Privacy Policy

1. Who we are

Wise Mynd Ltd is a private psychology practice led by Dr Fabienne Palmer, HCPC-registered Chartered Clinical Psychologist. We are the data controller responsible for your personal data.

• Trading name: Wise Mynd Ltd
• Registered office: Registered in England and Wales
• Companies House number: 12325643
• ICO registration number: ZA645117
• HCPC registration: Practitioner Psychologist
• Contact: hello@wisemynd.co.uk

For any question about how we handle your data, or to exercise your rights, please email hello@wisemynd.co.uk. Dr Fabienne Palmer acts as the point of contact for data protection matters.

2. The personal data we collect

We only collect information that is necessary for the service you are asking for, or that we are required to hold by law and by professional regulation.

Identity and contact data

• Full name and title
• Date of birth (where clinically relevant)
• Email address, telephone number and postal address
• Emergency contact details (where you choose to provide them)
• GP name and surgery (where you choose to share these)

Enquiry data

• The content of any message you send through the website contact form or by email
• Notes from an initial telephone or video consultation

Clinical and special category data

Where you engage in therapy, coaching, supervision or consultation with us, we hold clinical records that may include:

• Presenting difficulties and background history
• Assessment and formulation notes, questionnaire scores and outcome measures
• Session records and clinical letters
• Correspondence with your GP, psychiatrist or other treating professionals (only where you have consented)
• Any information about physical or mental health that you share during our work

This is “special category” data under Article 9 of the UK GDPR and is treated with additional safeguards.

Financial data

• Invoice and payment records
• Bank transfer references (we do not store your card details; payments are processed by our regulated payment provider)
• Insurer details where treatment is funded through a private medical insurer

Website and technical data

• IP address, device type, browser and operating system
• Pages visited, referring website and approximate location (city level)
• Cookies and similar technologies (see our Cookie Policy)

3. How we collect your data

We collect personal data in the following ways:

• Directly from you when you complete the website contact form, email or call us, attend sessions, complete assessments or make payments.
• From third parties with your consent, for example a referring GP, psychiatrist, employer, insurer or agent.
• Automatically through cookies and analytics when you use the website, subject to your cookie preferences.

4. Why we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

To respond to enquiries and arrange an initial consultation

Lawful basis: Article 6(1)(b) performance of a contract, or steps taken at your request before entering into a contract.

To deliver therapy, coaching, supervision or consultation

Lawful basis for personal data: Article 6(1)(b) contract.
Lawful basis for special category data: Article 9(2)(h) provision of health or social care and treatment, and Schedule 1 Part 1 of the Data Protection Act 2018. Where relevant, Article 9(2)(a) explicit consent may also apply.

To keep clinical records as required by professional regulation

Lawful basis: Article 6(1)(c) legal obligation and Article 6(1)(f) legitimate interests in meeting the standards of the HCPC and BPS, together with Article 9(2)(h) for health data.

To meet legal, tax and accounting obligations

Lawful basis: Article 6(1)(c) legal obligation, including HMRC and Companies House requirements.

To keep you safe and to safeguard others

Lawful basis: Article 6(1)(d) vital interests and Article 9(2)(c) where there is a serious risk to life. We will always try to discuss any such disclosure with you first where it is safe and appropriate to do so.

To manage the website and improve the service

Lawful basis: Article 6(1)(f) legitimate interests in running a secure and effective website, or Article 6(1)(a) consent for optional analytics and marketing cookies.

To send occasional professional updates

Lawful basis: Article 6(1)(a) consent. You can withdraw consent at any time by emailing us or using the unsubscribe link in any message.

5. Who we share your data with

Your information is kept confidential. We will not sell your data or share it for marketing. We may share limited information with the following categories of recipient:

• Your GP or other treating clinicians where you have given consent, or in exceptional circumstances where there is a serious risk to your safety or the safety of another person.
• Regulatory and professional bodies (HCPC, BPS) if required to demonstrate our fitness to practise or in response to a lawful investigation.
• Our clinical supervisor and peer consultation group, in anonymised form, in line with HCPC and BPS requirements for safe practice.
• Our accountants and professional advisers under written confidentiality obligations.
• Our data processors who help us run the practice, including website hosting, email, secure video conferencing, online booking, payment processing, cloud storage and backup. All processors are bound by a written data processing agreement.
• Insurers or third-party payors, only where you have asked us to bill them and only to the extent required to obtain authorisation and payment.
• Courts, regulators or law enforcement where we are legally compelled to disclose, for example by court order or a formal safeguarding request.

6. International transfers

Some of the tools we use are hosted outside the United Kingdom. Where personal data is transferred outside the UK we rely on one of the following safeguards:

• Transfers to countries covered by a UK adequacy decision (for example the European Economic Area and Switzerland).
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.

7. How long we keep your data

We only keep personal data for as long as it is needed for the purposes we collected it for, and in line with our professional obligations.

• Clinical records for adults: seven years from the date of your last contact, in line with BPS and HCPC guidance.
• Clinical records for children and young people: until the person reaches age 25, or 26 if they were 17 at the time of the last entry.
• Enquiries that do not proceed to a contract: up to 24 months, then securely deleted.
• Financial and tax records: six years plus the current tax year, as required by HMRC.
• Website and analytics data: up to 26 months.

Once the retention period has ended, records are securely destroyed or irreversibly anonymised.

8. How we protect your data

We take the security of your information seriously. Our safeguards include:

• Encrypted email and secure video conferencing for clinical contact.
• Password-protected, end-to-end encrypted storage for clinical records.
• Multi-factor authentication on all clinical and administrative accounts.
• Regular software updates and security backups of the website.
• A written incident response process. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and, where required, notify you without undue delay.

9. Your rights

Under UK GDPR you have the following rights in respect of your personal data:

• Right of access: to receive a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to ask us to delete data, subject to our legal and professional obligations to retain clinical records.
• Right to restriction: to ask us to limit how we use your data in certain circumstances.
• Right to data portability: to receive your data in a portable format where processing is based on consent or contract.
• Right to object: to object to processing based on legitimate interests, and to object to any direct marketing at any time.
• Right to withdraw consent: where processing is based on consent, at any time.
• Rights relating to automated decision making: we do not make decisions about you using solely automated means.

To exercise any of these rights, please email hello@wisemynd.co.uk. We will respond within one month. We may need to verify your identity before releasing information.

10. Cookies

Our website uses cookies and similar technologies. For a full list of the cookies we set, the categories they fall into, how long they last and how to manage them, please see our Cookie Policy.

11. Children

Wise Mynd Ltd offers services to individuals aged 21 and over. We do not knowingly collect data from children. If you believe a child has provided personal data via our website, please contact us so we can remove it.

12. Changes to this policy

We review this policy at least annually and whenever there is a material change to our practice or to the law. The date at the top of this page reflects the most recent update. Where changes are significant we will draw them to your attention by email or through a notice on the website.

13. How to complain

If you have concerns about how we have handled your personal data, please raise these with us first by emailing hello@wisemynd.co.uk. We take complaints seriously and will respond within a reasonable time.

You also have the right to complain to the Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Concerns about the professional conduct of Dr Fabienne Palmer can also be raised with the HCPC at hcpc-uk.org/concerns.