Privacy Notice

About this notice

This notice explains how I collect, use and look after your personal information, from the first time you get in touch through to after our work together has ended. It covers my psychology and coaching services and my websites.

I am the data controller for the information I hold about you, which means I am responsible for deciding how it is used and for keeping it safe. I am registered with the Information Commissioner’s Office (registration number ZB410315), and I follow UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this notice or how your information is handled, you are very welcome to get in touch at hello@andyblyth.co.uk.

What information I collect

Depending on how we are in contact, I may hold:

• Contact details, such as your name, email address, phone number and address.
• Information you share about why you are getting in touch and what you are hoping for.
• Information from someone who has referred you, such as a coach, clinician, GP or employer.
• Notes from our sessions, which may include information about your health, wellbeing, injury or pain.
• Any questionnaires or feedback forms you choose to complete.
• Payment and invoicing details, and, if your sessions are funded by insurance, your insurer’s authorisation details.
• Records of any consent you have given, for example to share updates with a referrer or to record a session.

Information about your health is known as special category data, and the law requires extra care in how it is handled. I only collect what is needed for our work together.

Where your information comes from

Most of the information I hold comes directly from you. Sometimes it comes from others, for example:

• A coach, gym, physiotherapist, clinician, GP or employer making a referral, normally with your knowledge and agreement.
• A private medical insurer, when it authorises sessions on your behalf.
• A parent or guardian, if you are under 18.
• An online directory or the contact form on my website, when you send an enquiry.

Why I use your information, and my lawful basis

The law requires me to have a lawful basis for using your personal information. The bases I rely on are:

• Contract. When you enquire about working with me, and while we are working together, I use your information to provide the service you have asked for.
• Legal obligation. I keep certain records, such as financial records, because the law requires it.
• Legitimate interests. After our work has ended, I keep records so that I can meet my professional obligations, respond to any questions or concerns, and deal with any complaint.
• Consent. For things that are optional, such as sharing updates with someone who referred you or recording a session for supervision, I will only do this with your agreement, and you can withdraw that agreement at any time.

For health information, I rely on the condition that it is needed for the provision of health care by a professional who is bound by a duty of confidentiality (UK GDPR Article 9(2)(h) and Schedule 1 of the Data Protection Act 2018). Where I share health information with a referrer, I will do so with your explicit consent. I may also use information where it is needed to establish or defend a legal claim.

Confidentiality

What we talk about is confidential. There are a small number of situations where I may need to share information without your agreement:

• Where there is a serious and immediate risk of harm to you or someone else.
• Where there are safeguarding concerns, including concerns about abuse.
• Where the law requires it, for example a court order.

Wherever possible, I will talk with you first before sharing anything.

Who I may share your information with

I do not sell your information or use it for marketing. I may share it in the following ways:

• Clinical supervision. As part of good professional practice, I discuss my work with a qualified supervisor. I do not share anything that would identify you unless you have consented our work to be recorded.
• People who referred you. If you were referred by a coach, clinician or similar, and you agree, I may share a brief update with them, usually after our first session and at a review. This covers whether we are working together and the general direction of the work, not the detail of what we discuss. You can change your mind about this at any time.
• Insurers. If your sessions are funded by private medical insurance, your insurer will need attendance dates and brief reports on the focus of the work, progress, and whether further sessions are recommended. This is a condition of insurance funding. I will tell you what I am sending, and you are welcome to see it. If you would prefer nothing to be shared, self-funding is always an option.
• Where required. With emergency services, your GP or other agencies in the situations described under Confidentiality.
• Service providers. I use a small number of trusted providers to run my practice, described below. They act on my instructions and may only use your information for the service they provide to me.

Service providers I use

• Microsoft 365, for email, calendar, secure storage of client records and session notes, and for online sessions through Microsoft Teams.
• reMarkable, a digital notebook I use to take notes during sessions. Notes are kept on the device, which is encrypted and password protected, and are synced to reMarkable’s secure cloud service so that I can access them through the reMarkable app. They are not shared with anyone else.
• My bank, for processing payments by bank transfer.
• Netlify, which hosts my websites and processes enquiries sent through the contact form.

Online sessions

Online sessions take place through Microsoft Teams. Microsoft processes data in line with its own privacy policy. I do not record sessions unless you have given written consent beforehand.

How I keep your information secure

I take the security of your information seriously. My Microsoft 365 account is protected by a strong password and two-factor authentication, and I do not download client records to my laptop. Any device I use to access email or notes is protected by a passcode only I know.

Notes taken during sessions on my reMarkable tablet stay on an encrypted, password-protected device, and are labelled with your client ID rather than your name.

Each client is given a unique ID when we start working together. Session notes and other documents are labelled with this ID rather than your name, and the link between names and IDs is kept in a separate secure file.

Transfers outside the UK

Some of my service providers may store or process data outside the UK. Where this happens, I rely on UK adequacy regulations or other safeguards recognised under UK data protection law, so that your information receives an equivalent level of protection.

Automated decisions

I do not use automated decision-making or profiling.

How long I keep your information

• If you get in touch but decide not to go ahead, I will delete your information within 30 days, or sooner if you ask.
• Client records, including session notes held in Microsoft 365 and on my reMarkable tablet, are kept for 7 years after our last contact and then securely destroyed. For young people, records are kept for 7 years or until they turn 25, whichever is later.
• Financial records are kept for as long as required for tax purposes.
• Emails that are not needed for your record are deleted when they are no longer needed. Important correspondence is kept with your record.
• Session recordings, if any, are deleted after 7 years, or sooner if you ask.

Young people

If you are under 18, you have the same rights to confidentiality and over your information as an adult. In Scotland, young people aged 12 or over are generally presumed able to exercise their own data protection rights. I will only involve a parent or guardian with your agreement, except where there is a safeguarding concern, and we will talk together about what is shared.

Your rights

You have the right to:

• Ask for a copy of the information I hold about you.
• Ask me to correct anything that is inaccurate or incomplete.
• Ask me to delete your information. There may be times I need to keep some records for professional or legal reasons, and if so I will explain why.
• Ask me to limit how I use your information, or object to me using it in some circumstances.
• Withdraw any consent you have given, at any time.

To make a request, email hello@andyblyth.co.uk. There is no charge, and I will respond within one month. You can read more about your rights at ico.org.uk/your-data-matters.

Visitors to my websites

My websites are hosted by Netlify. If you send an enquiry through a contact form, your details are processed by Netlify and passed to me, and I then keep them in Microsoft 365.

Netlify collects basic information about visits to the site, such as pages viewed and IP addresses, from its server logs and by measuring how quickly pages load, which helps me understand how the site is used. Netlify may also use cookies needed for the site to work. For more about how Netlify handles data and cookies, please see Netlify’s privacy policy at netlify.com/privacy and its cookie policy at netlify.com/legal/netlify-cookie-policy.

The contact form on my websites uses Google reCAPTCHA to help keep out spam. When a page with the form loads, reCAPTCHA may collect information about your device and browser, including your IP address, and send it to Google. It may also set cookies or similar technologies. Google may process this information outside the UK, including in the United States, and you can read more in Google’s privacy policy at policies.google.com/privacy and its terms at policies.google.com/terms.

My websites also load the Inter typeface from Google Fonts, which means Google receives your IP address and browser details when a page loads.

I use legitimate interests as my lawful basis for all of this, to keep my websites working, secure and free of spam, and I do not use this information to identify individual visitors.

Some pages include videos hosted on YouTube, which is owned by Google. These are embedded using YouTube’s privacy-enhanced mode, so YouTube should not set cookies or collect information about you simply because you visit the page. If you choose to play a video, YouTube may set cookies and collect information about your viewing, including your IP address, and this is handled by Google under its own privacy policy at policies.google.com/privacy. If you would rather avoid this, the written version of each piece is always available on the same page.

If you choose Accept on the cookie banner, I use Google Analytics to see which pages are read and how people find the site, so I can improve it. This sets cookies (named _ga and _ga_ followed by a code) for up to six months and sends information about your visit to Google, including your IP address and details of your browser and device. Google may process this outside the UK, including in the United States, under its own privacy policy at policies.google.com/privacy. I have turned off Google’s advertising features. Google Analytics only runs if you accept. If you choose Reject, or ignore the banner, it does not run. You can change your mind at any time using Cookie settings in the footer of every page. My lawful basis for this is your consent.

Concerns and complaints

If you have any concerns about how your information is handled, please speak to me first at hello@andyblyth.co.uk, as most things can be sorted out through conversation. If you remain unhappy, you can contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

I review this notice regularly and will update it if anything changes in how I work. The date at the top shows when it was last updated.