Data Retention Policy

Last updated: 22 June 2026

The Paediatric Psychology Clinic
Amelia Carton, Registered Practitioner Psychologist

Introduction

This policy explains how long I keep your personal information and why. As a psychologist working primarily with children and young people, I have specific legal, professional, and ethical obligations regarding record-keeping. This policy is written in plain English so that both clients and their parents or guardians can understand it clearly.

I am registered with the Information Commissioner's Office (ICO), registration number 00012049252.

Why I Retain Your Data

I keep records of our work together for several important reasons:

  • Legal requirements — UK GDPR and the Data Protection Act 2018 require me to keep records accurate and for no longer than necessary, but other laws (such as tax legislation) require me to keep certain records for minimum periods

  • Professional obligations — The British Psychological Society (BPS) Code of Ethics and Conduct requires me to maintain adequate records of psychological services

  • Professional indemnity insurance — My insurance requires me to retain records in case a complaint or claim arises after therapy ends

  • Your benefit — Records allow me to provide continuity of care if you return to therapy, and enable you to request access to your records in the future

  • Safeguarding — When working with children and young people, thorough records support safeguarding responsibilities and may be needed if concerns arise later

Retention Periods

A Note for Parents and Young Clients

If your child begins therapy with me at any age under 18, I will retain their therapy records until they reach age 25. This extended retention period exists to protect your child's interests — it allows them, as adults, to request access to their own therapy records and ensures records remain available should any safeguarding or legal matters arise later.

What I Retain

The records I keep may include:

  • Session notes — my professional notes about our therapy sessions

  • Contact details — names, addresses, telephone numbers, email addresses

  • Assessment materials — any assessments, questionnaires, or outcome measures completed

  • Consent records — including parental or guardian consent for children, and records of Gillick competence assessments where a young person consents for themselves

  • Correspondence — emails, letters, and messages relating to your care

  • Payment records — invoices and payment confirmations

  • Safeguarding records — any safeguarding concerns, disclosures, or referrals made

How Your Data is Stored

I keep digital records only — I do not maintain paper therapy files.

Your electronic records are:

  • Held on password-protected devices

  • Access is restricted to me (Amelia Carton)

  • Stored using WriteUpp, a secure practice management system designed for healthcare professionals

My clinical supervisor receives anonymised case material only for the purposes of professional supervision — this means they do not see your name or identifying details.

Your Right to Erasure

Under UK GDPR, you have the right to request erasure (deletion) of your personal data. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by:

  • British Psychological Society (BPS) professional guidelines

  • Professional indemnity insurance requirements

  • Legal obligations (such as tax records or safeguarding documentation)

If you ask me to delete your records before the retention period ends, I will explain clearly why I need to keep them and for how long. Once the retention period has passed, you may request deletion and I will action this promptly.

A Note About Children's Records

The child or young person is the data subject, even when a parent or guardian gave consent for therapy. This means:

  • Parents or guardians cannot automatically demand access to or deletion of their child's therapy records

  • Once a young person reaches adulthood, they have the right to access their own records

  • I will always consider the child's best interests and confidentiality when responding to any requests

Secure Disposal

At the end of the applicable retention period, I dispose of records securely:

  • Electronic records are permanently deleted from all devices and backup systems

I maintain a log of destroyed records to demonstrate compliance with UK GDPR.

Data Protection Complaints

If you have concerns about how I handle your data, please contact me first so I can try to resolve the matter:

Email: info [at] paediatricpsychologyclinic.co.uk
(Replace [at] with @ when emailing)

You can also submit concerns via my compliance page at https://thepaediatricpsychologyclinic.policydiary.co.uk

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO):

Changes to This Policy

I may update this policy from time to time to reflect changes in law or my practice. The current version is always available on my website at https://www.paediatricpsychologyclinic.co.uk