Privacy Notice

Nea Clark Coaching and Psychotherapy

This privacy notice explains how I collect, use, store and protect personal information in my work as a self-employed psychotherapist and ADHD coach. It applies to people who enquire about or receive individual psychotherapy, couples psychotherapy, ADHD coaching or related client services from Nea Clark Coaching and Psychotherapy. It also covers personal information collected through www.neaclark.com in connection with these services.

Training, practitioner courses and services provided through ADHD Universe Ltd or ADHD Universe Academy are outside the scope of this notice and are covered by a separate privacy notice.

1. Who is responsible for your information

Nea Clark, trading as Nea Clark Coaching and Psychotherapy, is the data controller. This is a sole-trader business. I decide why and how your personal information is used.

Business address:
Nea Clark Coaching and Psychotherapy
2 Devonshire Crescent
Margaret House, 1st Floor
Roundhay
Leeds
LS8 1EP

Website: www.neaclark.com
Privacy enquiries: Please use the contact details you already use for the practice or contact me through www.neaclark.com/contact.

I am not required to appoint a Data Protection Officer. Questions, requests or concerns about your personal information should be directed to me using the details above.

2. The information I may collect

I collect only information that is relevant to providing and administering psychotherapy or coaching. Depending on the service and what you choose to share, this may include:

  • your name, address, date of birth, email address and telephone number;

  • contact details for your GP, emergency contact, referrer or funding organisation where relevant;

  • appointment dates, attendance, cancellations and communication preferences;

  • your client information form, therapy or coaching agreement and consent records;

  • payment, invoice and funding information, although I do not retain full payment-card details;

  • correspondence by email, text message or WhatsApp;

  • brief clinical or coaching notes, assessments, goals, plans and relevant documents;

  • information about your mental or physical health, neurodivergence, medication, disability, relationships, family circumstances and personal history;

  • other special-category information you choose to discuss, which may include racial or ethnic origin, religious or philosophical beliefs, political opinions, sex life or sexual orientation;

  • information about risk, safeguarding or the wellbeing of you or another person;

  • information supplied by a partner during couples work, or by a referrer, GP, funder or another professional where there is an appropriate basis for them to provide it;

  • scheduling and technical information produced when you use Calendly, Zoom or the website; and

  • where you have expressly opted in, session audio and the transcript or summary produced through Fireflies.ai for note-taking purposes.

I do not provide an ADHD diagnostic service. Any diagnostic or health information held by the practice is information supplied for the purpose of psychotherapy or coaching rather than a diagnosis made by me.

3. Where the information comes from

Most information comes directly from you, including information you provide through enquiries, client forms, conversations, sessions and correspondence.

Information may also come from:

  • a partner participating in couples work;

  • a person or organisation referring or funding your work;

  • your GP or another professional, normally with your knowledge or permission;

  • an emergency contact; or

  • the scheduling, video-conferencing and practice-management services used to arrange and provide sessions.

If someone provides personal information about another person, I will handle it carefully and only use it where it is relevant and lawful to do so.

4. Why I use your information and my lawful bases

Under the UK GDPR, I must have a lawful basis for each use of personal information. Health information and some other highly personal information are special-category data and require an additional condition under Article 9.

Purpose

UK GDPR lawful basis

Responding to an enquiry and deciding whether I can offer a service

Steps at your request before entering into a contract, Article 6(1)(b)

Arranging and providing psychotherapy or coaching, keeping appropriate records, sending appointment reminders and administering the client agreement

Performance of a contract, Article 6(1)(b)

Processing health and other special-category information necessary for psychotherapy and treatment, under a professional and common-law duty of confidentiality

Provision of health care or treatment by a person owing a duty of confidentiality, Article 9(2)(h), together with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018

Processing special-category information in coaching where the health-care condition is not applicable

Your explicit consent, Article 9(2)(a). This will be limited to information necessary to provide the service

Using Fireflies.ai to capture session audio and prepare a transcript or summary

Your consent, Article 6(1)(a), and your separate explicit consent for special-category information, Article 9(2)(a)

Maintaining secure systems, responding to complaints, establishing what was agreed and protecting my legal rights or those of another person

Legitimate interests, Article 6(1)(f), and where relevant the establishment, exercise or defence of legal claims, Article 9(2)(f)

Keeping invoices, payment records and other information required by tax, accounting or other law

Legal obligation, Article 6(1)(c)

Responding to an immediate and serious threat to life where the person is unable to consent

Vital interests, Articles 6(1)(d) and 9(2)(c)

Making a safeguarding disclosure where this is necessary and lawful

Legal obligation or legitimate interests under Article 6, and where required substantial public interest under Article 9(2)(g) and the relevant safeguarding condition in Schedule 1 of the Data Protection Act 2018

Consent is used only where you have a genuine choice. The ordinary keeping of client records is not based solely on consent and records do not automatically have to be erased if consent to a separate optional activity is withdrawn.

5. Client records and WriteUpp

WriteUpp is the secure practice-management system I use to hold client details and individual client records. This includes contact details, appointments, automatic reminders, client documents and clinical or coaching notes.

I remain the data controller. Pathway Software (UK) Limited, the provider of WriteUpp, acts as a data processor when it stores and processes client information on my instructions.

WriteUpp states that its main servers are located within the European Union, in Dublin and Amsterdam. It also uses protected backups and other contracted services. Transfers are handled in accordance with applicable UK data-protection requirements.

Access to the practice account is restricted and protected. Each client has an individual record. Information is not made available to other clients.

6. Online sessions and Zoom

Online sessions are ordinarily provided through Zoom. Zoom may process details such as your name, email address, IP address, device information, meeting time and the audio or video transmitted during the call.

I do not use Zoom's own recording function for an ordinary client session unless this has been separately discussed and expressly agreed. A client may use audio only or turn off their camera if this is clinically and practically appropriate.

Zoom acts as a service provider for the online meeting. Its processing may involve locations outside the UK, using recognised safeguards for international transfers.

7. Optional Fireflies.ai note-taking

Fireflies.ai is an AI-supported meeting assistant that can join a Zoom session, capture the session audio and generate a transcript and summary. Because this involves particularly sensitive information, I use Fireflies only where you have been given clear information and have expressly opted in through a separate consent form.

You may decline Fireflies or withdraw your consent for future sessions without losing access to psychotherapy or coaching. If you do not opt in, I will use my ordinary manual note-taking process.

Where Fireflies is used:

  • its presence in the session will be apparent;

  • the material will be used only to help me prepare an accurate client note;

  • I will review the output rather than treating an automated transcript or summary as automatically accurate;

  • relevant information will be transferred into your individual WriteUpp record;

  • Fireflies audio, transcript and summary will be deleted within 30 days of the session once the necessary note has been completed, unless a shorter period is practicable or the material must temporarily be preserved in connection with a complaint or legal claim; and

  • the final clinical or coaching note may continue to be retained under the lawful bases applying to the client record, even if consent to future Fireflies use is withdrawn.

Fireflies.ai is based in the United States and may process data in the United States and other countries. Fireflies states that it does not use personal information for AI model training and contractually prohibits its vendors from doing so. It also states that it uses recognised safeguards for transfers of UK personal information.

8. Calendly, Google Forms and WhatsApp

Calendly may be used to offer or arrange appointments. It may process your name, contact details, time zone, chosen appointment and scheduling information. You may contact me directly if you prefer not to use Calendly.

Google Forms may be used to collect a limited consent decision, including the Fireflies opt-in or opt-out form. The consent record is retained as part of the evidence of your choice. A Google Form will not be used as the main store for your clinical record.

WhatsApp may be used for brief, practical communication such as appointment arrangements. It is not intended for therapy or coaching sessions, emergencies or detailed clinical disclosures. If a WhatsApp message contains information that is important to your care or the administration of the service, the relevant information may be added to your WriteUpp record. WhatsApp is provided by Meta and may process message metadata and other account information outside the UK. Messages are not relied upon as the permanent client record and are periodically deleted when no longer required.

You are welcome to ask for an alternative reasonable method of routine communication.

9. Other artificial-intelligence services

Apart from the optional and disclosed use of Fireflies described above, I do not upload identifiable client information, client records or session content to general-purpose artificial-intelligence services. AI tools used for my separate writing, research or training work are not given information that identifies a client.

10. Couples work

Each person participating in couples work has an individual record. Information discussed in a joint session may nevertheless relate to both people and form part of the professional understanding of the couple's work.

If either person makes a data-access request, I must also protect the rights and confidentiality of the other person and of any third party. This may mean that some information is withheld or redacted. Data-protection rights do not automatically entitle one partner to receive everything said or provided by the other partner.

The therapeutic agreement explains the clinical boundaries around individual contact, joint sessions and confidentiality between partners.

11. Professional supervision

Like other psychotherapists, I use professional supervision to support ethical and effective practice. I minimise identifying details and use anonymised or pseudonymised information wherever reasonably possible. A supervisor is professionally bound to maintain confidentiality.

12. When information may be shared

I do not sell personal information. I share it only where this is necessary, proportionate and supported by an appropriate legal or professional basis. Possible recipients include:

  • WriteUpp, Zoom, Fireflies.ai, Calendly, Google and WhatsApp/Meta to the limited extent necessary to provide their respective services;

  • my professional supervisor, usually using anonymised or minimised information;

  • an accountant, insurer, solicitor or other professional adviser where necessary;

  • a GP, emergency service, safeguarding service or other appropriate professional where there is serious concern about safety or a lawful safeguarding reason;

  • a court, regulator, police service or other authority where disclosure is legally required or necessary in connection with legal proceedings;

  • a funder, employer, referrer or other professional where you have authorised the disclosure or another lawful basis applies; and

  • a person you have expressly asked me to communicate with.

All service providers are expected to protect information and process it only for authorised purposes. Where possible, I share the minimum information needed.

Confidentiality may be limited where there is a serious risk of harm, a safeguarding concern, a legal requirement, a court order or another exceptional circumstance described in the client agreement. Where appropriate and safe, I will seek to discuss a proposed disclosure with you first.

13. International transfers

WriteUpp's main client-data servers are in the European Union. Some other providers, including Zoom, Fireflies.ai, Calendly, Google and Meta, are international organisations and may process personal information outside the UK.

Where a restricted international transfer takes place, I rely on an applicable UK adequacy regulation or require an appropriate transfer safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally recognised mechanism. You may contact me for further information about the safeguards relevant to a particular provider.

14. How long information is retained

I do not keep identifiable information indefinitely. The normal retention periods are:

Information

Normal retention period

Enquiry that does not become a client relationship

Up to 12 months after the last meaningful contact

Adult client record, including contact details, agreement, appointments, consent records and professional notes

Seven years after the final session or last professional contact

Financial and tax records

At least six years after the end of the relevant financial or tax year, or longer if legally required

Fireflies audio, transcript and summary

Deleted within 30 days of the session once the necessary note has been completed, subject to any temporary need connected with a complaint or legal claim

Routine WhatsApp or scheduling messages

Kept only while needed for communication and administration, with relevant information transferred to WriteUpp where appropriate

Information needed for a complaint, safeguarding matter or legal claim

Until the matter and any relevant limitation or review period have ended

WriteUpp may retain protected backup data for a limited additional period under its technical backup arrangements. Data held by an external provider may also remain in secure backups until that provider's normal deletion cycle is completed.

Records may be kept longer where required by law, an insurer, a regulator, an active complaint or legal proceedings. They may be deleted sooner where there is no continuing lawful or professional reason to retain them.

15. Security

I take proportionate technical and organisational measures to protect personal information. These include using restricted-access professional systems, passwords and available multi-factor authentication, maintaining appropriate confidentiality, minimising information and reviewing access to records.

No internet or communication system can be guaranteed to be completely secure. If a personal-data breach creates a risk to your rights and freedoms, I will take appropriate action and notify the Information Commissioner's Office and affected individuals where the law requires it.

16. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

  • ask for access to your personal information;

  • ask for inaccurate information to be corrected;

  • ask for information to be erased;

  • ask for processing to be restricted;

  • object to processing based on legitimate interests;

  • receive certain information in a portable format;

  • withdraw consent where processing is based on consent; and

  • complain to the Information Commissioner's Office.

These rights are not absolute. For example, information may need to be retained for legal claims, professional accountability or the provision of health care, and access may be limited where disclosure would adversely affect another person's rights and freedoms.

I do not make decisions about clients that have legal or similarly significant effects solely through automated processing. Any Fireflies output is reviewed by me and does not make decisions about your care.

I will normally respond to a valid rights request within one month. I may need to confirm your identity before releasing information.

17. Complaints

Please contact me first if you have a question or concern about how your information has been handled. I will take the concern seriously and try to resolve it.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office
ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

18. Changes to this notice

I will review this notice periodically and update it when my services, systems or legal obligations change. The latest version will be published on www.neaclark.com. A change to this notice will not retrospectively create consent for an optional use of your information.