Privacy Policy of Serendipity Psychology Services Ltd

Who We Are

Serendipity Psychology Services Ltd is an independent mental health company offering psychological therapy, assessments, consultation, training, and related services.

We are committed to protecting the privacy and confidentiality of all individuals accessing our services, including children, young people, vulnerable adults, and adults. This Privacy Policy outlines how we collect, use, share, and store personal data in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. It also provides information on how we communicate with clients regarding new services and handle safeguarding concerns.

Scope

This Privacy Policy applies to:

All clients of Serendipity Psychology Services Ltd, including children, young people, vulnerable adults, and adults.
Any personal information collected from clients, guardians, or other individuals acting on behalf of clients.

Definitions

Personal Data: Any information that can identify a person, such as names, addresses, phone numbers, email addresses, and health information.
Sensitive Personal Data: Includes data related to a person’s health, racial or ethnic origin, sexual orientation, or other sensitive categories that require enhanced protection.
Data Controller: Serendipity Psychology Services Ltd, responsible for determining how personal data is processed.
Data Processor: Any third party that processes personal data on behalf of Serendipity Psychology Services Ltd.
Safeguarding: Actions taken to protect children, young people, vulnerable adults, and adults at risk of harm or abuse.

Data Collection and Use

We collect and process personal data for the following purposes:

To provide psychological and psychotherapy services, including assessment and treatment.
To communicate with clients about appointments, treatment plans, and progress.
To maintain accurate records of client interactions.
To comply with legal obligations, including safeguarding and the reporting of harm.
To send clients information about new services, workshops, or events offered by Serendipity Psychology Services Ltd (with client consent).

What Information We Collect and Why

We may collect the following types of personal data:

Data Type	Purpose	Legal Basis (UK GDPR)
Name, date of birth, contact details	To identify you and communicate with you	Contractual necessity / Legitimate interests
Health and mental health information	To provide safe, effective psychological care	Provision of health care (special category data)
GP name and contact details	For safeguarding, coordination of care, and emergencies	Legitimate interests / Vital interests
Medical and developmental history	To inform assessment and treatment plans	Provision of health care
Emergency contact details	In case of urgent concerns	Vital interests
Financial data (e.g. invoices, payments, funding sources)	To manage billing, insurance, and contracts	Contractual necessity / Legal obligation
Email, phone or website interaction data	For communications, service updates, or marketing (if opted in)	Consent / Legitimate interests

Special Category Data

As a provider of psychological and therapeutic services, we routinely collect and process special category data as defined under Article 9 of the UK GDPR. This includes information that is considered more sensitive and therefore requires additional protection.

Special category data we may hold includes, but is not limited to:

Health and mental health information
Medical and developmental history
Therapy session notes and assessment reports
Information about sex life or sexual orientation
Racial or ethnic origin
Religious or philosophical beliefs
Information about family relationships, trauma history, or safeguarding concerns

We collect and process this data under the lawful basis of:

Article 6(1)(b) – For the performance of a contract (i.e. delivering the service you have requested), and

Article 9(2)(h) – For the provision of health or social care or treatment, carried out by or under the responsibility of a regulated health professional.

We only collect what is necessary to provide you with safe, high-quality care, and your information is treated with strict confidentiality and stored securely.

How We Collect Your Data

We collect data:

Directly from you (via referral forms, therapy sessions, assessments, etc.)
From parents, carers, or professionals involved in your care
From third parties (with your consent), such as GPs or case managers
Through our secure digital platforms (e.g. Tacklit, WriteUpp, Outlook)

For clients under the age of 18, we collect personal information from the child’s parent or guardian and may also collect information directly from the child during therapy. We ensure that children and young people understand how their data will be used, where appropriate, and we seek consent from both the child and the parent or guardian where required.

How We Use and Store Your Data

We only use your data for the purposes it was collected, and always lawfully and transparently. Your information is stored securely using systems such as Tacklit (our clinical records platform), WriteUpp, Outlook, Sage, and other secure systems.

We retain data for a minimum of 7 years after your final contact with us (or until age 25 for under-18s, whichever is longer), in line with professional guidance.

Who Can Access Your Information

Only professionals involved in your care or the operation of our service will have access to your information — and only when this is necessary.

This may include:

Your treating therapist or psychologist
Clinical or administrative staff who manage records or appointments
Other professionals within the team involved in multidisciplinary care
External supervisors or consultants, where required for clinical oversight and safety

Many of our clinicians work with us as self-employed contractors. While they are not employees of Serendipity Psychology Services Ltd, they are contractually bound to follow our data protection policies and are required to use our secure systems (e.g. Tacklit or WriteUpp) for all clinical records.

Self-employed team members may:

Temporarily hold paper notes (e.g. during home visits or travel) — these are expected to be securely transferred to our systems promptly
Access external clinical supervision — only anonymised or minimal necessary information is shared, in line with ethical guidance

All contractors and supervisors are required to maintain confidentiality, comply with GDPR, and follow their professional codes of conduct.

Third-Party Providers We Work With

To deliver our services safely, efficiently, and professionally, we work with a small number of trusted third-party providers. These organisations help us manage communications, clinical records, financial processes, IT systems, and service improvement. All third parties are required to comply with strict confidentiality, data protection, and information security standards under GDPR.

We only share the minimum necessary data with these providers.

Category	Purpose	Examples
Clinical records and appointment systems	To store therapy notes, manage appointments, and maintain secure records	Tacklit, WriteUpp, Microsoft
Email and communication platforms	To send appointment confirmations, reports, and secure correspondence	Outlook (Microsoft), Mailchimp (newsletters if opted in), Zoom, Teams (Microsoft)
Financial administration	To manage invoicing, accounting, and financial reporting	Sage, Nineteen Accountants Ltd, Johnsons Bookkeeping
Supervision and clinical governance support	To ensure safe and ethical practice with appropriate oversight	Accredited supervisors (internal or external), all bound by confidentiality and professional standards
Referrers, funders and care professionals	To coordinate care, manage funding, or inform support plans	GPs, schools, local authorities, case managers, insurance providers
IT, marketing, website and data security support	To maintain our systems, devices and digital security	Always Networks (IT provider), external web support, Rebeccah Platts (Marketing Support)
Administrative and clinical operations support	To assist with referral processing, record-keeping, and compliance monitoring	PsychVA Ltd

Your Rights

Under GDPR, you have the right to:

Access the personal data we hold about you
Request correction of any inaccurate or incomplete information
Request deletion of your data (in some circumstances)
Object to or restrict how we process your data (including for marketing purposes)
Request data portability (transfer to another service provider)
Withdraw consent at any time (where consent is relied upon)
Complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

To exercise your rights or raise a concern, email: support@serendipitypsychology.co.uk

Cookies and Website Analytics

We use cookies and analytics tools on our website to help us improve functionality and the user experience. You can manage your cookie settings in your browser at any time.

Communicating with Clients

Serendipity Psychology Services Ltd may contact clients to:

Provide information about new services, events, or workshops that may be of interest.
Share updates about therapy sessions, scheduling, or other related matters.

Marketing and Service Updates

Clients will be asked for their consent to receive communications about new services and events. You have the right to opt out of receiving these communications at any time by contacting us or by following the unsubscribe instructions included in the communication.

Updates to This Notice

We may occasionally update this Privacy Notice to reflect changes in our practice, providers, or legal requirements. The most up-to-date version will always be available on our website.