Please read this Privacy Policy carefully. It explains who we are, how we collect, use, store and share your personal data, your rights, and how to contact us or the relevant authority if you have concerns.

WHO WE ARE

We are Care at Your Home: Psychological Services Limited (trading as CAYH: Psychological Services), a private psychological therapy practice based in High Wycombe, Buckinghamshire. Company registration number: 16007169.

As a data controller, we are responsible for how we process your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (DPA) 2018.

We are registered with the Information Commissioner's Office. ICO registration number: ZB792066.

Our data protection contact is Sayra Raja, Clinical Director, and can be contacted using the details at the bottom of this policy.

All data processing activities are carried out in accordance with the seven data protection principles. We ensure that personal data is:

Processed lawfully, fairly and in a transparent way
Collected only for specified, explicit and legitimate purposes (purpose limitation)
Adequate, relevant and limited to what is necessary (data minimisation)
Accurate and kept up to date
Retained only for as long as necessary (storage limitation)
Processed securely, protecting against unauthorised access, loss or damage (integrity and confidentiality)
Handled in a way that demonstrates compliance with the above (accountability)

INFORMATION WE COLLECT

We define personal data as any information that identifies you or could make you identifiable. We process two categories of data:

Personal Data
This includes your name, address, email address, contact details, and financial information relevant to the services we provide.

Special Category Data
This includes sensitive information relating to your mental and physical health, clinical history, and current or planned treatment. Mental health information qualifies as special category data under UK GDPR Article 9.

Providing your personal data is necessary for us to deliver therapy services to you. Without certain information we may not be able to offer or continue treatment.

HOW WE COLLECT YOUR INFORMATION

We gather information through:

Enquiries made via our website, phone, email, or in person
Written correspondence by email or post
Online contact and booking forms
Live chat conversations via our website - these interactions are retained for a maximum of 12 months
Audio recordings of incoming and outgoing calls to our landline - please be aware that calls may be recorded. Recordings are used for business record-keeping, dispute resolution, service quality monitoring and staff training, and are retained for a maximum of 12 months
Device identifiers and browsing data such as IP addresses, pages visited, device type and software - collected for statistical and analytical purposes to improve your experience
Third-party data processors contracted to support our services, including IT support, payment systems, software platforms, and record archiving

Please note that our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

WHY WE COLLECT AND USE YOUR INFORMATION

We process your personal data under the following legal bases:

For general personal data (UK GDPR Article 6):
Consent: where you have given explicit consent for a specific purpose
Contractual obligation: to fulfil our agreement to provide you with therapy services
Legal compliance: to meet our legal and regulatory obligations
Legitimate interests: including responding to enquiries, service development, and clinical governance

For special category health data (UK GDPR Article 9(2)(h):
We process health and mental health data as necessary for the purposes of preventive medicine, medical diagnosis, and the provision of psychological health care and treatment.

WHO WE SHARE YOUR INFORMATION WITH

We may share your personal data, where appropriate and necessary, with:

Other health and social care professionals involved in your care, with your knowledge and consent where required
Law enforcement authorities, where required by law or court order
Regulatory and safeguarding bodies, including Local Safeguarding Adults Boards, where required
Third-party data processors contracted to support our services
CAYH staff involved in delivering or overseeing your care

Some of our contracted service providers may process data outside the UK. Where this occurs, appropriate safeguards are in place in accordance with UK GDPR requirements.

We will never sell or share your personal data for commercial purposes without your explicit consent.

HOW LONG WE KEEP YOUR DATA

We retain clinical records for a minimum of 7 years from the end of treatment for adults, in line with professional and regulatory guidance. Where records relate to a client who was a minor at the time of treatment, records are retained until the person's 25th birthday, or for 8 years from the end of treatment, whichever is later.

Call recordings and live chat interactions are retained for a maximum of 12 months.

Non-clinical data such as general enquiry records is retained for no longer than 12 months unless there is a specific reason to retain it further.

KEEPING YOUR DATA SAFE

We have technical and organisational security measures in place to protect your personal data and limit access to authorised personnel only. We have procedures to detect and respond to suspected data breaches and will notify you and the relevant authorities where required by law.

YOUR RIGHTS

Under UK GDPR, you have the following rights:

The right to be informed about how your data is processed
The right to access the personal data we hold about you
The right to have inaccurate data corrected
The right to have your personal data deleted (in certain circumstances)
The right to restrict how we process your data
The right to data portability
The right to object to processing based on legitimate interests
The right to withdraw consent at any time, where processing is based on consent
Rights in relation to automated decision-making and profiling
The right to lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, please contact us using the details below.

For guidance on your rights, visit: www.ico.org.uk

HOW TO COMPLAIN

If you have concerns about how we handle your data, please contact us in the first instance. If you remain unsatisfied, you have the right to complain directly to the ICO:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

CONTACT US

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Email: hello@cayhpsychologicalservices.co.uk
Telephone: 01494 977397
Post: CAYH Psychological Services, The Royal British Legion, High Wycombe, HP13 7DE

CHANGES TO THIS POLICY

This Privacy Policy may be updated periodically to reflect changes in our practices or applicable law. The date at the top of this page indicates when it was last r