Privacy Notice
Dr Lynsey Kelly, Clinical Psychologist
HCPC Registered
cambridge-psychologist.co.uk
dr.lynsey.kelly@gmail.com
About this notice
I am the data controller for personal information I hold about you in connection with my private practice.
This Privacy Notice explains what information I collect, why I use it, who it may be shared with, how long it is retained and your rights.
Information I collect
I may collect:
Identity and contact information, including your name, date of birth, address, email address and telephone number.
Healthcare information, including details of your GP and other professionals involved in your care.
Emergency contact information, including the name, relationship and contact details of the person you nominate.
Clinical information, including information provided during assessment and therapy, clinical notes, questionnaires and measures, correspondence and other information generated in the course of therapy.
Financial and funding information, including information relating to payments, invoices, insurers, universities or Colleges funding therapy.
Psychological therapy involves processing special category personal data, particularly information about physical and mental health. It may also involve information about racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation.
How I obtain information
Most information is provided directly by you.
I may also receive relevant information from other people or organisations, including healthcare professionals, insurers, universities or Colleges, referrers, or another person or service involved in your care or safety.
Why I use your information
I use personal information where necessary to:
assess your needs and provide psychological therapy;
maintain appropriate clinical records;
communicate with you;
manage appointments, payments and third-party funding;
operate my private practice;
undertake professional supervision;
communicate with other professionals where appropriate;
meet professional, regulatory and legal obligations;
establish, exercise or defend legal claims; and
respond appropriately to safeguarding concerns or serious concerns about safety.
Where you have separately agreed to its use, Zoom AI Companion may also be used to assist in producing clinical notes from online sessions.
Lawful basis for processing
For ordinary clinical care and practice administration, the lawful bases I rely upon will depend upon the particular processing and may include performance of a contract, legitimate interests and compliance with legal obligations.
Because I process health information and other special-category information, I also require an additional lawful condition. For the ordinary provision of psychological therapy, I principally rely upon processing that is necessary for the provision of healthcare or treatment by a health professional subject to duties of confidentiality.
Other bases or conditions may apply in particular circumstances, including protection of vital interests, safeguarding, legal claims or other legal obligations.
I do not ordinarily rely upon your consent to process the clinical information necessary to provide therapy. Consequently, ending therapy or withdrawing consent from an optional activity does not necessarily require me to delete your clinical record.
Emergency contacts
I ask you to nominate an emergency contact and hold their name, relationship to you and contact details.
I will not routinely contact them or disclose that you are receiving therapy.
I may use these details where I have a serious and immediate concern about your safety and believe contacting them is necessary to help keep you safe. This may include an unexpected failure to attend an appointment where there are additional circumstances giving me serious cause for concern.
Where possible and appropriate, I would discuss this with you first. I will aim to disclose only the information necessary for the purpose.
I may also contact emergency services, your GP or another appropriate service where I consider this necessary.
Zoom AI Companion
With your separate agreement, I may use Zoom AI Companion during online therapy sessions to assist me in producing clinical notes.
Zoom processes the spoken content of the session and generates transcript data in order to produce an AI meeting summary.
My Zoom account is configured so that:
sessions are not audio- or video-recorded as part of this process;
a verbatim meeting transcript is not retained;
the AI meeting summary is not automatically shared with participants;
stored meeting summaries are located in Germany; and
Zoom meeting summaries are automatically deleted after 30 days.
I review the AI-generated summary and make any necessary changes before the resulting information is used as the clinical note. That clinical note is retained separately as part of your clinical record.
Zoom states that it does not use customer audio, video or other communications content to train Zoom's or third-party AI models. Where Zoom uses third-party AI models to provide a feature, relevant information may be processed outside the UK, including in the United States.
The AI system does not make clinical decisions about you. I remain responsible for clinical records and professional decisions.
Use of Zoom AI Companion is optional. You can decline its use and still receive therapy. You may also withdraw your agreement to its use for future sessions at any time.
Professional supervision
I undertake appropriate professional supervision and may discuss aspects of my clinical work with my supervisor.
I minimise identifying information where possible. My supervisor is subject to professional duties of confidentiality.
Who I may share information with
Where necessary and appropriate, I may share relevant information with:
your GP, psychiatrist or another healthcare professional;
my clinical supervisor or another professional providing clinical consultation;
emergency services, safeguarding services or other relevant organisations where there are serious safety or safeguarding concerns;
your nominated emergency contact in the limited circumstances described above;
an insurer, university, College or other third-party funder where appropriate;
professional advisers such as lawyers or accountants;
organisations providing IT, communications or other services necessary to operate my practice;
Zoom, where Zoom is used for online therapy and, with your agreement, AI-assisted clinical notes;
the HCPC or another regulatory or legal body where disclosure is necessary;
debt-recovery services in the event of persistent non-payment; and
other organisations where disclosure is required or permitted by law.
I aim to disclose only information that is necessary for the relevant purpose.
International processing
Some organisations providing technology services to my practice may process personal information outside the UK.
My Zoom account is configured to store Zoom Meeting Summaries in Germany. However, this does not mean that all processing involved in providing Zoom AI Companion occurs in Germany. Zoom may use third-party AI providers that process relevant information outside the UK, including in the United States.
Where personal information is transferred internationally, appropriate arrangements must be in place in accordance with UK data-protection law.
How I protect your information
I take appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration or disclosure.
I also take reasonable steps to ensure that organisations processing personal information on my behalf provide appropriate protection.
How long I keep your information
I generally retain your clinical record and associated personal information for seven years after our clinical relationship ends.
Information may be retained for longer where necessary because of safeguarding concerns, legal or regulatory proceedings, legal claims, or another legal or professional requirement.
Where Zoom AI Companion is used, the Zoom meeting summary is configured to be automatically deleted after 30 days and a verbatim Zoom meeting transcript is not retained as part of my usual workflow.
The reviewed clinical note is retained as part of your clinical record.
Your rights
Depending on the circumstances, you may have the right to:
access personal information I hold about you;
ask me to correct inaccurate or incomplete information;
request erasure of information in certain circumstances;
request restriction of processing in certain circumstances;
object to certain processing;
receive certain information in a portable format where the right to data portability applies; and
withdraw consent where a particular processing activity is based upon your consent.
These rights are not absolute. For example, a request for deletion does not necessarily require me to delete clinical records that I have an appropriate legal or professional reason to retain.
You can contact me at lynsey.kelly@gmail.com to exercise your rights.
You can also ask me for a copy of your clinical notes or reviewed meeting summaries. There may be limited circumstances in which some information cannot be provided, for example where disclosure would adversely affect the rights of another person.
Complaints about data protection
If you have concerns about how I have handled your personal information, please contact me in the first instance.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data-protection regulator.
Information Commissioner's Office
Changes to this notice
I keep this Privacy Notice under review and will update it when the way I process personal information changes.
Where I introduce a significant new use of your personal information, I will bring this to your attention before beginning that processing.
Last updated: September 2026