated: July 2026

Dr Dave Heavens
Clinical Psychologist 

Email: drdaveheavens@protonmail.com.