Privacy policy

Version: 2.0 | Effective date: 5 October 2026

In brief

Your information is held securely and confidentially, and seen only by the people involved in your care.
Your own psychologist is responsible for your clinical records; the practice handles the admin around them.
We never sell your data, and we never advertise to you.
You can ask to see, correct or delete your information at any time, and we respond within a month.
AI never makes decisions about you. Our AI ethical use policy explains exactly how AI is and is not used.
Any questions or worries, email [email protected]. You can also go to the ICO at any time.

Introduction
Who is the data controller?
Information we collect
Lawful basis for processing your data
How we use your information
Data sharing and confidentiality
The systems we use
International transfers
Data security
How long we keep your information
Your rights
Automated decision-making
If something goes wrong
Cookies
Third-party websites
Children and young people
Contact and complaints
Changes to this policy

1. Introduction

This policy explains how we, Thriving Minds Collective Ltd (trading as The Bromley Psychologists, Company No. 16358249), collect, use and protect your personal information in the course of providing psychological therapy services. We have written it to be clear and readable rather than legalistic, because you should be able to understand exactly what happens to your information without a law degree.

2. Who is the data controller?

Thriving Minds Collective Ltd is the data controller for information collected and processed in connection with practice administration, including handling enquiries, sending initial communications, and managing bookings through our practice systems. Our Clinical Director, a director of Thriving Minds Collective Ltd, is responsible for overseeing data protection compliance on behalf of the practice. Thriving Minds Collective Ltd is registered with the Information Commissioner’s Office, registration ZB902327.

When you engage with an associate clinical psychologist for clinical services, your psychologist becomes the data controller for the personal data they collect and process in the course of therapy. Each psychologist is individually responsible for their clinical records, maintains their own privacy policy, and is separately registered with the ICO. Thriving Minds Collective Ltd does not act as the central data controller for clinical records: all clinical information and records are the sole responsibility of the individual psychologist you work with.

Shared access to client records

All our psychologists securely store client information in Halaxy, a GDPR-compliant practice management system used for session notes, appointment scheduling and record-keeping. Individual psychologists cannot access each other’s client records. As practice owner, our Clinical Director has full administrative access to the practice systems, which is used only for operational purposes, such as managing enquiries, appointments and invoicing, and for keeping the service safe and running properly.

Digital tools and AI

Some psychologists may, with your explicit consent, use supplementary digital tools such as Heidi, an AI-assisted medical scribe that helps clinicians write up sessions accurately. No audio is ever stored: speech is processed in real time and discarded immediately after transcription, and your psychologist reviews and approves every note before it is saved to your record. Heidi is used in NHS services to reduce admin time and improve clinician focus, and your psychologist will always ask for your consent before using it. Some psychologists also write up their notes by dictating their own summary of the session into an approved AI note tool, such as Heidi Health, after the session has ended, without your name or identifying details. The tool does not listen to or record your session, so we do not ask for separate consent, but if you would prefer your psychologist did not do this, just let them know.

Our full AI ethical use policy explains everything about how AI is and is not used in this practice, in plain English. The short version: AI helps with paperwork, never with decisions about your care, and nothing AI-related happens in your sessions without your consent.

3. Information we collect

A. Personal data

Name, address, phone number and email address
Date of birth
GP contact details (if provided)

B. Sensitive personal data (special category data)

Health information relevant to therapy
Therapy session notes and assessments
Referral details and treatment history

Questionnaires and structured information

As part of assessment and therapy we may ask you to complete questionnaires that help us understand your experiences, difficulties and background. These may include mood and wellbeing questionnaires, background information such as family relationships and early development, and details about the mental and physical health of family members where relevant. We collect this only with explicit consent and store it securely within Halaxy or another GDPR-compliant system used by your psychologist.

What we need, and what is optional

Some information is essential for us to work with you safely, such as your contact details and health information relevant to your therapy. If you prefer not to share something essential we will talk it through with you, though it may limit what we can safely offer. Anything beyond that is optional, and choosing not to share it never affects the care you receive.

C. Website, analytics and payment data

Our get-started questionnaire: if you complete the questionnaire on this website, we collect your name, contact details and the information you choose to give us, so the right psychologist can be found for you. Your answers go directly to our clinical team.

Payments: payment for therapy is typically made by online bank transfer directly to your psychologist or to Thriving Minds Collective Ltd. Some psychologists or services may also offer card payment through a secure third-party payment processor (Stripe). With your consent, a card can also be saved on file when you register, in case of missed payments or late cancellations under our cancellation policy. Saved cards are held securely by Stripe, never by us: we cannot see your full card details, and every transaction is processed under Stripe’s data security standards.

Website analytics: we use Google Analytics 4 to understand how visitors use our website. It does not identify you, and it only loads if you accept analytics cookies. See our cookie policy for the detail.

Independent clinical psychologists and data responsibilities

All clinical psychologists delivering services through The Bromley Psychologists operate as independent sole traders. They are individually responsible for ensuring the security and confidentiality of client information they manage, in compliance with GDPR.

4. Lawful basis for processing your data

Under UK GDPR we must have a lawful basis for processing personal data. The bases relevant to our work are:

Consent: when you give consent for us to process your data, for example for referrals you request or optional tools.
Contractual necessity: processing needed to provide your therapy and manage your appointments.
Legal obligation: when required by law, for example safeguarding duties or financial record-keeping.
Legitimate interests: the day-to-day running of the practice and maintaining high-quality services.

Health information is special category data, and we process it under Article 9(2)(h) of UK GDPR (provision of healthcare, under a duty of confidentiality) and, where relevant, your explicit consent.

5. How we use your information

We use your data to:

Provide therapy and maintain appropriate clinical records.
Manage appointments and communicate with you.
Where relevant, process payments securely.
Comply with legal and ethical obligations, such as safeguarding.

We never sell your data. We never advertise to you. The only marketing-type contact we will ever make, such as inviting you to leave a review after therapy ends, happens with your agreement.

Information about you is stored securely and treated as confidential. It will not be shared with others except in specific circumstances:

With your consent: if you ask us to share information with another professional, for example letters to GPs or psychiatrists, or reports for insurers.

Legal or safeguarding obligations: if there is a risk of harm to you or others, or when we are legally required to disclose information. Wherever possible we would discuss this with you first.

When working as part of a multidisciplinary team, for example if you are referred through a service.

Obtaining information from other agencies: with your explicit consent, we may obtain information from others involved in your care, such as your GP or previous mental health workers, where useful for your treatment.

Client referrals to associates: if you consent to being referred to one of our associates, we share your contact details and the relevant information from your enquiry and get-started questionnaire, plus details of any appointments booked, unless you ask otherwise.

Administrator access: to support the running of the practice, an administrator has access to emails and our practice systems. They work under a confidentiality agreement and only access what is necessary for tasks such as managing appointments, invoices and enquiries.

7. The systems we use

Everything that holds your information is chosen for security and bound by data processing agreements and appropriate safeguards:

Halaxy (practice management): appointments, clinical records and invoicing. Encrypted, EU-hosted, acting as a data processor.
Our practice dashboard (practice-owned software): we operate our own secure dashboard for appointment management, enquiries and practice administration. It is practice-owned software rather than a third-party service, and it runs on secure servers in the UK. Clinical notes and personal details held in it are encrypted, access is role-based (clinicians see only their own clients), and clinical records are also maintained in Halaxy.
Stripe (payments): card payments and secure card-on-file where offered. Saved cards are held by Stripe, never by us, and are only charged in line with our booking and cancellation policy.
Google Workspace (email and documents): our email and documents are protected by Google’s security and encryption under Google’s own terms. As with any email provider anywhere, email as a medium is never completely secure end to end, so we suggest keeping deeply personal detail for your sessions rather than email.
Cloudflare (website and get-started questionnaire): hosts this website and processes your enquiry when you submit the get-started questionnaire.
Google Meet, Zoom or Microsoft Teams (online sessions): encrypted and GDPR-compliant, and sessions are never recorded. Most of our psychologists use Google Meet, which is part of our Google Workspace and covered by Google’s security and encryption under Google’s own terms. You can review the Google privacy policy, the Zoom privacy statement and the Microsoft privacy statement.
AI-assisted administration: AI tools help our team run the practice behind the scenes, covered in full in our AI ethical use policy. Client data is never used to train AI models.
Encrypted backups: practice data is backed up regularly to secure storage to protect against loss.

8. International transfers

We keep data in the UK or EEA wherever possible. Where a provider processes data outside the UK, such as Google, Stripe, Cloudflare or Anthropic, transfers rely on UK GDPR-approved mechanisms: the UK-US Data Privacy Framework or Standard Contractual Clauses with the UK addendum.

9. Data security

Encrypted storage of clinical records, in Halaxy and in our own practice systems.
Role-based access: your psychologist controls access to your clinical data, and practice staff see only what their role requires.
Secure, private settings for all online therapy, with no session recording.
Secure disposal of information at the end of its retention period.

10. How long we keep your information

Therapy records: kept for 7 years after the last session.
Financial records: 6 years from the end of the financial year they relate to, as HMRC requires.
Enquiries: if you contact us but do not go on to have therapy with us, we remove your name, contact details and everything you told us from our practice dashboard six months after your enquiry is closed. We keep only anonymous details, such as the date and how you found us, so we can understand how the service is used.
Website analytics: kept for Google’s standard retention period, without identifying you.

After the retention period, records are securely deleted.

11. Your rights

Under UK GDPR you have the right to:

Access: request a copy of the information we hold about you (a subject access request).
Rectification: ask us to correct anything inaccurate.
Erasure: ask us to delete information, subject to the legal and professional duty to retain clinical records for the periods above.
Restriction and objection: restrict or object to certain processing.
Portability: receive your data in a portable format.
Withdraw consent: at any time, without affecting your care.

To exercise any of these rights, email [email protected]. We will respond within one month. If your request is complex we may extend this by up to two months, and we will tell you if so. There is no charge.

12. Automated decision-making

We do not make any decision with legal or similarly significant effect about you by automated means. Administrative automation, such as appointment reminder emails, never affects your access to care or any clinical decision. Our get-started questionnaire is a structured set of questions, not AI, and a member of our clinical team reviews your answers.

13. If something goes wrong

If a personal data breach occurs we investigate immediately, record it, and report to the Information Commissioner’s Office within 72 hours where the legal threshold is met. If a breach is likely to put you at high risk we will tell you directly and promptly: what happened, what information was involved, and what we are doing about it. If you ever suspect a problem with your data, contact us and we will investigate.

14. Cookies

This website keeps your cookie banner choice in your browser’s local storage, uses Google Analytics only if you accept it, and uses Cloudflare Turnstile on the get-started questionnaire to check that a person is sending it. We do not use advertising or marketing cookies. You can change your choice at any time with the “Manage cookies” link at the bottom of every page, and the full detail, including how long each cookie lasts, is in our cookie policy.

15. Third-party websites

Our website may link to third-party websites and services. We are not responsible for their content or practices, and their handling of your data is governed by their own privacy policies, which we recommend reviewing.

16. Children and young people

Our services are for adults aged 18 and over, and this website is not aimed at children. We do not knowingly collect personal data from children through the website. If we become aware that a child has provided personal data through our website, we will delete it promptly.

17. Contact and complaints

Questions or concerns about this policy, or about how your information has been handled, can be sent to [email protected].

We take every concern seriously, will acknowledge you promptly, and will investigate and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office at any time, whether or not you have raised it with us first: ico.org.uk, 0303 123 1113.

18. Changes to this policy

We update this policy when our systems or the law change. The version number and effective date at the top always tell you what is current, and we will communicate significant changes clearly. This version (2.0) replaces the version dated 9 September 2026.