Website Privacy Policy

Verdure Psychology Ltd | Version 2.2 | Effective 29 June 2026 | Last updated 29 June 2026

This Privacy Policy explains how Verdure Psychology Ltd collects, uses, shares and protects personal information when people use our website, submit enquiries or referral forms, communicate with us, or take steps before entering into a therapeutic or professional service.

1. Who we are

Verdure Psychology Ltd is the data controller for personal information processed through this website and through Verdure Psychology enquiries and pre-service administration, unless another practitioner or organisation states that they are the controller for their own service.

Company number: 15019341. Registered office: Innovation Centre (Office1.03), Innovation Way, Heslington, York, North Yorkshire, England, YO10 5DG.

Contact: info@verdurepsychology.co.uk. Telephone: 07594 805751.

We have not appointed a formal Data Protection Officer. Data protection enquiries should be sent to the email address above.

2. Scope of this policy

This policy covers website use, general enquiries, referral forms, booking enquiries, contact forms and pre-service administration. If you become a client, the relevant Service Agreement and any practitioner-specific privacy information will provide additional details about clinical records, confidentiality, retention and service-specific data processing.

Independent associates may act as separate data controllers for the therapeutic or professional services they provide. If you ask to work with an associate, your enquiry details may be passed to that practitioner so they can respond to you and provide their own service information.

3. Personal information we collect

Depending on how you use the website and services, we may collect:

identity and contact details, such as name, email address, telephone number, address and preferred contact method;

date of birth and demographic information where needed to identify you safely or assess whether the service is appropriate;

enquiry, referral and appointment information, including what you tell us about the support you are seeking;

health and wellbeing information, GP details, emergency contact details and relevant risk or safeguarding information where you provide this through secure forms or pre-service communication;

payment, insurer and billing information where relevant;

electronic signature, form submission records and correspondence;

technical information such as IP address, browser type, device information, pages visited, referring pages and approximate location derived from technical data; and

cookie-consent preferences and limited website interaction information, where collected in accordance with the Cookie Policy and your consent choices.

We ask that you only provide information that is relevant to your enquiry or service. If you provide information about another person, you should only do so where you have a lawful and appropriate reason.

4. Special category information

Information about physical or mental health is special category data under UK data protection law and requires additional protection. Some enquiries may also reveal other sensitive information, such as disability, ethnicity, religion, sexuality, sex life or family circumstances. We process this information only where it is necessary and lawful, usually because it is needed to assess, arrange or provide health care or related professional services, manage risk, meet professional obligations, or respond to your enquiry.

5. How and why we use personal information

We use personal information for the following purposes:

to respond to enquiries and referral requests;

to assess whether Verdure Psychology or an associate may be able to offer an appropriate service;

to arrange appointments, send forms, confirm identity and manage communication;

to provide or administer psychological, therapeutic, supervision or related professional services where you decide to proceed;

to maintain clinical, administrative and financial records;

to manage payments, insurance-funded work, invoices and accounting;

to protect safety, manage risk and respond to safeguarding concerns;

to comply with legal, regulatory, tax, insurance and professional obligations;

to operate, secure and improve the website and IT systems;

to manage cookie preferences and website security controls;

to understand basic website performance through privacy-respecting statistics or consented analytics tools where enabled; and

to handle complaints, data protection rights requests, disputes or legal claims.

6. Lawful bases for processing

We do not rely on consent for most core processing because clinical, administrative and legal processing is usually necessary to respond to enquiries, take steps before entering into a contract, provide health care, manage risk, or meet legal and professional obligations. Where we do rely on consent, you may withdraw it at any time, although this will not affect processing that has already taken place.

Purpose	Article 6 lawful basis	Article 9 condition, where special category data is involved
Responding to enquiries, referral requests and pre-contract communication	Article 6(1)(b) contract/pre-contract steps and/or Article 6(1)(f) legitimate interests	Article 9(2)(h) health or social care, where health information is needed
Providing and administering therapy, assessment, supervision or related services	Article 6(1)(b) contract; Article 6(1)(c) legal obligation where relevant	Article 9(2)(h) health or social care by or under the responsibility of a health professional
Risk management, safeguarding and serious concerns about safety	Article 6(1)(c) legal obligation, Article 6(1)(d) vital interests and/or Article 6(1)(f) legitimate interests	Article 9(2)(h) health or social care; Article 9(2)(c) vital interests where applicable; Article 9(2)(f) legal claims where relevant
Payments, insurance administration, invoicing and accounting	Article 6(1)(b) contract; Article 6(1)(c) legal obligation; Article 6(1)(f) legitimate interests	Article 9(2)(h) where health information is necessary for insurance-funded care
Website security, basic performance and service improvement	Article 6(1)(f) legitimate interests	Usually not applicable
Non-essential cookies, analytics or similar technologies, if enabled	Consent, unless a narrow PECR exception applies and the required information and objection controls are provided	Usually not applicable
Legal claims, complaints, regulatory enquiries or professional advice	Article 6(1)(c) legal obligation and/or Article 6(1)(f) legitimate interests	Article 9(2)(f) legal claims and/or Article 9(2)(h) health or social care where relevant
Marketing communications	Consent, where used	Usually not applicable

7. AI-assisted tools and automated decisions

Verdure Psychology may use carefully selected AI-assisted tools to support administration, document drafting, proofreading, summarisation, transcription or clinical record-keeping. AI-assisted output is reviewed by a qualified practitioner or appropriate staff member before it is relied upon. AI is not used to make autonomous decisions about eligibility, diagnosis, risk management or treatment.

Identifiable personal information will only be processed through AI-assisted systems where appropriate data protection safeguards are in place. Session transcription, recording or similar processing will only be used where it has been explained to you and agreed where required.

8. Sharing personal information

We do not sell personal information. We do not use your personal information for marketing without your consent. We may share personal information where necessary and proportionate with:

independent associates or other practitioners where you have asked to work with them or where this is needed to respond to a referral;

secure clinical, form, communication and practice-management systems, including Cliniko, ProtonMail and other secure business systems;

payment, banking, insurance and accounting providers, including Stripe, Starling Bank, Healthcode, Xero and professional advisers where relevant;

AI-assisted documentation or transcription providers such as Heidi Health where used with appropriate safeguards;

clinical supervisors, usually with information anonymised or minimised where possible;

GPs, emergency contacts, NHS services, safeguarding services or emergency services where there is a serious concern about safety or safeguarding;

insurers, courts, regulators, professional bodies, legal advisers or law enforcement agencies where required or permitted by law; and

website hosting, security, cookie consent and IT support providers needed to operate, secure and improve the website and systems, including tools identified in the current Cookie Policy where active.

Processors are expected to process personal information only under appropriate contractual safeguards. Some third parties may act as independent controllers for their own legal or professional purposes.

9. International transfers

Some service providers may process personal information outside the UK. Where this involves a restricted transfer, we will rely on a valid adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism.

10. Security

We use appropriate technical and organisational measures to protect personal information, including secure systems, access controls, passwords, encryption where appropriate, confidentiality obligations and limited access on a need-to-know basis.

No internet transmission or electronic system can be guaranteed to be completely secure. You should avoid sending urgent or highly sensitive information by standard email or general website forms unless specifically requested to use a secure method.

11. Retention

We keep personal information only for as long as necessary for the purposes for which it was collected, including professional, legal, accounting, insurance and safeguarding requirements. Usual retention periods are:

Type of information	Usual retention period
Website enquiries that do not proceed to a service	Normally up to 2 years, unless a longer period is needed for safeguarding, complaints, legal claims or regulatory reasons
Adult clinical records	Normally 7 years after last contact
Clinical records for young people	Normally until age 26, or 7 years after last contact if that is later or clinically/legally necessary
Financial, invoice and accounting records	Normally 6 years from the end of the relevant financial year
Data protection complaints and rights requests	Normally up to 6 years after closure, unless a longer period is needed
Cookie consent records and website technical/statistical data	According to the Cookie Policy, consent-management settings and relevant provider retention settings

Records may be retained for longer where required by law, insurance, professional standards, safeguarding considerations, complaints or legal claims.

12. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

be informed about how your personal information is used;

access a copy of your personal information;

ask for inaccurate or incomplete information to be corrected;

ask for information to be erased in certain circumstances;

ask us to restrict processing in certain circumstances;

object to processing in certain circumstances;

receive certain information in a portable format;

withdraw consent where processing is based on consent; and

complain about how your information has been handled.

These rights are not absolute. For example, clinical, safeguarding, accounting, legal or professional obligations may mean that we cannot erase some records. We will respond to valid rights requests without undue delay and usually within one month. We may need to confirm your identity before responding.

13. Cookies and similar technologies

The website has a separate Cookie Policy. The Cookie Policy is now maintained manually on the website, while Complianz is used to provide the cookie banner, record cookie choices and allow visitors to manage consent preferences.

The website currently uses necessary and functional cookies and similar technologies for site operation, security, form functionality, WordPress/Elementor functionality and cookie-consent choices. We do not currently use Google Analytics, Microsoft Ads, Microsoft Clarity, heat maps or session-replay tools.

Non-essential cookies or similar technologies, such as analytics, advertising, social-media tracking, heat-map or session-replay tools, will only be used where legally permitted and where appropriate consent or another valid PECR basis applies. Any such tools should be configured to minimise personal information and avoid capturing sensitive information entered into forms or communications.

You can manage or withdraw cookie consent using the cookie banner, the website cookie settings or your browser settings. The Cookie Policy should be reviewed whenever website plugins, analytics, advertising, form, embedded-content or security tools change.

14. Direct marketing

We do not add clients or enquirers to marketing lists without permission. If we ever send newsletters or marketing communications, we will only do so where we have an appropriate lawful basis and you will be able to unsubscribe.

15. Children and young people

Verdure Psychology primarily provides services to adults and young people aged 16 and above. Where personal information relates to a young person, we consider capacity, confidentiality, safeguarding and parental or guardian involvement in line with legal and professional standards. Information will be shared only where appropriate, necessary and proportionate.

16. Data protection complaints

You can complain to us if you are concerned about how your personal information has been handled. Please email info@verdurepsychology.co.uk or write to the registered office address above.

We will acknowledge receipt of a data protection complaint within 30 days. We will take appropriate steps to investigate, keep you informed where necessary, and tell you the outcome without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: https://ico.org.uk.

17. Changes to this policy

We may update this policy from time to time. The latest version will be published on the website with the version number and date. Where changes are significant and you are an active client, we may also notify you by email or through service documentation.

18. Document control

Document	Website Privacy Policy
Version	2.2
Effective date	29 June 2026
Last updated	29 June 2026