Privacy Statement

General Data Protection Regulation and Privacy Policy

Introduction

Welcome to The Haven Child Psychology Practice’s privacy policy. We take the privacy rights of all our clients seriously and uphold the highest standards of compliance and confidentiality regarding your personal data. This practice is a safe space for you to discuss your feelings and concerns, operating within a highly confidential environment.

This privacy policy explains how we collect, use, and safeguard your personal data, including sensitive health information, in accordance with the UK GDPR, Data Protection Act 2018, and the Data Use and Access Act 2025 (DUAA).

1. Important Information and Who We Are

Purpose of this Privacy Policy

This privacy policy provides information on how The Haven Child Psychology Practice collects and processes your personal data when you use our website, contact us, or engage in therapeutic services.

This website is not intended for children directly. We only collect information from parents or guardians referring children to our service.

Please read this privacy policy together with any other privacy notice we may provide on specific occasions when we collect or process your personal or sensitive data. This policy supplements those notices and is not intended to override them.

Data Controller

• Tanya Griffiths is the primary data controller responsible for your personal data.
• Associates working with Dr. Tanya Griffiths Ltd may also act as data controllers for clients they directly support due to the confidential nature of therapeutic work. In such cases, they will be the primary data controllers.

Changes to this Privacy Policy

We keep our privacy policy under review. This version reflects changes brought in by the Data Use and Access Act 2025, effective from August 2025.

2. The Data We Collect About You

• We collect different categories of personal data including:
  • Identity Data (e.g., name, date of birth, gender)
  • Contact Data (e.g., address, email, phone)
  • Financial & Transaction Data (e.g., payment information)
  • Technical & Usage Data (e.g., website analytics, cookies)
  • Profile Data (e.g., preferences, feedback, survey responses)
  • Marketing Data (e.g., communication preferences)

Sensitive (Special Category) Data

As a psychology practice, we process sensitive data including:

• Health and mental health information (e.g., history, medication, therapy notes).

We only process such data with your explicit consent, unless another lawful basis applies (e.g., safeguarding, vital interests, or public health purposes under the new “recognised legitimate interests” basis introduced in DUAA 2025).

3. How Your Data Is Collected

• Directly: Forms, therapy sessions, email, phone.
• Automatically: Website analytics, cookies.
• Third Parties: For example, secure IT service providers, payment processors, or publicly available sources.

4. How We Use Your Data

We will only use your data when the law allows. Under UK GDPR and DUAA 2025, the lawful bases we rely on are:

• Performance of a contract – to provide therapy and services.
• Legal obligation – compliance with safeguarding, child protection, or regulatory requirements.
• Recognised legitimate interests – safeguarding children or vulnerable individuals, ensuring security of systems, or conducting health-related research where appropriate.
• Consent – required for processing sensitive health data and for marketing communications.

We will never use solely automated decision-making to make clinical or legal determinations about you. Where automated tools (such as appointment scheduling or secure platforms) are used, human review is always involved.

5. Disclosures of Your Data

We may share your data with:

• Service providers (IT, secure storage, payment processors).
• Professional advisors (legal, insurance, audit).
• Safeguarding or regulatory authorities (where legally required).

All third parties are bound by confidentiality and security requirements.

6. International Transfers

If we transfer data outside the UK:

• We will rely on UK adequacy decisions (where a country offers protections not materially lower than the UK).
• Where this is not available, we will use International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs).

7. Data Security

We use organisational and technical measures to protect your data, including:

• Restricted access to sensitive records.
• Secure encrypted storage.
• Breach response procedures in line with ICO requirements.

8. Data Retention

We retain personal data only as long as necessary:

• Typically, health records must be retained for at least 7 years after last contact (or until the child is 25, if seen under 18).
• Financial records are retained for 6 years for HMRC purposes.
• After this period, data is securely destroyed or anonymised for research/statistical purposes.

9. Your Legal Rights

Under UK GDPR and DUAA 2025, you have rights including:

• Access to your data.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”).
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Data portability.
• Withdraw consent at any time.

You also have the right to raise a complaint with us directly under our formal complaints process, or with the ICO. 

Contact Details

If you have any questions about this policy or wish to exercise your rights, please contact our Data Protection Officer (DPO):

Legal Entity: Dr. Tanya Griffiths Ltd
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Postal Address: c/o 21 Fairwater Close, Gosport, PO13 0HF
Telephone: 07713 462065

You always have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We encourage you to contact us first, as we are required under DUAA to provide a fair complaints process.