Thank you for reading our privacy policy. At Within Psychology Practice, we take your privacy seriously and are committed to protecting your information and handling it responsibly while you use our website and services. This is a safe, confidential space, and this policy explains how we collect and process your data.
Please read this policy alongside any other privacy notices we provide, so you are fully informed about how and why we use your information.
Who is in Charge of Your Data?The data controller is Within Psychology Practice Limited. You can contact us at:
- Post: James Nicol Limited, 17 Wellside Place, Falkirk, FK1 5RL
- Email: waveswithin-psychology@protonmail.com
We are committed to treating your personal data with respect, transparency, and care. If you have questions or concerns about how your data is used, we want to hear from you and will do our best to resolve things quickly and fairly.
Under the Data (Use and Access) Act 2025, you have the right to raise a complaint directly with us first. Here is how:
- Step 1: Email us at waveswithin-psychology@protonmail.com with a brief description of your concern. You do not need to use legal language, just tell us what is worrying you.
- Step 2: We will acknowledge your message and respond without undue delay, usually within 10 working days.
- Step 3: If you are not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk, telephone 0303 123 1113.
“Personal data” is information that identifies you. We may collect, use, store and share the following types of personal data:
- Identity details: first and last name, username or similar identifier, marital status, title, date of birth, and gender.
- Contact details: billing address, email address, and telephone number.
- Technical information: IP address, login data, browser type and version, plug-in types and versions, time zone, location, operating system, platform, and other technology on devices you use to access our website.
- Transaction information: details about payments to and from you.
- Usage information: how you use our website and services.
- Marketing information: your preferences for receiving marketing from us and your communication preferences.
- Special Category Data: information about your health, including existing and previous medical conditions, medication details, psychiatric history, and other relevant health information needed to deliver our services. We do not collect other Special Category Data (race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data) and we do not collect information about criminal convictions or offences.
Consent for Health Data: We require your specific consent to process Special Category Data. When you submit your details, we will ask you to confirm your consent to this processing.
How Do We Collect Your Data?Most of the time, information is collected directly from you in the following ways:
- When you complete our online contact form or send an email enquiry
- When you complete any forms before or during an appointment
- Verbally during discussions
- Correspondence via post, phone, email, or otherwise
- When you request marketing communications
- When you give us feedback or contact us
- Through essential website cookies (see our Cookie Policy for details)
- Technical information from analytics providers
If you do not provide required data, we may be unable to perform our contract with you. We will notify you if this is the case.
Why Do We Use Your Data?- To register you as a new client
- To provide our services, including supporting clinical work, sharing therapy resources, managing payments, and collecting money owed
- To manage our relationship with you, including notifying you of changes to our terms or asking for feedback
- To administer and protect our practice and website
- To deliver relevant website content and measure its effectiveness
- To use data analytics to improve our website, services, and client experience
We rely on one or more of the following lawful bases to process your data: fulfilment of our contract with you; our legitimate interests; or compliance with legal obligations. Where we process sensitive data, we will ask for your consent.
Recognised Legitimate InterestsUnder the Data (Use and Access) Act 2025, we may process your data under a “recognised legitimate interest”, meaning we use your data in ways that support important public or organisational aims while respecting your rights. Examples include:
- Helping prevent fraud or misuse of our services
- Supporting safeguarding and professional standards
- Responding to emergencies or protecting wellbeing
- Improving accessibility and inclusion in our resources
We always carry out a balancing test to ensure our interests do not override yours. You have the right to object to this type of processing at any time. Our obligations around confidentiality and risk of harm are explained in the “Do We Share Your Data?” section below.
CookiesCookies help our website work better for you by remembering your preferences and improving your experience. Our website uses cookies to distinguish you from other users. Please refer to our Cookie Policy for full details.
AI UsageWe may use AI tools to assist with the provision of our services. Any AI tools we use comply with applicable data protection laws, including the UK GDPR. When using AI tools, we ensure:
- Personal data is processed lawfully, fairly, and transparently
- Data minimisation principles are upheld: we only provide AI tools with information strictly necessary for the intended purpose
- Robust security measures are in place to protect your personal data
- Personal data is retained only as long as necessary, then securely deleted or anonymised
| AI Tool | Purpose | Types of Data Used | Legal Basis |
|---|---|---|---|
| WriteUpp (AI-assisted note summarisation) | To generate a draft summary of session notes following a therapy appointment. All AI-generated content is reviewed and edited by Dr Calum Rankin before being stored as part of your clinical record. | Clinical session notes; personal and health information. Processed by WriteUpp Ltd (writeupp.com/privacy-policy). | Explicit consent |
Our website may link to third-party websites, tools, and apps. We do not control those websites and are not responsible for their privacy policies. We encourage you to read the privacy policy of every website you visit.
Do We Share Your Data?We take your data security seriously and only allow certain people to access it. We may share your personal data with:
- Service providers who supply IT and system administration services
- Professional advisers including healthcare professionals, lawyers, bankers, auditors, and insurers
- Your health insurance provider, where you are referred through insurance, for billing and treatment updates
- Our clinical supervisor, for the purposes of professional reflection and improving clinical skills. We refer to clients by first name only and minimise identifiable information
- Your GP or a social worker, where relevant, always with your consent where possible. Where there is a risk of harm to you or another person, we may need to share information without your consent for safety reasons
- Other psychologists or healthcare professionals, where you are referred for specialist care, to ensure continuity of treatment
- HMRC, regulators, and other authorities who require reporting of processing activities
- Debt collection agencies, in the event that payment is not received for services rendered
- Courts, legal representatives, or other relevant authorities for medico-legal purposes where required by law or to protect vital interests
All third parties are required to respect the security of your personal data and may only process it for specified purposes in line with our instructions.
International Data TransfersWe may transfer your data outside the United Kingdom, but only where it is adequately protected. Safeguards include:
- Transferring only to countries deemed to provide adequate protection by the UK
- Using contracts approved by the UK ICO which give personal data the same protection it has in the UK
The only service we use that may transfer data outside the UK is Zoom, used for online appointments. Zoom operates under Standard Contractual Clauses and the EU-US Data Privacy Framework, and we have enabled EU Data Residency on our Zoom account, meaning your data remains protected to UK GDPR standards. Contact us if you have any concerns.
How Secure Is Your Data?We use WriteUpp, a secure practice management platform designed for healthcare professionals and fully GDPR compliant. Only we can access your data and it is processed in accordance with our confidentiality terms. In the rare event of a personal data breach, we have procedures in place and will notify you and any applicable regulator as legally required.
Children’s Data and Age-Appropriate DesignWe are committed to protecting the privacy of children and young people. We currently work with young people aged 12 to 17, as well as adults. In Scotland, young people aged 16 and over have the legal capacity to consent to their own treatment. For clients aged 12 to 15, we ask a parent or guardian to complete the consent form on their behalf.
Where we work with young people under 18, we follow the Age-Appropriate Design Code and the updated rules under the Data (Use and Access) Act 2025. In practice this means:
- We design our services with children’s safety and understanding in mind
- We avoid unnecessary tracking or profiling tools
- We explain things clearly, using child-friendly language wherever possible
- We ask for parental or guardian consent when needed
- We give children meaningful choices about their data
If you are a parent, guardian, or educator with questions about how we handle children’s data, contact us at waveswithin-psychology@protonmail.com.
How Long Do We Keep Your Data?We only keep your data as long as necessary for the reasons we collected it.
- Medical/clinical records: retained for 8 years after your last contact with us
- Children’s records: retained until the child’s 18th birthday at minimum
- Basic client information (contact, identity, financial, transaction data): retained for 6 years after you cease being a client, for tax purposes
For other data, we consider what kind it is, how sensitive it is, the risks if misused, why we need it, and whether there are alternative ways to meet the same purposes.
Your RightsYou have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you (a Subject Access Request). Email us at waveswithin-psychology@protonmail.com with the subject line “DSAR Request”. You do not need to use legal language. We will respond within one calendar month. If your request is complex or repetitive, we may apply proportionality rules under the Data (Use and Access) Act 2025, and will always explain why and keep you informed.
- Correction: Ask us to correct incomplete or incorrect data.
- Erasure: Ask us to delete your personal data. Legal obligations may prevent us from fulfilling this in full; we will inform you if so.
- Objection: Object to the processing of your personal data in certain circumstances.
- Restriction of Processing: Request that we limit processing under specific circumstances.
- Data Portability: Request transfer of your personal data to you or a third party.
- Withdrawal of Consent: Withdraw consent at any time where we rely on it for processing. Withdrawal does not affect the legality of processing done before withdrawal. We will inform you if withdrawal affects our ability to provide services.
Subject Access Requests are free of charge. We reserve the right to charge a reasonable fee or decline to comply only where a request is manifestly unfounded, repetitive, or excessive, and will always explain our reasoning if so.
Changes and ContactThis privacy policy is governed by Scots law. Any disputes arising from it will be subject to the jurisdiction of the Scottish courts. We regularly review this policy. Please keep us updated if your personal data changes.
If you have any questions or need to exercise your rights, contact us at waveswithin-psychology@protonmail.com.