Privacy policy

Last updated: 17 September 2026. This notice explains how The Phoenix Psychology Practice (“we”, “us”) collects and uses personal information when you use this website, book or receive our services, or use the student apps and resources.

Who we are

The Phoenix Psychology Practice provides neurodiversity screening, diagnostic and clinical assessment, coaching, counselling and related services to individuals, families, schools, colleges, universities and employers, in person in Somerset and online across the UK. We are the data controller for the information described here and are registered with the Information Commissioner’s Office (ICO), registration reference C1370064. You can contact us about anything in this notice through the contact form.

What we collect

When you enquire or create an account

Your name, email address, phone number (if given), whether the enquiry is for yourself, your child or an organisation, the service you are interested in, your availability and anything you choose to tell us in the message box. For organisations we also record the organisation’s name and your role.

When you become a client

Information needed to carry out an assessment or provide support. This can include date of birth, educational or employment history, developmental and family history, questionnaires and test results, and clinical notes and reports. Much of this is special category data (information about health, including neurodevelopmental conditions) and is protected by additional safeguards in law.

When you use the student apps and resources

Your login email, which resources you have access to, and basic usage needed to keep the service working and secure. The apps themselves do not ask you for clinical information.

Automatically

Standard technical information such as IP address, browser type and pages visited, used only to keep the site secure and working. We use a human-verification check on sign-up forms to block automated abuse. We do not use advertising cookies.

Why we use it and our lawful basis

• Responding to your enquiry and providing our services — necessary to take steps at your request and to perform our contract with you or your organisation (UK GDPR Article 6(1)(b)).
• Health information collected during assessment and support — processed for the provision of health care and psychological assessment by, or under the responsibility of, a professional bound by a duty of confidentiality (Article 9(2)(h)), and, where we ask for it, with your explicit consent (Article 9(2)(a)). You may withdraw consent at any time, although this may mean we cannot complete an assessment.
• Keeping records, invoicing and meeting our professional and legal obligations — legal obligation and legitimate interests (Article 6(1)(c) and (f)).
• Keeping the website secure and preventing abuse — legitimate interests (Article 6(1)(f)).
• Newsletters or updates — only if you opt in, and you can unsubscribe at any time.

Children and young people

Where the service is for a child or young person, we collect information from the parent, guardian or referring organisation and, where appropriate, from the young person themselves. We explain what we are doing in a way they can understand and involve them in decisions about their information as far as their age and understanding allow.

Organisations (schools, colleges, universities, employers)

If your assessment or support is arranged and funded by an organisation, we share with that organisation only what is needed to administer the arrangement — typically confirmation of attendance, invoicing details and, with your knowledge, the report or recommendations that the arrangement covers. We do not share your clinical notes with your organisation.

Who we share information with

We do not sell personal information. We share it only with: professionals involved in your care where you have agreed (for example your GP for a referral); organisations funding your assessment, as described above; and the service providers who run our systems under contract with us — our website and email hosting in the UK/EU, our secure practice management and booking system, and our payment providers when you pay by card. Each of these acts on our instructions and is bound by confidentiality and data-protection obligations. We may disclose information where the law requires it, or where necessary to protect someone from serious harm.

How we keep it safe

Client documents uploaded through this site are stored encrypted, in locations that are not publicly accessible, with access limited to the practice. Connections to the site are encrypted (HTTPS), administrator accounts use two-factor authentication, and we keep off-site backups. Clinical records are held in our practice management system, not on this website.

How long we keep it

Clinical records are kept in line with professional guidance for psychologists — generally for a minimum of 7 years after our last contact with you, or, for children, until the child’s 25th birthday (26th if they were 17 when the work ended), whichever is later. Enquiry details that do not become a client record are deleted after 12 months. Accounts on the student resources that have not been used for 24 months are removed. Financial records are kept for 6 years as required by HMRC.

Your rights

You have the right to ask for a copy of the information we hold about you, to have inaccurate information corrected, to ask us to delete information or restrict how we use it, to object to processing based on legitimate interests, and to data portability where processing is based on consent or contract. Some rights are limited where we must keep records to meet professional or legal obligations; we will always explain why. To exercise any of these rights, contact us through the contact form. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), although we would appreciate the chance to resolve any concern first.

How long we keep your information

We keep your account, appointment and invoice records for five years after your last activity with the practice, after which the account is retired. Assessment reports are kept for longer, in line with professional record-keeping requirements. Everything is stored encrypted, and you can ask us about your records at any time.

Changes to this notice

We will update this page when our practices change and show the date at the top.