Privacy Policy

Last updated: 22 June 2026

Who we are

The Paediatric Psychology Clinic is a private psychology practice run by Amelia Carton. I am a registered psychologist and I am committed to protecting your personal data and respecting your privacy.

Contact details:

This privacy policy explains how I collect, use, store, and protect your personal information when you use my services.

What personal data we collect

I collect and process the following types of personal data:

Contact and identification information:

  • Your name, address, telephone number, and email address

  • Emergency contact details

  • For clients under 18: parent or guardian contact details

Health and therapy-related information:

  • Presenting issues and reasons for seeking therapy

  • Session notes and records of our therapeutic work together

  • Relevant medical history

  • Mental health history where relevant

  • Information about your wellbeing and progress

Administrative information:

  • Appointment dates and times

  • Payment records and invoices

  • Correspondence between us

Important: Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection because of its sensitive nature. I take particular care to protect this information.

How we collect your data

I collect your personal data directly from you:

  • When you first contact me to enquire about therapy

  • During the initial assessment or intake session

  • Throughout our therapeutic work together during sessions

  • Through email, telephone, or video communication

  • For clients under 18: from parents or guardians during the consent and intake process

I do not collect personal data about you from third parties without your knowledge, unless this is necessary for safeguarding purposes.

Why we process your data — lawful basis

Under UK data protection law, I must have a valid legal reason (called a "lawful basis") for processing your personal data. For therapy services, I rely on two separate legal bases:

Article 6 basis (ordinary personal data):

Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your psychologist (or, for under-18 clients, when a parent or guardian does so on your behalf), we enter into a contract for me to provide psychological services. I need to process your personal data to fulfil that contract.

Article 9 special category basis (health data):

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. This allows me to process sensitive health information as part of providing you with psychological care.

The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 — health or social care. Processing is carried out by a registered psychologist subject to the professional obligation of confidentiality under the Health & Care Professions Council (HCPC) and British Psychological Society (BPS) Code of Ethics and Conduct.

Professional obligations and CPD

I am required by the Health & Care Professions Council (HCPC) to attend regular clinical supervision as part of maintaining safe and effective practice. I may discuss our therapeutic work with my supervisor. When I do so:

  • Your name and any identifying details are NOT shared with my supervisor

  • I use anonymised or pseudonymised case material only, meaning my supervisor cannot identify you

  • My clinical supervision is provided by a qualified professional bound by the same confidentiality obligations as I am

  • My supervisor is bound by their own professional code of ethics and practice

Clinical supervision helps me reflect on my work and ensures I am providing you with the best possible care. It is a standard and essential part of ethical psychological practice.

Who we share your data with

I take your confidentiality seriously and keep your information strictly private. Beyond clinical supervision (where only anonymised material is shared), I use the following third-party services which may process limited data on my behalf:

  • WriteUpp — my practice management system for session notes and client records

  • MailerLite — for sending newsletters (only if you subscribe)

  • Squarespace — website hosting

  • YouTube — embedded video content on the website

Each of these services is bound by a data processing agreement that requires them to protect your data. Links to their privacy policies are available on request.

I never sell your personal data to anyone.

I may also be legally required to share your information in limited circumstances (see "Confidentiality exceptions" below).

International data transfers

Some of the third-party services I use may transfer personal data outside the United Kingdom:

  • MailerLite (MailerLite Limited, Lithuania — may transfer to USA)

  • Squarespace (Squarespace Inc, USA)

  • YouTube (Google LLC, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025. The USA does not currently have a UK adequacy decision.

WriteUpp processes data on my behalf to deliver practice management services. For specific details on their data handling practices, international transfers (if any), and applicable safeguards, please refer to their privacy policy.

You can request a copy of the relevant transfer safeguards or additional information by contacting me at any time.

How long we keep your data

I retain your personal data for the following periods:

Therapy records (adult clients): 7 years after our last session. Per British Psychological Society (BPS) guidance and professional indemnity insurance requirements.

Therapy records (clients under 18 at time of therapy): Until the client reaches the age of 25. This extended retention period exists because:

  • Children may not fully understand or recall their therapy experience until they are older

  • As an adult, you have the right to access your own childhood therapy records

  • Safeguarding or legal matters may arise that require historical records

  • Professional indemnity insurance may require records to be available for claims made as an adult

Financial records: 6 years (HMRC legal requirement)

Website enquiries (non-clients): 12 months

After the applicable retention period ends, all electronic records are permanently deleted.

Your rights under UK GDPR

You have the following rights regarding your personal data. I have explained each one in plain language:

Right to be informed: You have the right to know how I use your data. This privacy policy fulfils that right.

Right of access (subject access request): You can ask for a copy of all the personal data I hold about you. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information and respond within one month.

Right to rectification: If any of your personal data is inaccurate or incomplete, you can ask me to correct it.

Right to erasure: You can ask me to delete your personal data in certain circumstances. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance requirements, or law.

Right to restrict processing: You can ask me to limit how I use your data in certain circumstances, for example while a complaint is being investigated.

Right to data portability: Where technically feasible, you can ask me to transfer your data to another service provider in a commonly used format.

Right to object: You can object to certain types of processing. For therapy records processed under contract, this right is limited, but I will always consider your concerns.

Rights related to automated decision-making: I do not use automated decision-making or profiling in my practice.

To exercise any of these rights, please contact me at info [at] paediatricpsychologyclinic.co.uk (please replace [at] with @ when emailing). I will respond within one month. There is no fee for most requests, though I may charge a reasonable fee for requests that are clearly unfounded or excessive.

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take complaints seriously and will respond promptly.

To make a complaint:

I aim to resolve all complaints within 30 days.

If you are not satisfied with my response: You may escalate your complaint to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Telephone: 0303 123 1113

  • Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are specific circumstances where I may need to break confidentiality:

  • Risk of serious harm: If I believe you or someone else is at serious risk of harm, I may need to share information with appropriate services to help keep people safe.

  • Child or vulnerable adult safeguarding concerns: If I become aware of abuse, neglect, or risk of harm to a child or vulnerable adult, I have a legal and ethical duty to report this to the relevant safeguarding authorities.

  • Court order: If a court orders me to disclose information, I am legally required to comply.

My commitment to you: Wherever possible, I will always try to discuss any disclosure with you first and involve you in decisions about sharing information — unless doing so would itself put someone at risk.

Working with children and young people

The Paediatric Psychology Clinic primarily works with children and young people under 18. This section explains how I handle data and consent for younger clients.

Parental and guardian consent:

For children under 16, I generally require consent from a parent or guardian before therapy begins. This includes consent for me to collect and process the child's personal data.

Gillick competence:

In England and Wales, children may be able to consent to their own treatment (including the processing of their personal data) if they demonstrate sufficient understanding and maturity. This is known as "Gillick competence" and typically applies to young people aged around 12-16, depending on the individual child's ability to understand what is involved.

Where a child is Gillick competent, I will respect their autonomy and may accept their consent directly, though I encourage family involvement where appropriate.

Who is the data subject?

The child is the data subject, not their parents. This means:

  • The child's data protection rights belong to the child

  • As a child matures, they gain increasing rights over their own data

  • Parents do not have an automatic right to access their child's therapy records

Parental requests for records:

If a parent or guardian requests access to their child's therapy records while the child is currently in therapy, I must consider:

  • The child's own views and wishes

  • Whether the child is Gillick competent to make their own decision

  • Whether disclosure would be in the child's best interests

  • Whether disclosure might cause harm to the child

In most cases, I will discuss any such request with the child (where appropriate to their age and understanding) before making a decision.

Extended retention for young clients:

Records for clients who were under 18 at the time of therapy are retained until the client reaches the age of 25. This ensures that as a young person becomes an adult, they can request access to their own childhood therapy records if they wish.

Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make any significant changes that affect how your data is processed, I will inform you directly.

Minor updates (such as corrections or clarifications) may be made without individual notification, but the current version will always be available on my website.