Last updated: 17/09/2026
I, Dr Kristy Potter, am committed to keeping any personal data you share with me safe and secure. I will not share your information with anyone unless I have a professional or legal reason to do so, or you have asked me to do so.
This Privacy Notice explains how I collect, use, store, share and protect your personal data in the course of providing psychological services, training, consultancy, online programmes, digital resources and other services through Dr Potter Psychology.
Dr Potter Psychology is now based in the United Kingdom. I provide services online and may work with people located in the UK and internationally, including existing clients in Guernsey, Bermuda and elsewhere.
Introduction
I am responsible for protecting your privacy and any personal information you share with me.
For data protection purposes, I, Dr Kristy Potter trading as Dr Potter Psychology, am the “data controller”. This means I am responsible for deciding how and why your information is used, how it is protected, how long it is kept and who, if anyone, it may be shared with.
As Dr Potter Psychology is based in the UK, I process personal data primarily in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.
The Privacy and Electronic Communications Regulations 2003 (PECR) also apply to some activities, including electronic marketing and the use of cookies and similar technologies.
Depending on where you are located, other applicable data protection requirements may also apply.
“Personal data” means information relating to an identified or identifiable person. This may include information about your therapy, communications with me, purchases, use of online programmes, training or consultancy, and your use of my website.
“Processing” your data includes activities such as collecting, recording, organising, using, sharing, storing and deleting it.
The law requires me:
• To process your data lawfully, fairly and transparently;
• To collect your data only for specified and legitimate purposes;
• To collect only information that is relevant and necessary;
• To take reasonable steps to ensure that information is accurate and up to date;
• To keep information only for as long as reasonably necessary; and
• To use appropriate security measures to protect your information.
I may update this Privacy Notice from time to time to reflect changes in my services, systems, professional requirements or the law.
Conditions for processing your data
Data protection law sets out a number of lawful reasons for collecting and processing personal data.
Different lawful bases may apply depending on why I am using your information.
Contractual obligations
When we begin working together, I may ask you to agree to terms relating to the service I provide.
Processing certain personal information is necessary for me to provide services under that agreement or to take steps at your request before entering into an agreement.
For example, this may include responding to an enquiry, arranging appointments, providing psychological services, delivering training or consultancy, giving you access to an online programme or digital resource, and managing payments.
Legitimate interests
In certain circumstances, I may process your information where this is necessary for my legitimate interests in operating a safe, effective and professionally accountable psychology practice, provided that those interests are not overridden by your rights and interests.
This may include practice administration, maintaining appropriate records, responding to enquiries, maintaining the security of my systems, managing and improving services, meeting professional or insurance requirements, and establishing, exercising or defending legal claims.
Where I rely on legitimate interests, I consider whether the processing is necessary and whether your rights and interests outweigh my legitimate interests.
Legal obligations
I may process personal information where this is necessary to meet a legal, regulatory, tax or other obligation that applies to me.
Information may sometimes need to be disclosed where I am legally required to do so, for example in response to a valid court order or another binding legal requirement.
Vital interests
In exceptional circumstances, I may process or share personal information where this is necessary to protect your life or the life of another person.
For example, if I reasonably believe that there is a serious and immediate risk of harm to you or another person, it may be necessary to contact your GP, emergency services or another appropriate service.
I will only disclose information that is relevant and necessary in the circumstances and, where appropriate and safe to do so, I will tell you about the disclosure.
Consent
There are some circumstances in which I may ask for your consent.
For example, I may ask for your consent before sharing information with another professional where consent is the appropriate basis for doing so.
Where I rely on your consent as the lawful basis for processing personal data, you can withdraw that consent at any time. This does not affect processing that was lawful before consent was withdrawn.
Consent to psychological treatment or agreement to the sharing of confidential clinical information is not necessarily the same as consent as a lawful basis under UK data protection law.
Special category data
When providing psychological assessment, consultation or therapy, I collect information about your psychological health and may also collect information about your physical health, medication, treatment, relationships, family circumstances, social circumstances, relevant history, risk or safeguarding concerns and other information relevant to our work.
I may also collect information when you complete questionnaires or psychological measures.
Some of this information is defined under data protection law as “special category data”. This includes health information and may, where relevant, include information about racial or ethnic origin, religious or philosophical beliefs, sexuality or sex life.
Special category data is given additional legal protection.
​
For the clinical psychology services I provide, I primarily process health and related special category information because this is necessary for the provision of health care or treatment under Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018.
​
I am a regulated health professional and am subject to professional duties of confidentiality.
​
Other special category conditions may apply in particular circumstances, for example where processing is necessary to protect vital interests, establish or defend legal claims, or where explicit consent is appropriate.
I aim to collect and process only the information that is relevant and necessary for the service I provide.
​
Clinical supervision
​
I discuss aspects of my clinical work in professional supervision with an appropriately qualified psychologist or psychotherapist.
​
Supervision is an important part of maintaining safe and effective professional practice.
​
Information discussed in supervision is limited to what is necessary and, where reasonably possible, identifying information is removed or minimised.
​
My supervisor is also subject to professional and confidentiality obligations.
​
Sharing information with other professionals
​
I do not routinely share your clinical information with third parties.
​
Where appropriate, and normally after discussing this with you, I may communicate with a referrer, GP, psychiatrist, insurer or another professional involved in your care.
​
This might include requesting relevant information, discussing your referral, providing an agreed summary or report, or requesting authorisation for further sessions.
​
Where consent is the appropriate basis for a particular disclosure, I will obtain this before sharing the information.
​
There may be exceptional circumstances where information needs to be disclosed without your consent, including serious safeguarding or risk concerns or where I am legally required to disclose information.
​
I will only share information that is relevant and necessary in the circumstances.
​
How I might collect your data
​
I collect personal data in a number of ways that may include, but are not limited to:
​
• When you contact me by email, telephone, website form or another method;
• When you enquire about my services but do not subsequently engage;
• When you book or attend an appointment;
• During psychological assessment, consultation or therapy;
• When you complete questionnaires or forms;
• When another professional provides relevant information about you where there is an appropriate basis for them to do so;
• When you purchase or access online programmes, digital courses or downloadable materials;
• When you create an account to access members-only or digital content;
• When you participate in training, workshops or consultancy;
• When you subscribe to free resources, newsletters or programme updates;
• When you make a payment; and
• When you access or interact with my website.
The information I hold is primarily stored electronically.
​
For your security, I use appropriate organisational and technical security controls to safeguard your information. These may include strong passwords, multi-factor authentication, access controls, device security, secure cloud services and encryption where appropriate.
​
Use of data processors and service providers
​
I use carefully selected third-party services to support the operation of Dr Potter Psychology and the delivery of my services.
​
These include services used for:
• Clinical documentation and administration;
• Email and communication;
• Video consultations;
• Cloud file storage;
• AI-assisted clinical documentation;
• Accounting and invoicing;
• Website hosting and administration;
• Online programmes and digital resources;
• Payment processing; and
• Email communications and marketing.
​
Providers I currently use include Microsoft 365, Outlook and OneDrive, Zoom, Heidi, Xero and Wix, together with relevant payment providers and other professional services where required.
​
Depending on the particular service, these organisations may process information on my behalf or may act as independent data controllers for certain activities.
​
Where an organisation processes personal information on my behalf, I take reasonable steps to ensure appropriate contractual, security and data protection arrangements are in place.
​
Payment information for online purchases is processed securely by the relevant payment provider. I do not store full payment card details within my clinical records.
​
Use of Heidi for clinical documentation
​
I use Heidi, an AI-assisted clinical documentation service, to support aspects of clinical note-taking and record keeping.
​
Where I intend to use Heidi during clinical work, I will explain this to you and obtain any agreement or consent required for professional, ethical or confidentiality purposes.
​
Heidi may process information from a clinical session in order to assist with transcription and preparation of draft clinical documentation.
​
My use of Heidi does not change the underlying lawful basis on which I process your clinical information.
I remain professionally responsible for your clinical record. AI-generated documentation is subject to my professional judgement and review before it is retained as part of your record.
​
I do not use Heidi or another automated system to make solely automated clinical decisions about your treatment or care.
​
International clients and international processing
​
Dr Potter Psychology is based in the United Kingdom, although I provide online services to people in the UK and internationally.
​
The fact that you are physically located outside the UK does not, by itself, mean that I am transferring your personal information to an organisation in that country.
​
However, some of the technology and service providers I use operate internationally. Depending on the provider and service, personal information may therefore be stored, processed or accessed outside the UK.
​
Where personal information is transferred to a separate organisation outside the UK and the UK international transfer rules apply, I take reasonable steps to ensure an appropriate lawful transfer mechanism or safeguard is in place.
​
This may include UK adequacy regulations, an approved data protection framework, an International Data Transfer Agreement, the UK International Data Transfer Addendum to approved Standard Contractual Clauses, or another mechanism permitted under UK data protection law.
​
You can contact me if you would like further information about international processing or safeguards relevant to a particular service provider.
​
Personal data breaches
​
If a personal data breach occurs, I will assess the circumstances and take appropriate action in accordance with data protection law.
​
Where required, this may include notifying the Information Commissioner’s Office and informing affected individuals.
​
I maintain appropriate procedures for identifying, recording and responding to personal data breaches.
​
Online Programmes and Digital Content
​
In addition to providing psychological services, I offer educational online programmes, courses and digital resources.
​
When you purchase, register for or access digital content, I may collect and process:
• Your name;
• Email address;
• Billing and transaction information;
• Account login information; and
• Records relating to programme or resource access.
​
This information may be processed for purposes including:
• Providing access to purchased content;
• Administering your account;
• Managing payments;
• Providing relevant service communications;
• Maintaining transaction records; and
• Meeting contractual, accounting and legal obligations.
​
Participation in an online educational programme or use of a digital resource does not, by itself, constitute psychological therapy or create a clinical psychologist-client relationship.
​
Training and Consultancy
​
I also provide professional training, workshops, consultancy and related services.
​
Where you enquire about, book or participate in these services, I may process information such as your name, professional contact details, organisation, booking information, correspondence, attendance information, billing information and information you choose to provide in connection with the service.
​
I use this information to respond to enquiries, administer and provide the service, manage payments and contracts, communicate with participants and meet relevant professional, accounting and legal requirements.
​
Participants should not disclose identifiable personal or clinical information about their own clients or other third parties during training unless there is an appropriate lawful and professional basis for doing so.
​
Email Communications and Marketing
​
If you subscribe to receive updates, free resources, newsletters, programme information or other marketing communications, I may process your name and email address for this purpose.
​
Electronic marketing is carried out in accordance with applicable data protection law and the Privacy and Electronic Communications Regulations.
​
Marketing may be sent where you have provided appropriate consent or, where legally permitted, under the existing-customer or “soft opt-in” rules for similar products or services.
​
You may unsubscribe from marketing communications at any time using the unsubscribe link provided in emails or by contacting me directly.
​
I may retain a limited record after you unsubscribe so that I can ensure further marketing is not sent to you.
I will not sell your personal data or share it with unrelated third parties for their own marketing purposes.
​
Website and cookies
​
When you use my website, certain technical information may be processed automatically. This may include your IP address, device or browser information and information about how the website is used.
​
My website is hosted through Wix and uses cookies and similar technologies.
​
Some cookies are necessary for the website to operate.
​
Other cookies, including certain analytics, advertising or similar technologies, will only be used where permitted by law and, where required, after you have made an appropriate choice through the website’s cookie consent system.
​
You can manage relevant choices through the cookie settings available on the website.
​
Children and young people
​
Where I provide clinical psychology services to a child or young person, confidentiality, consent, information sharing and data protection will be considered in accordance with applicable law, professional standards and the individual child or young person’s circumstances and capacity.
​
Where appropriate, information may be shared with a person who has parental responsibility.
​
As children and young people develop greater understanding and autonomy, their confidentiality and privacy rights will be balanced appropriately with parental involvement and safeguarding responsibilities.
​
These arrangements will be discussed as part of establishing the clinical work.
​
I am committed to your data protection rights
​
You have important rights under UK data protection law. Not every right applies in every circumstance, but these may include the following:
​
Right to Object
​
You may have the right to object to processing based on my legitimate interests.
​
You have an absolute right to object to your personal information being used for direct marketing. If you object to direct marketing, I will stop using your information for that purpose.
​
Right to a copy of your information
​
You have the right to ask whether I hold personal information about you and to request a copy of that information.
​
I may need to verify your identity before providing information.
​
If a third party makes a request on your behalf, I may ask them to demonstrate that they have your authority to do so.
​
Right to correct inaccurate information
​
You may ask me to correct personal information that is inaccurate or complete information that is incomplete.
​
Right to erasure
​
In some circumstances you may ask me to delete personal information I hold about you.
This right is not absolute.
​
In particular, the right to erasure does not apply to clinical information where continued processing is necessary under the health or social care condition in Article 9(2)(h) of the UK GDPR, or where another applicable legal exemption or requirement means that information should be retained.
​
Professional, legal, regulatory, safeguarding, insurance or other requirements may therefore mean that I need to retain particular records.
​
Right to be informed
​
You have the right to understand how and why your personal information is being processed.
​
This Privacy Notice forms part of the information I provide to you.
​
Right to Restriction
​
In certain circumstances, you may ask me to restrict how your personal information is processed.
​
Right to data portability
​
Where this right applies, you may ask me to provide certain information you have supplied to me in a structured, commonly used and machine-readable format or, where technically feasible, transfer it to another organisation.
​
Rights relating to consent
​
Where I rely on your consent as the lawful basis for processing personal information, you may withdraw that consent at any time.
​
This does not affect processing that was lawful before consent was withdrawn.
​
Automated decision-making
​
I do not use solely automated decision-making that produces legal or similarly significant effects in relation to my clinical work with you.
​
Technology, including AI-assisted clinical documentation, may support aspects of administration and record keeping, but clinical decisions remain subject to my professional judgement.
​
Data retention and how long I may keep information
​
Whenever I collect or process personal information, I will only keep it for as long as reasonably necessary for the purpose for which it was collected and to meet relevant legal, professional, regulatory, insurance, contractual and accounting requirements.
​
For adult clinical psychology clients, I generally retain personal information and clinical records for six years after our work ends, unless there is a professional, legal, regulatory, safeguarding or insurance reason requiring a different retention period.
​
Different retention periods may apply to records relating to children and young people, taking account of relevant professional, legal and insurance requirements.
​
Information relating to online programmes, digital products, training, consultancy and financial transactions is retained for as long as reasonably necessary to provide the service and meet contractual, accounting, tax and legal requirements.
​
Marketing information is normally retained until you unsubscribe or otherwise object to receiving marketing. I may retain limited information afterwards in order to maintain a suppression record so that you are not contacted again.
​
At the end of the appropriate retention period, information will be securely deleted, anonymised or destroyed.
​
How to complain about my processing of your data
​
If you are concerned about how I have collected, used, shared or protected your personal information, you can make a data protection complaint directly to me.
​
Please contact:
Dr Kristy Potter
Dr Potter Psychology
Email: admin@drpotterpsychology.co.uk
​
I will acknowledge a data protection complaint within 30 days of receiving it.
​
I will take appropriate steps to investigate the complaint without undue delay, keep you appropriately informed while it is being considered and communicate the outcome to you without undue delay.
​
As Dr Potter Psychology is based in the United Kingdom, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
​
Information about making a complaint is available at:
https://ico.org.uk/make-a-complaint/
​
If you are located outside the UK, you may also have rights under data protection legislation applicable in your jurisdiction and may be able to contact the relevant local supervisory authority.
​
If you would like to discuss any aspect of this Privacy Notice or the way I process your information, please contact me: