Privacy Policy

Effective Date: [29/09/2026] Data Controller: (Dr Holly Cumbers, trading under the name Deeper Understanding)
Contact Details: (cumbersholly@gmail.com) (07454 765741)

At [Practice Name], we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Why do we collect information about you?

We collect and process your information to provide you with safe, effective, and evidence-based clinical psychology services. Under the UK GDPR, we must have a “lawful basis” for processing your data. Our lawful bases are:

Contractual Necessity: To provide the psychological therapy or assessment services we have agreed to undertake with you.
Legitimate Interests: To run our practice efficiently and safely.
Provision of Health Care: Because we collect “special category data” (specifically, information about your mental and physical health), we process this under the condition of providing health or social care and treatment.
Performance of a Contract: Processing insurance details to fulfil therapy services funded under your health insurance policy.

What information do we collect about you?

To provide a comprehensive service, we collect both standard personal data and sensitive (special category) data. This includes:

Basic Contact Information: Name, date of birth, address, telephone number, and email address.
Next of Kin/Emergency Contact: Name and contact details in case of an emergency.
Medical Information: Details of your General Practitioner (GP) and any relevant medical history.
Clinical Records: Assessment questionnaires, background information, therapy notes, formulations, and records of our appointments.
Communication Data: Emails, text messages, or letters exchanged between us.
Insurance Details: Membership/policy numbers, pre-authorisation codes, scheme limits, and claims history associated with your health insurance provider (Bupa).
Website Analytics and Cookies
Like most websites, our website uses cookies and similar technologies. Cookies are small text files placed on your device to help the site function and provide us with information about how the site is used.
Website Analytics When you visit our website, we use third-party analytics services (such as (Google Analytics) to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site, which helps us improve our online presence.
This information is processed in a way that does not directly identify anyone (it is aggregated and anonymised).
We do not make, and do not allow our analytics providers to make, any attempt to find out the identities of those visiting our website.
We rely on your explicit consent to collect this analytics data.
Our Cookie Policy We use the following types of cookies on our website:
Strictly Necessary Cookies: These are essential for the website to function securely and properly (e.g., page navigation, protecting contact forms from spam). These are automatically enabled and do not require your consent.
Performance & Analytics Cookies: These help us understand how visitors interact with our website. These are only activated if you give your consent via our cookie banner.
Third-Party Services: If our website includes embedded features (Calendly), or interactive maps), these third-party providers may set cookies on your device. These also require your consent.
Managing your cookie preferences: When you first visit our website, you will see a cookie banner allowing you to accept or reject non-essential cookies. You can change your preferences or withdraw your consent at any time by clicking the “Cookie Settings” link at the bottom of our website, or by adjusting your web browser settings to block cookies entirely.

How do we store the information about you?

We take the security of your data very seriously. Your information is stored securely in the following ways:

Electronic Records: Your personal details, appointment information, and clinical notes are stored securely using WriteUpp, a specialized, cloud-based practice management system for healthcare professionals. WriteUpp is fully compliant with the UK GDPR, uses two-factor authentication and encrypts your data both in transit and at rest.
Paper Records: Any physical documents containing personal information are kept in a locked filing cabinet that is only accessible by
(Dr Holly Cumbers, 07454 765741).
Communications: Mobile phones and laptops used for practice purposes are protected with passcodes and encryption.

How long do we keep your information for?

We do not keep your personal data for longer than is necessary. In line with guidance from professional bodies such as the British Psychological Society (BPS) and the Health and Care Professions Council (HCPC), we retain adult clinical records for a period of 7 years after the end of your therapy or our last contact with you.

After this time, all electronic records will be securely deleted, and physical records will be safely shredded.

Who do we share your personal information with?

Your information is kept strictly confidential. We will not share your personal data with third parties for marketing purposes. However, there are specific circumstances where we may need to share your information:

Medical Professionals: It is standard practice to inform your GP that you are attending psychological therapy, and we may share a brief discharge summary with them (this is usually done with your explicit consent).
Supervision: As part of professional practice, clinical psychologists are required to have regular clinical supervision. Cases are discussed anonymously, and you will not be identifiable.
Risk of Harm: If we believe that you or someone else is at serious risk of harm, we have a professional and legal duty to break confidentiality and contact relevant authorities (e.g., your GP, emergency services, or social services). We will always attempt to discuss this with you first if it is safe and appropriate to do so.
Legal Obligations: We may be required to share information if ordered to do so by a court of law.
Private Health Insurance Companies: If your treatment is funded through private medical insurance (e.g., Bupa, AXA Health, Aviva, Vitality), we will share relevant personal and clinical information with your insurer. This may include your name, date of birth, policy/authorisation numbers, billing codes, appointment dates, diagnostic descriptions, treatment summaries, or session usage reports necessary to process claims and secure funding.

Medical Billing Platforms: We may process invoices and claims securely via third-party clearing platforms (Writeupp) in accordance with UK data protection regulations.

What are your rights?

Under the UK GDPR, you have several rights regarding your personal data:

The Right to be Informed: To know how your data is being used (which this policy explains).
The Right of Access: To request a copy of the personal information we hold about you.
The Right to Rectification: To ask us to correct information you think is inaccurate or incomplete.
The Right to Erasure: To ask us to erase your personal information in certain circumstances (please note that due to our legal and professional obligations to maintain healthcare records, this right may not always apply).
The Right to Restrict Processing: To ask us to restrict the processing of your data in certain circumstances.
The Right to Data Portability: To request that your data be transferred to another organization or to you.
The Right to Object: To object to how your data is being processed.

How you can access your information and correct if necessary?

You have the right to request a copy of the information we hold about you (known as a Subject Access Request). If you would like a copy of some or all of your personal information, please email or write to us at [cumbersholly@gmail.com. We will provide this within 30 days, free of charge.

If you believe any information we hold about you is inaccurate or out of date, please let us know, and we will correct or update it promptly.

Complaints or queries

If you have any questions about this Privacy Policy or how your data is handled, please contact (Dr Holly Cumbers) at (cumbersholly@gmail.com) or
(07454 765741).

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights. I would appreciate being given the opportunity to resolve it with yourself first, if you feel that you can contact me about this.

Information Commissioner’s Office (ICO) Contact Details: Website: www.ico.org.uk Telephone: 0303 123 1113

HCPC registration number – PLY043183, Check the Register and find a registered health and care professional | The HCPC

ICO registration number – ZB695728 Search the register | ICO