Psychologist

Privacy Notice

This privacy notice explains how Dr Erin Carroll collects, uses, stores and protects your personal information. It has been written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and updated to reflect the requirements of the Data (Use and Access) Act 2025.

Who is the Data Controller?

Dr Erin Carroll is the data controller for personal information collected through this website and in the course of providing psychological services. Dr Carroll is registered with the Information Commissioner’s Office (ICO) as a data controller under registration number [ICO Reg No ZB788889].

You can contact Dr Carroll at: erin@erincarrollpsychologist.co.uk

What Personal Data We Collect

Contact and Identity Information

• Name, address, email address, telephone number
• Video conference ID (if online therapy)
• Next of kin name and contact details
• GP contact details
• If referred by a health insurance or Employee Assistance Programme (EAP) provider: referral information, health insurance policy number, and authorisation for psychological treatment

Clinical Information (Special Category Data)

• Therapy records including session notes, letters, reports, and outcome measures

This information is classed as “special category data” under UK GDPR due to its sensitivity. It is handled with the highest standards of care and professional confidentiality.

Website and Technical Data

• If you complete a web-based enquiry form, we collect any information you provide along with your IP address, which is automatically supplied by the website software
• Technical data collected via cookies: IP address, browser type, and pages visited

Lawful Basis for Processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Legitimate Interests: To respond to enquiries and manage the provision of psychological services
• Contract: Where processing is necessary to arrange and deliver your therapy sessions
• Legal Obligation: Where we are required to process or retain data by law, court order, or professional regulatory requirement
• Consent: Where you have given clear consent to a specific use of your data

For special category clinical data, we additionally rely on Article 9(2)(h) of the UK GDPR, which permits processing that is necessary for the provision of health care or treatment, carried out by a health professional subject to professional confidentiality obligations.

How We Use Your Personal Information

• To provide psychological therapy and assessment services
• To arrange and manage appointments
• To process payment for services
• To communicate with you about your care
• To comply with our legal and professional obligations to the British Psychological Society (BPS) and the Health and Care Professions Council (HCPC)

We will only use your personal data for the purposes for which it was collected. If you do not provide the personal information requested, we may be unable to provide a service to you.

How We Share Your Information

We hold information about each client and the therapy they receive in confidence. We will not normally share your personal information with anyone else. However, limited sharing may be necessary in the following circumstances:

• Insurance and EAP referrals: If you are referred by an EAP or health insurance provider, or are funding therapy through a health insurance policy, we may share appointment schedules for billing purposes and relevant clinical information to assist other healthcare providers involved in your treatment, where appropriate.
• Other healthcare providers: We may share relevant clinical information with your GP, psychiatrist, or other health professionals on a need-to-know basis. No information will be passed to another provider without being discussed with you first.
• Legal proceedings: If your treatment has been instructed by a solicitor, relevant clinical information may be shared with legal services as required and with your written consent.
• Legal or safeguarding duty: We may share information without your consent where required by a court order, where disclosure is in the public interest or to prevent a miscarriage of justice, or where there is a risk of harm to you or another person. We will discuss any proposed disclosure with you unless doing so could increase the level of risk to you or someone else.

We will never share your personal information with third parties for marketing purposes.

How We Store and Secure Your Data

• Personal information is minimised in phone and email communication
• Sensitive personal data sent to clients is password protected
• We use Transport Layer Security (TLS) to encrypt and protect email traffic. Please note that if your email service does not support TLS, emails sent or received may not be protected in transit
• We monitor emails for viruses and malicious software
• Office computers are password protected with malware and antivirus software installed
• Mobile devices are protected with a passcode or biometric security
• We never use open or insecure Wi-Fi networks to send personal data

How Long We Keep Your Data

• Basic contact information held on a mobile phone is deleted at the end of therapy
• Clinical records (therapy notes, reports, outcome measures) are retained for 7 years after the end of therapy, in accordance with the record-keeping guidance of the British Psychological Society and the HCPC. After this period, records are securely deleted at the end of each calendar year
• Enquiry data from people who do not become clients is deleted as soon as it is no longer needed

Website Visitors and Cookies

When you visit this website, non-identifiable technical information may be collected automatically, including your IP address, browser type, and pages visited. Cookies are small text files placed on your device when you visit a website. A cookie consent banner will appear when you visit this site, giving you clear notice and a choice to accept or decline non-essential cookies. You can also manage or delete cookies through your browser settings at any time.

If you are concerned about anyone knowing you have visited this site, you can erase your browser history and cookies after your visit. We are not liable for any technical issues this may cause to your device.

Your Rights over Your Personal Information

Under UK data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you, free of charge, provided within one month of your request
• Rectification: Ask us to correct inaccurate or incomplete information
• Erasure: Request deletion of your data. Please note this right does not apply to clinical therapy records, which we are professionally and legally required to retain for 7 years in accordance with BPS and HCPC guidelines
• Restriction: Ask us to limit how we process your data in certain circumstances
• Data Portability: Receive your data in a portable format
• Object: Object to certain types of processing
• Withdraw Consent: Where consent is the basis for processing, you may withdraw it at any time

To exercise any of these rights, please contact Dr Carroll at erin@erincarrollpsychologist.co.uk.

Data Protection Concerns and Complaints

If you have a concern or are unhappy with how your personal information has been handled, you have the right to raise a complaint directly with Dr Carroll first.

Please email erin@erincarrollpsychologist.co.uk with your name, the nature of your concern, and what you would like looked into. Dr Carroll will:

1. Acknowledge your complaint within 30 days of receipt.
2. Investigate your concern and communicate the outcome to you without undue delay.

If you remain unsatisfied with the response, you can escalate your complaint to the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113

Changes to This Notice

This notice may be updated from time to time to reflect changes in law or practice. Any changes will be posted on this page with an updated review date.

Last updated: 19 June 2026