Privacy Policy

Last updated: [DATE]

This policy explains how Dr Ali Cliffe collects, uses and protects personal information, both through this website and in the course of providing psychotherapy. Please read it alongside the Terms and Conditions.

Who I am

Dr Ali Cliffe is a Child and Adolescent Psychoanalytic Psychotherapist based in Bath, registered with the Association of Child Psychotherapists (ACP registration 6901).

For the purposes of UK data protection law, I am the data controller for the information described in this policy.

  • Contact: alison_cliffe@icloud.com

  • Telephone: 07505 586020

  • Correspondence address: [ADDRESS, or state that this is available on request]

  • ICO registration number: [NUMBER, or remove this line if not yet registered]

If you have a question about how your information is handled, please contact me directly using the details above.

The information I collect

Enquiries and initial contact. When you contact me by email, telephone or through this website, I collect your name, contact details and any information you choose to share about the difficulties you or your child are experiencing.

Assessment and therapy. If we go on to work together, I hold a clinical record. This may include:

  • Name, date of birth, address and contact details of the child or young person and of parents or carers

  • GP details and, where relevant, details of the school and other professionals involved

  • Referral information and reports from other services

  • Information about family circumstances, health, development and history

  • Session notes and my clinical thinking about the work

  • Correspondence, consent forms and safeguarding records

  • Records of appointments, fees and payments

Much of this is special category data under UK GDPR, because it concerns physical and mental health. Some of it concerns children. I treat it with corresponding care.

Website data. This website is built and hosted on Squarespace. Squarespace sets cookies and collects limited technical information such as IP address, browser type and pages visited, in order to operate the site and provide basic analytics. Further detail is available in the Squarespace cookie policy at squarespace.com/cookie-policy.

Why I use your information, and the lawful basis

Purpose Lawful basis (UK GDPR) Responding to an enquiry Article 6(1)(b) steps prior to entering a contract, or 6(1)(f) legitimate interests Providing assessment and psychotherapy Article 6(1)(b) performance of a contract, and Article 9(2)(h) provision of health or social care treatment by a professional bound by an obligation of confidentiality Keeping accurate clinical records, as required by my professional body Article 6(1)(c) legal obligation and 6(1)(f) legitimate interests, with Article 9(2)(h) Clinical supervision and professional development Article 6(1)(f) legitimate interests, with Article 9(2)(h). Material is anonymised or pseudonymised wherever possible Safeguarding a child or responding to a risk of serious harm Article 6(1)(d) vital interests or 6(1)(c) legal obligation, with Article 9(2)(b), 9(2)(c) or 9(2)(h) Invoicing, accounts and tax records Article 6(1)(c) legal obligation Defending a legal claim or responding to a complaint Article 6(1)(f) legitimate interests, with Article 9(2)(f)

I do not use your information for marketing, and I do not sell or share it for commercial purposes.

Confidentiality and when I may share information

What happens in therapy is confidential. There are limited circumstances in which I may need to share information:

  • Safeguarding. If I believe a child or young person is at risk of significant harm, or that someone else is at risk, I have a professional and legal duty to share relevant information with the appropriate agency, such as children's social care or the police. Wherever it is safe and appropriate to do so, I will discuss this with you first.

  • Risk to life. If there is an immediate risk to someone's life, I may contact emergency services, a GP, or another named contact.

  • Clinical supervision. As required by the ACP, my work is discussed in regular supervision with a qualified supervisor who is also bound by confidentiality. Identifying details are minimised.

  • Other professionals. With your consent, I may correspond with a GP, school, paediatrician or other professional where this supports the work.

  • Legal requirement. I may be required to disclose information by a court order or other legal obligation.

  • Service providers. Certain organisations process information on my behalf, for example my website and email providers, my accountant and my professional indemnity insurer. These are set out below.

Processors and third parties

  • Squarespace, for website hosting and any enquiry form submissions

  • Apple (iCloud Mail), for email correspondence

  • [ACCOUNTING OR INVOICING SOFTWARE, if used]

  • [ONLINE SESSION PLATFORM, if used, for example Zoom]

  • [PROFESSIONAL INDEMNITY INSURER], where a claim or potential claim arises

Some of these providers are based outside the UK, principally in the United States. Where information is transferred internationally, it is protected by safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How information is stored

Clinical records are kept securely. Paper records are held in [a locked cabinet at a secure location / DESCRIBE]. Electronic records are held on [password-protected and encrypted devices / DESCRIBE], with access limited to me.

Identifying information is kept separately from session notes where practicable. I use initials or a case reference rather than full names in working notes wherever possible.

How long information is kept

Clinical records for children and young people are retained until the young person's 25th birthday, or until their 26th birthday if they were 17 at the conclusion of treatment, in line with the NHS Records Management Code of Practice. This is so that the record remains available to them in adulthood should they need it.

Records for adults [for example parent work or young adults aged 18 to 25] are retained for [NUMBER] years after the end of the work. [CONFIRM WITH YOUR INSURER, commonly 7 years or longer.]

Enquiries that do not lead to therapy are deleted within [NUMBER] months.

Financial records are kept for six years after the end of the relevant tax year, as required by HMRC.

At the end of the retention period, records are securely destroyed.

Your rights

Under UK data protection law you have the right to:

  • Be informed about how your information is used

  • Request a copy of the information I hold about you

  • Ask for inaccurate information to be corrected

  • Ask for information to be erased in certain circumstances

  • Object to, or ask me to restrict, certain processing

  • Withdraw consent where processing is based on consent

  • Request that information be transferred to another provider in certain circumstances

These rights are not absolute. Where I have a professional or legal obligation to retain a clinical record, I may not be able to delete it, and I may withhold parts of a record where releasing it would be likely to cause serious harm, or would disclose information about another person who has not consented.

Children and young people. Where a child has sufficient understanding to make their own decisions, usually from around the age of 12 but assessed individually, they exercise these rights themselves. For younger children, a person with parental responsibility exercises them on the child's behalf, provided this is in the child's best interests. A parent's right to see a child's therapy record is not automatic, and I will consider the young person's own views and confidentiality before releasing anything.

To make a request, contact me using the details above. I will respond within one month.

Complaints

If you are unhappy with how I have handled your information, please tell me first so that I can try to put it right. You also have the right to complain to the Information Commissioner's Office:

Changes to this policy

I may update this policy from time to time. The current version is always published on this page, with the date it was last updated shown at the top.