Dr Hazel Rayner (CPsychol)
Clinical Psychologist
HCPC Registered Practitioner Psychologist 

Privacy Statement

Your privacy is of great importance to me and I am committed to complying with the terms of the General Data Protection Regulation (GDPR) regarding the responsible and secure use of your data.

In order to provide psychological services which are safe and professional, I have a legitimate interest as a Registered Practitioner Psychologist in processing personal data including some forms of sensitive (including ‘special category’) data (such as details about mental health conditions).

The purpose of this statement is to let you know what personal information I collect and hold, why this data is collected, how long it is kept and what your rights are with regards to this personal data. I am registered with the Information Commissioners Office (ICO), with whom my Registration Number is: ZB836726.

When you agree to receive (or for your child to receive) psychological services from me, you are asked to consent to the processing of your/your child’s data under the terms of this policy (which should be read in conjunction with the Terms & Conditions). You do not have to agree to share information with me, however, in many cases I may not be able to offer you a service if you do not.

If your child is over 16 years of age they will also be asked to consent to this processing of their data under this policy. If your child is under 16, their stage of development and capacity to understand and weigh up considerations about how their personal information is treated will be taken into consideration in how they are informed and given a say about this process alongside your own decision (this is covered in more detail in the Terms & Conditions which will be sent to you when you book an initial consultation).

Who is the Data Controller?

I, Dr Hazel Rayner (trading as Kernel Psychology) am the Data Controller. I refer to myself and my role as the Data Controller as “I” throughout this document. 

What information do I collect?

I collect personal data such as name, address, date of birth, GP/medical practitioner details, Next of Kin details, children, occupation, telephone/SMS numbers and email addresses for the purpose of arranging and providing psychological care, verifying identity, contacting you if there is a problem, contact in case of emergency, and processing payment.

I also collect potentially sensitive data you give me (including some forms of “Special Category” data) regarding personal, family and relationships background; health data including medical conditions, prescribed medication and illicit substance use, disability (if relevant), psychological history and current difficulties, therapy history, completed psychometric measures/questionnaires; sex/identified gender (if relevant); sexuality/sexual orientation (if relevant); religious or political beliefs or trade union membership (if relevant); racial or ethnic background (if relevant); offences; financial information including bank account details (for billing, invoicing and tax calculation purposes); signed therapy/services agreement & GDPR agreement. My lawful reason for collecting such data is that doing so is that it is necessary for the provision of safe and professional mental health treatment (including psychological therapy) as a Registered Practitioner Psychologist with the Health & Care Professions Council (HCPC).

​I may also collect information about you if I am providing supervision, training or other services to you. If you are a supervisee I will have a contract/Supervision Agreement with you, which will be my lawful reason to process your data. 

What do I use your information for?

I use your information in the following ways:

·        To provide clients with psychological services requested;

·        To offer appointment times and notify you about changes to your appointments;

·        To fulfil any administrative, legal, ethical and contractual obligations. 

What information do I share?

I will NOT share any information about you with other organisations or people, except in the following situations:

When you’ve given your consent to share information: I may share information with relevant health and care professionals (or - if you/your child is under 18 - someone who has Parental Responsibility), or others whom you have requested or agreed we need to contact.

If there is a risk of serious harm: I may share information with the relevant authorities (or - if you/your child is under 18 - someone who has Parental Responsibility) if I have reason to believe that this may prevent serious harm being caused to you or another person.

To comply with the law: I may share information when the law requires me to – e.g. in relation to Safeguarding, or the prevention of serious crime such as terrorism and trafficking.

Clinical will: I may set up a clinical will, which means in the event of my sudden death or a serious accident or illness, a named colleague would be able to access contact details so they can notify clients and take necessary steps to protect their data.

For supervision: It is an professional requirement for any clinician offering psychological services to have regular supervision with an experienced and appropriately qualified and accredited clinician, who follows their own accrediting organisation’s ethical and professional practice standards. Supervisors also have a duty of confidentiality and will keep any information private (with the same limitations to confidentiality outlined above).

Learning about your experience: As a result of sharing your information with me, you will NOT be subject to any automated decision making, profiling, or marketing.  I may ask for (but you are not obliged to give) information on how you found my service or your experience of the service I provide (such as a testimonial) for the purpose of my own marketing and service improvement research: such information would not be shared without your consent and agreed anonymisation.  I will never sell your information to others. 

Supervisees or professionals seeking consultation

I will only use the information you supply to me to support your supervision or professional consultation. In addition, I may collect information such as your bank details for processing payments, your qualifications and professional registration details, and information regarding previous professional experience and supervision.

I will not disclose information about our supervision to a Third Party unless we have discussed this beforehand (e.g. for a job reference) or disclosure is required by law.

How do I keep your information safe?

All information you provide to me is stored as securely as possible. I will take all reasonable precautions to prevent the loss, misuse or alteration of information given.

All paper forms, notes and correspondence are kept in a lockable cabinet when not in use. All electronic files are kept on a password-protected device with virus protection software. Word documents containing personal information are password protected. My email account is with a secure provider (Protonmail), though I cannot be held responsible for any breaches in confidentiality caused by failures in any of the software or platforms utilised, or for the security of your own email provider, which you may wish to consider when you choose to email me.

Any known data breaches will be reported to the ICO within 72 hours. 

How long do I keep your information for?

In line with the British Psychological Society’s Professional Practice Guidelines, there are different data retention periods for people of different ages, to afford them opportunity to access their records before they are securely destroyed.

For clients over 18 years-old at the time of accessing psychological services clinical records are kept for seven years after the period of accessing psychological services from me ends.

For clients under 18 years-old at the time of accessing psychological services from me, clinical records are kept until the client is 26 years-old.   

I do not keep your data for longer than is necessary. 

How can you access the information I keep about you?

Any requests for personal data need to be made through a Data Subject Access Request and, unless there lawful grounds not to do so (for example if the information relates to another person such as a family member, or if I believe the information would cause serious harm if disclosed) will be supplied within one month. 

Your rights

Under the GDPR, you have the right to:

·        Access your personal data

·        Rectify, erase or restrict your data

·        Object to the processing of your data

·        Request transfer of data (data portability).

You may withdraw your consent for me to hold and process your data at any time. However, if you do this while actively receiving psychological services, the services may have to end and earlier records may be subject to data retention periods. You can withdraw your consent by stating this on an email to hazel@kernelpsychology.co.uk

If you have any concerns about the way I handle your data please contact me.  If you feel this has not resolved your concerns effectively, you have the right to contact the Information Commissioners Office - the UKs independent authority for upholding information rights and data privacy in the public interest. 

Website access, security and collection of information

If you complete the Contact Form on my webpage, I will collect any of the information you voluntarily provide to me.

My website uses cookies to enable the core functioning of the website and monitor website traffic. I do not identify you or any other individuals from cookies. My Cookie Policy can be found here.

My website provides links to some Third Party websites. Each of these websites and organisations will have their own Cookies Policies. Although every effort is made to provide genuine and helpful links, the security and accuracy of Third Party websites cannot be verified by Kernel Psychology. 

Children and the use of the website: Although it is intended my website will be accessed predominantly by adults, the needs of children and adolescents who might foreseeably access the site have been taken into consideration in a Data Protection Impact Assessment (DPIA). This is available on request.  

Changes to this policy

This document is a work in progress and may be modified from time to time. If significant changes are made while you are working with me, you will be notified and sent a revised policy.  

Policy last updated: 23rd December 2024

By: Dr Hazel Rayner (CPsychol), Clinical Psychologist, trading as Kernel Psychology