Last updated: August 2026

Joanne Wright Psychology respects your privacy and is committed to protecting your personal information. This privacy policy explains what information we collect, why we collect it, how it may be used and shared, how long it is retained, and the rights available to you under UK data-protection law.

Psychological and assessment records may contain information about physical or mental health. This is treated as special-category personal data and is subject to additional legal protections.

1. Who We Are

Joanne Wright Psychology provides psychological services including:

• ADHD and autism assessments;
• psychological therapy;
• EMDR;
• clinical hypnotherapy;
• mindfulness-based support;
• post-diagnostic support;
• psychology-related SEND guidance.

For data-protection purposes, the data controller is:

Joanne Wright Psychology
Practice address: Joanne Wright Psychology 1st Floor Boughey House, 60 High Street, Newport TF10 7AQ
Email: office@joannewrightpsychology.co.uk
Telephone: 07779 297177
Website: joannewrightpsychology.com
ICO registration number: ZA749433

2. Information We May Collect

The information collected will depend on your relationship with the practice and the service being provided.

It may include:

• your name, address, telephone number and email address;
• your date of birth and preferred pronouns;
• parent, carer or emergency-contact details;
• GP and other healthcare-professional details;
• information provided through website contact forms;
• appointment and communication records;
• payment, invoice and insurance information;
• insurer membership, policy and authorisation details;
• physical and mental-health information;
• developmental, family, educational and employment history;
• assessment questionnaires, clinical interviews and observations;
• therapy notes, formulations and treatment plans;
• diagnostic information and psychological reports;
• school, college, university or workplace information;
• information supplied by parents, carers, teachers or other professionals;
• safeguarding and risk information;
• information concerning disability, ethnicity, religion or other matters where clinically relevant;
• technical information generated when you use the website, such as IP address, browser type and cookie preferences.

Please avoid submitting detailed or highly sensitive clinical information through the general website contact form unless specifically requested.

3. Information About Children and Young People

Where services are provided to a child or young person, information may be collected from:

• the child or young person;
• a parent or person with parental responsibility;
• schools, colleges or nurseries;
• healthcare practitioners;
• local-authority professionals;
• other people involved in the child’s care or assessment.

Children and young people will be involved in decisions about their information in a way that reflects their age, understanding and circumstances.

Where appropriate, consent or another valid legal basis will be established before information is requested from or disclosed to another organisation.

4. How We Collect Information

We may collect personal information:

• directly from you;
• through the website contact form;
• by telephone, email or video consultation;
• during appointments and assessments;
• through questionnaires and service agreements;
• from parents, carers or family members;
• from schools, employers and other professionals;
• from previous reports or clinical records supplied to us;
• from insurers funding treatment;
• from publicly available information where relevant and lawful.

Where information is obtained from someone other than the person it concerns, appropriate privacy information should generally be provided within a reasonable period and no later than one month, subject to limited exceptions.

5. Why We Use Personal Information

We may use personal information to:

• respond to enquiries;
• assess whether a service is appropriate;
• arrange and manage appointments;
• provide psychological assessments and therapy;
• prepare diagnostic and psychological reports;
• formulate clinical opinions and recommendations;
• communicate with parents, schools and other professionals;
• manage safeguarding or risk concerns;
• process payments and insurance claims;
• maintain appropriate clinical and business records;
• comply with professional, legal and regulatory obligations;
• respond to complaints, claims or legal proceedings;
• manage and improve the website;
• protect the security of our systems and services.

Information will not be used for a materially different purpose without considering whether a new lawful basis or further notification is required.

6. Our Lawful Bases

Depending on the circumstances, personal information may be processed because:

• it is necessary to take steps at your request before entering into an agreement;
• it is necessary to provide a contracted service;
• there is a legal or regulatory obligation;
• it is necessary for legitimate business or professional interests, provided your rights are not overridden;
• you have provided valid consent;
• it is necessary to protect someone’s vital interests.

Because psychological services involve health information, an additional legal condition is required for processing special-category data. Relevant conditions may include the provision or management of health or social care, explicit consent, the protection of vital interests or the establishment, exercise or defence of legal claims, depending on the circumstances.

UK data-protection law requires an organisation to identify both an Article 6 lawful basis and an appropriate Article 9 condition when processing special-category data.

Consent will not necessarily be the lawful basis for every aspect of clinical record-keeping. For example, certain records may need to be retained after services end to meet professional, insurance or legal responsibilities.

7. Who We May Share Information With

Information is kept confidential and is not routinely shared without an appropriate reason.

Where necessary and lawful, it may be shared with:

• your GP or another healthcare professional;
• members of a multidisciplinary assessment team;
• appropriately qualified associate practitioners;
• schools, colleges, universities or employers;
• parents, carers or people with parental responsibility;
• local authorities or SEND professionals;
• private health insurers;
• medication or prescribing providers;
• professional supervisors, using anonymised or minimised information wherever practicable;
• administrative, IT, secure-email, record-storage or payment providers;
• professional indemnity insurers, legal advisers or regulatory bodies;
• safeguarding agencies, emergency services or the police;
• courts or tribunals where disclosure is legally required.

Only information that is relevant and necessary will be shared.

Where an independent professional or organisation receives information, they may act as a separate data controller and apply their own privacy policy.

8. Confidentiality and Safeguarding

Psychological services are confidential, but confidentiality is not absolute.

Information may need to be disclosed without consent where:

• there is a serious or immediate risk of harm;
• a child or vulnerable adult may be at risk;
• disclosure is required by law or court order;
• it is necessary to prevent or investigate serious crime;
• it is required to protect the vital interests of an individual;
• a professional or regulatory obligation requires action.

Where possible and safe, the person concerned will be informed before information is shared.

9. Working With Other Organisations

Joanne Wright Psychology may work alongside external organisations, including:

• independent assessment professionals;
• medication providers;
• private health insurers;
• education and SEND services;
• School of Diversity.

Information will not automatically pass between organisations merely because they work in association. Information will only be shared where there is a valid legal basis, an appropriate professional reason and, where required, your knowledge or consent.

10. Private Health Insurance

Where an appointment is funded by Bupa, AXA Health or Aviva, we may process and share information required to:

• confirm authorisation;
• verify eligibility;
• submit invoices;
• provide treatment updates;
• request additional sessions;
• meet the insurer’s audit or contractual requirements.

Your insurer may require certain clinical information before agreeing or continuing funding. You should consult your insurer’s privacy policy for details of how it processes your information.

11. Payments

Self-funded payments are normally made by bank transfer.

We may retain records relating to:

• payments received;
• invoices;
• outstanding balances;
• refunds;
• insurer contributions;
• policy excesses.

Financial records may need to be retained to satisfy accounting, taxation, insurance and legal requirements.

The practice does not need to retain complete online-banking credentials or payment-card details.

12. Clinical Supervision

Professional supervision supports safe and effective psychological practice.

Clinical matters may be discussed with an appropriately qualified supervisor. Information will be anonymised or minimised wherever possible. Supervisors are also subject to professional duties of confidentiality.

In limited circumstances, identifying information may need to be discussed where necessary to manage safeguarding, risk, clinical governance or another significant concern.

13. How We Protect Information

Reasonable technical and organisational measures are used to protect personal information against unauthorised access, alteration, loss, disclosure or destruction.

These may include:

• password-protected systems;
• secure devices and accounts;
• access controls;
• encrypted or secure communication where appropriate;
• secure storage of paper records;
• data minimisation;
• confidentiality agreements;
• regular software and security updates;
• secure disposal procedures;
• incident-response and breach-management processes.

No method of electronic transmission or storage can be guaranteed to be completely secure, but proportionate steps are taken to reduce foreseeable risks.

14. How Long We Keep Information

Information is retained only for as long as reasonably necessary for the purpose for which it was collected and to meet professional, regulatory, insurance, safeguarding, taxation and legal requirements.

Different records may have different retention periods. The period applied may depend on:

• whether the client is an adult or child;
• the type of service provided;
• professional guidance;
• insurer requirements;
• safeguarding considerations;
• limitation periods for legal claims;
• any ongoing complaint or dispute.

Insert the practice’s confirmed retention schedule here, for example:

• adult clinical records: 7 Years
• child clinical records: 7 Years
• unsuccessful enquiries: 3 Months
• financial records: 6 Years
• contact-form submissions: 3 Months

Records may be retained longer where there is a safeguarding concern, complaint, legal claim or other valid reason.

The ICO requires privacy information to explain applicable retention periods or the criteria used to determine them.

15. Email, Telephone and Online Appointments

Email and standard telephone communication may not always be completely secure. Please consider the sensitivity of the information you send.

Online appointments require:

• a suitable internet connection;
• a private environment;
• an appropriate device;
• reasonable steps to prevent conversations being overheard.

Online sessions will not be recorded by the practice unless this has been discussed in advance and an appropriate legal basis has been established. Clients should not record appointments without prior written agreement.

16. Website Contact Forms

When you submit a website form, the information may be used to:

• respond to your enquiry;
• determine which service may be appropriate;
• provide information about fees and availability;
• arrange an initial appointment;
• maintain a record of correspondence.

Submitting a form does not create a therapeutic relationship or guarantee that a service can be offered.

The website contact form should not be used for urgent, crisis or emergency support.

17. Cookies and Website Analytics

The website may use cookies and similar technologies to:

• operate essential website functions;
• maintain security;
• remember preferences;
• understand how visitors use the website;
• measure website performance;
• support embedded content or third-party services.

18. External Links

The website may contain links to other organisations, including School of Diversity, insurers and professional resources.

Joanne Wright Psychology is not responsible for the privacy practices or content of external websites. You should review the privacy information provided by the relevant organisation before submitting personal data.

19. International Transfers

Some technology providers may store or access information outside the United Kingdom.

Where this occurs, reasonable steps will be taken to ensure an appropriate transfer mechanism and safeguards are in place, such as:

• UK adequacy regulations;
• an International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally recognised safeguard.

20. Automated Decision-Making

Joanne Wright Psychology does not make solely automated decisions that produce legal or similarly significant effects for clients.

Diagnostic and treatment decisions are made through professional clinical judgement and consideration of relevant evidence. Questionnaire scores or digital tools are not used as the sole basis for diagnosis.

21. Your Data-Protection Rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• request deletion of information;
• request restriction of processing;
• object to certain processing;
• request transfer of information in a portable format;
• withdraw consent where consent is relied upon;
• challenge certain automated decisions;
• complain to the Information Commissioner’s Office.

These rights are not absolute. For example, access may be restricted where disclosure would adversely affect another person’s rights, and clinical records may need to be retained despite a deletion request where there is a valid legal or professional reason.

22. Requests for Access to Records

To request access to your personal information, contact:

Email: office@joannewrightpsychology.co.uk
Postal address: Joanne Wright Psychology 1st Floor Boughey House, 60 High Street, Newport TF107AQ

We may need to confirm your identity before responding.

Where a request concerns a child or information supplied by another person, additional checks may be required to protect confidentiality and determine who is entitled to receive the information.

23. Concerns and Complaints

Questions or concerns about the handling of your information should initially be directed to:

Joanne Wright Psychology
Email: office@joannewrightpsycholgy.co.uk
Telephone: 07779 297177

You also have the right to complain to the Information Commissioner’s Office. Details of how to raise a concern are available through the ICO.

24. Changes to This Policy

This policy will be reviewed periodically and updated where the practice, services, technology or legal requirements change.

The current version will be published on this website with its effective date. Significant changes affecting how information is used will be brought to the attention of affected individuals where appropriate.