Privacy Policy of Serendipity Psychology Services Ltd

Last updated: 

Special Category Data

As a provider of psychological and therapeutic services, we routinely collect and process special category data as defined under Article 9 of the UK GDPR. This information is more sensitive and requires additional protection.

Special category data we may hold includes, but is not limited to:

• Health and mental health information
• Medical and developmental history
• Therapy session notes and assessment reports
• Information about sex life or sexual orientation
• Racial or ethnic origin
• Religious or philosophical beliefs
• Information about family relationships, trauma history, or safeguarding concerns

We collect and process this data under:

• Article 6(1)(b) – for the performance of a contract (delivering the service you have requested), and
• Article 9(2)(h) – for the provision of health or social care or treatment, carried out by or under the responsibility of a regulated health professional.

We only collect what is necessary to provide you with safe, high-quality care. Your information is treated with strict confidentiality and stored securely.

How We Collect Your Data

We collect data:

• Directly from you (via referral forms, therapy sessions, assessments, etc.)
• From parents, carers, or professionals involved in your care
• From third parties (with your consent), such as GPs or case managers
• Through our secure digital platforms (e.g. Tacklit, WriteUpp, Outlook, RingCentral)
• Through AI-assisted note-taking (Heidi) and recording of telephone sessions (RingCentral)

For clients under 18, we collect personal information from the child’s parent or guardian and may also collect information directly from the child during sessions. We make sure children and young people understand how their information will be used, where appropriate, and we seek consent from both the child and the parent or guardian where required.

How We Use and Store Your Data

We only use your data for the purposes it was collected, and always lawfully and transparently. Your information is stored securely using systems such as Tacklit (our clinical records platform), WriteUpp, Microsoft Outlook, Sage, and other secure systems.

We keep clinical records for a minimum of 7 years after your final contact with us (or until age 25 for under-18s, whichever is longer), in line with professional guidance. Our AI scribe does not keep audio recordings, and its transcripts and draft notes are deleted automatically once the final note is saved to your record (see below).

AI-Assisted Note-Taking (AI Scribes)

Some of our clinicians use a secure AI scribe called Heidi Health to help write clinical notes, letters and reports. It is used widely across the NHS and private healthcare, and we have chosen it because it helps us give you a better experience:

• More of your clinician’s attention. Instead of typing or writing, your clinician can focus fully on you, keep eye contact and follow the conversation naturally.
• More accurate records. Notes reflect what you actually said, in more detail, so less is missed or misremembered.
• Faster letters and reports. Less time on paperwork means your reports and letters can reach you, your GP or school sooner.
• More time for care. Time saved on admin is time our clinicians can spend on assessment, therapy and seeing more people.

How it works

1. The AI scribe listens to the session and creates a written transcript.
2. It uses the transcript to produce a draft note or letter.
3. Your clinician reads, corrects and approves the draft before anything is added to your record. The clinician remains fully responsible for the content.

How your information is protected

• No audio recordings are stored. Audio is converted to text as the session happens and is not kept.
• Data is encrypted and hosted on servers in the UK.
• Transcripts and draft notes are deleted automatically once the final note is saved to your clinical record.
• Your information is never used to train AI models.
• Heidi acts as a data processor under a contract with us and complies with UK GDPR. We have completed a Data Protection Impact Assessment (DPIA) before using it.
• The AI scribe does not make any decisions about your care. All clinical judgements are made by your clinician.

Your choice

Your clinician will tell you at the start of the work with them if an AI scribe is being used. You (or a parent or guardian on a child’s behalf) can ask for it not to be used.

Online and Telephone Sessions

Some sessions take place by video or telephone using secure, GDPR-compliant platforms, including RingCentral, Microsoft Teams and Zoom. These platforms encrypt calls and are bound by contract to protect your data.

Telephone calls to the central office are held on RingCentral are recorded for training and quality monitoring purposes. You will be told about this in advance. If you do not want your session recorded, please tell the call handler at the start of the call and the recording will be stopped. Recordings are stored securely, accessed only by authorised clinical and supervisory staff.

Recording online assessments

During some online assessments, such as autism (ASD) and ADHD assessments, we may ask to record the session so the clinician can refer back to it when writing your report. This helps make sure nothing important is missed. You can ask for the session not to be recorded. Recordings are stored securely, used only by the clinicians involved in your assessment, and deleted once your assessment report has been submitted and your feedback session has been held.

Recordings by students and assistants

Sometimes a trainee, student or assistant psychologist working with us may ask to record a session, for example for their training or supervision. We will always ask for your consent in advance, and the session will only be recorded if you agree. You can change your mind at any time. These recordings are stored securely, used only for the purpose explained to you, and deleted once that purpose has been met.

To protect your privacy, we recommend joining from a private space, using your own device, and not recording sessions yourself without first agreeing this with your clinician.

Who Can Access Your Information

Only professionals involved in your care or the operation of our service will have access to your information, and only when this is necessary. This may include:

• Your treating therapist or psychologist
• Clinical or administrative staff who manage records or appointments
• Other professionals within the team involved in your multidisciplinary care
• External supervisors or consultants, where required for clinical oversight and safety

Many of our clinicians work with us as self-employed contractors. While they are not employees of Serendipity Psychology Services Ltd, they are contractually bound to follow our data protection policies and must use our approved secure systems (e.g. Tacklit, WriteUpp, Heidi, RingCentral) for clinical records and sessions.

Self-employed team members may:

• Temporarily hold paper notes (e.g. during home visits or travel). These must be securely transferred to our systems promptly.
• Access external clinical supervision. Only anonymised or minimal necessary information is shared, in line with ethical guidance.

All contractors and supervisors must maintain confidentiality, comply with UK GDPR, and follow their professional codes of conduct.

Third-Party Providers We Work With

To deliver our services safely and efficiently, we work with a small number of trusted third-party providers. They help us manage communications, clinical records, financial processes, IT systems, and service improvement. All are required to meet strict confidentiality, data protection, and information security standards under UK GDPR, and we only share the minimum data necessary.

 

Category	Purpose	Examples
Clinical records and appointment systems	To store therapy notes, manage appointments, and maintain secure records	Tacklit, WriteUpp, Microsoft, Heidi Health, RingCentral
AI-assisted note-taking	To transcribe sessions / calls and draft clinical notes and letters for clinician review	Heidi Health, Ring Central
Video, telephone and communication platforms	To hold online and telephone sessions (including recording telephone sessions for training and monitoring), and send appointment confirmations and reminders, reports, and secure correspondence	RingCentral, Microsoft Teams, Zoom, WriteUpp (appointment emails and texts), Outlook (Microsoft), Mailchimp (newsletters)
Financial administration	To manage invoicing, accounting, and financial reporting	Sage, Xero, Nineteen Accountants Ltd, Johnsons Bookkeeping, Claude, CoPilot
Supervision and clinical governance support	To ensure safe and ethical practice with appropriate oversight	Accredited supervisors (internal or external), all bound by confidentiality and professional standards
Referrers, funders and care professionals	To coordinate care, manage funding, or inform support plans	GPs, schools, local authorities, case managers, insurance providers
IT, marketing, website and data security support	To maintain our systems, devices and digital security	Always Networks (IT provider), external web support, Rebeccah Platts (Marketing Support)
Administrative and clinical operations support	To assist with referral processing, record-keeping, and compliance monitoring	PsychVA Ltd

 

International Transfers

We keep your data in the UK wherever possible; our AI scribe data, for example, is hosted in the UK. Some providers (such as RingCentral, Zoom, Microsoft or Mailchimp) may process limited data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.

Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of any inaccurate or incomplete information
• Request deletion of your data (in some circumstances)
• Object to or restrict how we process your data (including for marketing purposes)
• Request data portability (transfer to another service provider)
• Withdraw consent at any time (where consent is relied upon)
• Ask for an AI scribe not to be used, or for a telephone call or online assessment not to be recorded, and withdraw consent to a recording by a student or assistant
• Complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

To exercise your rights or raise a concern, email support@serendipitypsychology.co.uk. We would appreciate the chance to address any concerns before you contact the ICO.

Cookies and Website Analytics

We use cookies and analytics tools on our website to improve functionality and the user experience. You can manage your cookie settings in your browser at any time.

Communicating with Clients

Serendipity Psychology Services Ltd may contact clients to:

• Provide information about new services, events, or workshops that may be of interest.
• Share updates about sessions, scheduling, or other related matters.

Appointment messages

Our practice management system, WriteUpp, sends automated appointment confirmations and reminders by email and text message to the contact details you give us. If you would prefer us not to use a particular phone number or email address, for example because it is shared with someone else, please let us know.

Marketing and Service Updates

As a client, you will receive our newsletters and updates about our own services, workshops and events by email or text message, unless you tell us you do not want them. We send these on the basis of our legitimate interest in keeping clients informed about services similar to those they have used with us. We never share your details with other organisations for their marketing.

You can opt out at any time, at no cost, by:

• ticking the opt-out box on your referral or registration form
• email ‘OPT OUT OF MARKETING’ to support@serendipitypsychology.co.uk

Opting out of newsletters will not affect your care, and you will still receive messages about your appointments and treatment.

Updates to This Notice

We may update this Privacy Notice to reflect changes in our practice, providers, or legal requirements. The most up-to-date version will always be available on our website.