Book Your Session

Privacy Policy

North East Psychology Privacy Notice

Last updated: August 2026

1. Who I am

Dr Sarah Woods / NEpsychology
Email: hello@nepsychology.co.uk
Website: www.nepsychology.co.uk

I am the data controller for the personal information I process in connection with my psychological therapy, assessment and expert witness services, unless I explain otherwise.

This privacy notice tells you what to expect us to do with your personal information.

I aim to be clear and transparent about how and why I use personal information.

This notice applies to people who:

  • contact me about psychological services;
  • receive psychological therapy from me;
  • are referred to me by a case manager, another professional or another organisation;
  • are assessed by me in my capacity as an independent expert witness; or
  • otherwise communicate with me in relation to my professional services.

2. The information I collect

Depending on the service I provide, I may collect and process:

  • your name;
  • date of birth;
  • contact details, including postal address, telephone number and email address;
  • Pronoun preferences;
  • details of your GP and other healthcare professionals;
  • Next of Kin details including any support networks
  • emergency contact details
  • insurance policy details
  • information about your physical and psychological health;
  • information about your psychological history and current circumstances;
  • information provided during psychological assessments or therapy;
  • clinical or assessment notes;
  • call recordings
  • test results (including psychological evaluations)’
  • information contained in reports, medical records and other documents provided to me;
  • information about appointments, cancellations and communications;
  • payment and invoicing information; and
  • information relevant to legal proceedings where I am instructed as an expert witness.

In some circumstances, I may also process information about other people where this is relevant and necessary to the service I am providing.

Health and sex life information is classed as special category personal data and receives additional protection under data-protection law.

I will seek to collect and retain only information that is relevant and necessary for the purpose for which it is being processed.

3. How I obtain personal information

I may obtain personal information:

  • directly from you;
  • from a case manager or other professional who refers you;
  • from another healthcare professional or organisation;
  • from your solicitor or other legal representative;
  • from medical or psychological records;
  • from other documents supplied for the purpose of an assessment;
  • from other professionals involved in your care or legal proceedings, where appropriate; or
  • from communications with you.

Where I receive information about you from another person or organisation, I will provide you with appropriate privacy information in accordance with applicable data-protection requirements.

4. How I use your information

Psychological assessment and therapy

Where I provide psychological therapy, I may use your information to:

  • communicate with you;
  • assess your needs and provide psychological services;
  • maintain appropriate clinical records;
  • communicate with other professionals where this is necessary and lawful;
  • arrange and manage appointments;
  • provide appointment reminders and relevant links;
  • process payments and maintain financial records; and
  • meet my professional, legal and regulatory obligations.

Case-manager referrals for psychological therapy and assessment

Where you are referred by a case manager or another organisation, I may process information provided by the referring organisation and information obtained during my work with you.

I may communicate with the referring organisation where this is necessary for the service being provided and in accordance with the arrangements governing your referral.

Expert witness work

When I am instructed as an independent expert witness, I may process personal information for the purposes of:

  • considering instructions;
  • reviewing documents and records provided to me;
  • undertaking psychological assessments;
  • obtaining relevant information from the person being assessed;
  • preparing independent expert opinions and reports;
  • communicating with the instructing solicitor or other instructing party;
  • complying with my duties as an expert;
  • responding to appropriate requests for clarification;
  • attending conferences, hearings or court/tribunal proceedings where required; and
  • complying with legal and professional obligations.

My role as an independent expert witness is different from my role as a treating psychologist. An expert witness is required to provide an independent opinion based on the evidence available, rather than to act as an advocate or treating professional for either party.

Information contained in an expert report may be disclosed as required or permitted in connection with the relevant legal proceedings.

5. Lawful basis for processing your information

I will only process personal information where I have a lawful basis for doing so. Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Depending on the circumstances, the lawful basis for collecting or using personal information to provide patient care may also include:

  • Contract – where processing is necessary to provide services you have requested or to take steps at your request before entering into a contract;
  • Legitimate interests – where processing is necessary for my legitimate professional or business interests and those interests are not overridden by your rights and interests;
  • Legal obligation – where I need to process information to comply with a legal obligation;
  • Consent – where I specifically rely on your consent for a particular processing activity; and
  • Legal claims – where processing is necessary in connection with the establishment, exercise or defence of legal claims, where applicable.

The lawful basis will depend on the particular circumstances and purpose for which your information is being processed.

Where I process special category information, such as health information, I will also rely on an appropriate condition for processing special category data under applicable data-protection law. Special category data requires additional protection and both a general lawful basis and an appropriate special-category condition are required.

Where I rely on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. It may also not be possible to stop processing where another lawful basis applies or where I have a legal or professional obligation to retain or process the information.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes suicide risk, risk to others or an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

6. Expert witness assessments and legal proceedings

If I am instructed as an expert witness, the information I process may have been provided to me by a solicitor, legal representative, healthcare professional or another source rather than directly by you.

I may therefore process information that forms part of the evidence or documentation relevant to the case.

I may share relevant information and my expert report with the parties or professionals who are entitled to receive it as part of the legal proceedings. This may include, depending on the circumstances:

  • the instructing solicitor or organisation;
  • legal representatives;
  • counsel;
  • the court or tribunal;
  • other parties to the proceedings where disclosure is appropriate or required;
  • other experts or professionals where necessary and lawful; and
  • other persons or organisations where disclosure is required by law or by the relevant proceedings.

I will not use information obtained for an expert assessment for unrelated purposes unless there is a lawful basis for doing so.

7. Confidentiality

Information provided to me in the course of therapy or assessment will normally be treated as confidential. However, confidentiality is not absolute and there may be circumstances in which information must or may lawfully be disclosed.

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:

  • you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
  • we have a legal requirement (including court orders) to collect, share or use the data;
  • on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
  • If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or
  • If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.

In expert witness work, the nature of the role means that relevant information and the resulting expert report may need to be disclosed as part of the legal proceedings. This will be explained to you as part of the assessment process.

8. How I store and protect your information

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, alteration or disclosure.

Electronic records

My computers and other devices used for professional purposes are password protected and encrypted where technically available. I use appropriate security measures for electronic records and communications.

Where sensitive information is sent electronically, I use appropriate security measures, including password protection or other secure methods where appropriate.

Paper records

Where paper records are held, they are stored securely and access is restricted.

I will keep information only for as long as it is necessary for the relevant purpose, taking account of legal, professional, regulatory and financial requirements.

9. Retention of information

I retain different types of information for different periods depending on the purpose for which it was collected and my legal and professional obligations.

For example:

  • information relating to enquiries where you do not become a client will normally be retained for a limited period and then securely deleted;
  • therapy records will be retained in accordance with applicable professional, legal and regulatory requirements;
  • expert witness records will be retained for an appropriate period having regard to the nature of the legal proceedings, potential appeals or further proceedings, professional requirements and legal obligations; and
  • financial and invoicing records will be retained for the period required by HMRC and other applicable financial requirements.

At the end of the applicable retention period, information will be securely deleted or destroyed unless there is a lawful reason to retain it for longer.

10. Sharing your information

I will only share your personal information where there is a lawful basis to do so.

Depending on the service I provide, this may include sharing information with:

  • services providing secretarial support;
  • your GP or another healthcare professional;
  • a case manager or referring organisation;
  • your solicitor or other legal representative;
  • other parties involved in legal proceedings where disclosure is appropriate or required;
  • courts or tribunals;
  • other professionals or experts where necessary and lawful;
  • organisations that provide services to me, such as IT, secure storage, accounting or administrative services, where they need access to information to provide those services; and
  • public authorities or other organisations where I am legally required or permitted to disclose information.
  • Organisations we’re legally obliged to share personal information with
  • Debt collection agencies

Where another organisation processes information on my behalf, I will take appropriate steps to ensure that suitable data-protection and confidentiality arrangements are in place.

11. Communication by email and electronic means

I may communicate with you by email, telephone or other electronic means where appropriate.

This may include:

  • appointment information;
  • appointment reminders;
  • video consultation links;
  • information relating to your assessment or therapy;
  • correspondence with you about your care or assessment; and
  • other relevant professional communications.

I take reasonable steps to protect information sent electronically. Where particularly sensitive information is transmitted electronically, appropriate security measures will be used.

13. Cookies and website information

My website may use cookies or similar technologies.

Some cookies may be necessary for the operation and security of the website. Other cookies may be used to understand how the website is used or to improve its functionality.

Where required by law, appropriate information or consent mechanisms will be provided for cookies that are not strictly necessary.

You can also manage or delete cookies through your browser settings.

14. Data breaches

I take reasonable steps to prevent personal data breaches. If a breach occurs, I will assess it and take appropriate action in accordance with applicable data-protection law, including notifying the Information Commissioner’s Office or affected individuals where this is legally required.

15. Changes to this Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in my services, technology, legal requirements or data-protection practices.

The current version will be available on my website and will show the date it was last updated.

How to complain or exercise your rights

If you have any concerns about our use of your personal information, you can make a data protection complaint to us, you can also use thiss address to exercise your rights:

Email: hello@nepsychology.co.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

17. Further information

If you have any questions about this Privacy Notice or how I process your personal information, please contact me at:

hello@nepsychology.co.uk

This Privacy Notice is intended to explain my general approach to the processing of personal information. The precise information I process, the lawful basis relied upon and the people with whom information is shared will depend on the nature of the service I am providing and the circumstances of the individual case.