Privacy Policy
Last updated: September 2026
Pinewood Psychology is committed to protecting your privacy and handling your personal information carefully, securely and transparently.
This privacy notice explains what information I may collect about you, why I use it, how it may be shared and the rights you have in relation to your personal information.
Who I am
Pinewood Psychology provides psychological therapy, autism and ADHD assessments, training and consultation.
For the purposes of UK data protection law, Pinewood Psychology is the data controller for the personal information described in this notice.
Dr Hannah Gray
Clinical Psychologist
Pinewood Psychology
Rownhams House
Betteridge Drive
Southampton
SO16 8LS
Email: hannah@pinewoodpsychology.com
Information I may collect
The information I collect depends on your relationship with Pinewood Psychology.
If you contact me about therapy, assessment or another psychological service, this may include your name and contact details; information provided when making an enquiry; appointment and correspondence information; relevant personal, developmental and family history; information about your physical and mental health; assessment information and questionnaire responses; clinical notes, reports and recommendations; information provided by family members, schools, healthcare professionals or other relevant people where appropriate; information relating to referrals, funding or insurance; and payment and invoicing information.
Some of this information, particularly information about physical or mental health, is classed as special-category personal data and receives additional protection under data protection law.
If you contact Pinewood Psychology about training, consultation or another professional service, I may collect your name, role, organisation, professional contact details and information relevant to your enquiry.
How I use your information
I may use your personal information to:
- respond to enquiries;
- arrange and provide psychological services;
- carry out psychological assessments and prepare reports;
- communicate with you about appointments and services;
- liaise with other professionals or relevant people where appropriate;
- manage payments, invoices and insurance arrangements;
- maintain appropriate clinical and business records;
- provide training, consultation and other professional services;
- meet professional, regulatory, safeguarding and legal obligations; and
- maintain the security and effective operation of Pinewood Psychology.
I only collect and use information that is relevant to the purpose for which it is needed.
Lawful basis for using your information
Under UK data protection law, I must have a lawful basis for processing personal information.
Depending on the circumstances, Pinewood Psychology may process personal information because it is necessary to provide a service you have requested or to take steps before providing that service; to comply with a legal obligation; or for the legitimate interests of operating and administering an independent psychology practice, where those interests do not override your rights and interests. Consent may also be used where it is the appropriate lawful basis.
Where I process health information or other special-category information as part of providing psychological services, an additional condition for processing is required. This may include processing necessary for the provision of health care or treatment by a health professional, subject to appropriate professional confidentiality requirements.
Sharing your information
Your information is treated confidentially.
There may be circumstances in which information is shared where this is necessary and appropriate. This may include other professionals involved in an assessment or your care; your GP or another healthcare professional where appropriate; insurers or organisations funding your care; professionals or organisations to whom you have asked me to provide information; and regulatory, safeguarding or legal bodies where disclosure is required or justified.
Pinewood Psychology also uses service providers to support the operation of the practice, including secure practice-management, Microsoft 365/email and cloud-storage, website, accounting and administrative services.
Where another organisation processes information on behalf of Pinewood Psychology, appropriate data-protection arrangements are used where required.
There may be circumstances where confidentiality needs to be broken because of a serious safeguarding concern or legal requirement. Wherever reasonably possible and appropriate, this would be discussed with you.
Autism and ADHD assessments
Assessment may involve obtaining information from other people, such as a parent, partner, family member, school or another professional.
Where appropriate, you will be informed about the information being requested and how it will contribute to the assessment.
Assessment may also involve working with other appropriately qualified clinicians. Relevant information may be shared within the assessment team where necessary to complete the assessment and reach an appropriate clinical conclusion.
Professional contacts and organisations
Pinewood Psychology may occasionally contact professionals and organisations where I reasonably believe that psychological training, consultation or another professional service may be relevant to their work.
Professional information used for this purpose may include a person’s name, job title, organisation and professional contact details. This information may have been obtained from publicly available professional sources, such as an organisation’s website.
Where appropriate, I rely on the legitimate interests of Pinewood Psychology in developing and communicating relevant professional services. Contact is targeted rather than indiscriminate.
You have the right to object to the use of your personal information for direct marketing at any time. If you ask not to receive further marketing communication, your details may be retained on a suppression list solely to ensure that your preference is respected.
Website enquiries and cookies
If you contact Pinewood Psychology through the website, I will use the information you provide to respond to your enquiry and, where relevant, arrange services.
Please avoid including highly sensitive or detailed clinical information in an initial website enquiry unless it is necessary.
The website may use cookies or similar technologies necessary for its operation. Where non-essential cookies or analytics technologies are used, appropriate information and choices will be provided where required.
How your information is stored and kept secure
Clinical and administrative information may be stored electronically using secure systems, including WriteUpp and password-protected Microsoft 365/OneDrive storage where appropriate.
Handwritten or electronic working notes may also be made during psychological work. Paper records are stored securely with access restricted.
Where information from working notes needs to form part of your clinical record, relevant information may be transferred to the appropriate clinical record or report.
I take appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure. Third-party services used to process or store personal information are selected with consideration of their data-protection and security arrangements.
How long I keep information
Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected and to meet relevant professional, regulatory, insurance, tax and legal requirements.
Clinical records may need to be retained for a period after psychological work has ended in accordance with applicable professional, legal and insurance requirements. Different retention periods may therefore apply to different types of information.
Information that is no longer required will be securely deleted or destroyed where appropriate.
International transfers
Some technology providers may process or store personal information outside the UK.
Where personal information is transferred internationally, appropriate steps will be taken to ensure that the transfer complies with UK data-protection law and that appropriate safeguards are in place where required.
Your rights
Depending on the circumstances, you may have rights including the right to access personal information held about you; request correction of inaccurate information; request erasure or restriction in certain circumstances; object to certain uses of your information; and receive certain information in a portable format where applicable.
Where processing is based on consent, you can withdraw that consent.
These rights are not absolute and may depend on the circumstances and the lawful basis on which your information is being processed.
You have an absolute right to object to your personal information being used for direct marketing.
To exercise your rights, please contact hannah@pinewoodpsychology.com.
Concerns or complaints
If you have concerns about how Pinewood Psychology uses your personal information, please contact me in the first instance so that I can try to resolve the issue.
You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.
Information Commissioner’s Office
Changes to this privacy notice
This privacy notice may be updated from time to time to reflect changes to Pinewood Psychology’s services, systems or legal obligations.