Sudworth Psychology Data Protection Complaints Policy

Our commitment to your privacy

Sudworth Psychology believes that it is paramount to protect your personal information as it is an integral part of working relationship. Confidentiality, transparency, respect, care, and trust are at the heart of effective therapy, and Sudworth Psychology takes responsibility to safeguard your data just as seriously as we take our work together.

This statement explains, in plain terms, what information we collect, why it is needed, and how Sudworth Psychology looks after it. If you have any questions after reading this, please do ask — Sudworth Psychology wants you to feel completely comfortable.

When you work with Sudworth Psychology, we collect and keep the following types of information:

Your name and contact details (address, phone number, email)
Details about the issues you'd like to work on
Notes from our sessions together
Relevant medical or health history that helps inform our work
Emergency contact information
Payment and invoice details

Why Sudworth Psychology collects this information

Sudworth Psychology needs to collect and use your information so that we can provide you with Psychological interventions and treatment. There are specific legal reasons that allow us to do this under UK data protection law:

For general personal information: We rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. In simpler terms, Sudworth Psychology needs this information to fulfil our agreement to provide you with therapy.

For health-related information: Because therapy involves sensitive information about your mental and physical health, Sudworth Psychology relies on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional legal condition I meet is DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care).

Professional obligations and supervision

As a Psychologist, I am required to discuss my clinical work in professional supervision. This helps me maintain high standards, that any treatment or intervention is safe, and ethical, and ensures you receive the best possible care.

Your identity is always protected in supervision. Sudworth Psychology uses non identifiable and limited information about you within supervision. We work only with anonymised case material — meaning any supervisor hears about the therapeutic work without knowing who you are. My supervisors are also bound by their own professional body's strict confidentiality obligations.

Clinical will arrangements

I have appointed a Clinical Executor — a trusted fellow Psychologist — who would step in to manage my professional responsibilities if I were to become seriously ill or die unexpectedly. In such circumstances, this person would contact you to let you know what has happened and would handle your records with the same confidentiality that Sudworth Psychology provides. This arrangement ensures you would not be left without information or support, and that your records would remain protected.

Who else may see your information

Beyond Sudworth Psychology and my clinical supervisors (who receives anonymised information only), the following may have limited access to some of your information:

External bookkeeper: My bookkeeper has access to invoice data only (your name and payment amounts) for accounting purposes. They do not see your session notes or clinical information.

Service providers: I use the following third-party services to run my practice and website:
Wix — hosts my website
Mettle — processes payments
Microsoft teams — provides secure video sessions
Bilateral Base — supports therapeutic work

Each of these providers processes limited data on my behalf and has their own privacy policies. You can ask me for more details about any of them.

Statutory authorities: In rare circumstances, I may be legally required to share information with authorities — this is explained below.

When Sudworth Psychology may need to break confidentiality

Sudworth Psychology will always try to keep what you share with us confidential. However, there are rare situations where we may need to share information without your permission:

If we believe there is a serious risk of harm to you or someone else
If there are concerns about the safety of a child or vulnerable adult
If we receive a court order requiring me to disclose information
If you take any legal action against Sudworth Psychology

Wherever possible, Sudworth Psychology will discuss this with you first and explain what we need to do and why.

How long your records are kept

Sudworth Psychology keeps your therapy records for 7 years after our last session together. This timeframe is in line with the Limitation Act 1980 and standard professional indemnity insurance requirements. All our records are kept digitally. They are encrypted and password-protected on secure systems, with access restricted only to Dr. Sudworth. At the end of the retention period, records are securely deleted.

Your rights

You have clear rights over your personal information. Here's what you can do:

See your records — You can ask to see what information Sudworth Psychology holds about you
Correct mistakes — If anything is inaccurate, you can ask Sudworth Psychology to put it right
Request deletion — You can ask Sudworth Psychology to delete your information, though we may need to keep some records for legal, insurance, or safety reasons
Restrict processing — You can ask Sudworth Psychology to limit how we use your information in certain circumstances
Receive your data — You can request a copy of your information in a portable format
Object — You can object to certain types of processing
Withdraw consent — Where Sudworth Psychology relies on your consent for something specific, you can withdraw it at any time

Sudworth Psychology will always respond to any request as quickly as possible, and within one month.

What Counts as a Data Protection Complaint?

A data protection complaint is any expression of dissatisfaction about how we have collected, shared, stored, used, or protected your personal data. You do not need to use legal language. If something worries you, you can tell us in your own words.

How You Can Make a Complaint

You can make a complaint in any format - email, phone, letter, or in person.

Please contact Dr. Chera Sudworth at info@sudworthpsychology.com

Include a brief description of what has happened and why you are concerned. You do not need to cite legislation or provide evidence at this stage.

What Happens Next

Step 1 - Acknowledgement

We will acknowledge your complaint within 30 days, as required by the Data (Use and Access) Act 2025. We will acknowledge that we have received your complaint and will explain what will happen next.

Step 2 - Investigation

We will investigate your complaint without undue delay. This may include:

checking our records and systems
reviewing the information you have provided
assessing whether our data handling complied with the law

Step 3 - Keeping You Informed

If the investigation takes time, we will keep you updated so you know what is happening and when you can expect a full response.

Step 4 – Outcome

We will communicate the outcome without undue delay.
Our response will explain:

what was found during the investigation
any steps we have taken or will take in relation to the investigation
any changes we will make to improve our practices as a result of the investigation

Where appropriate, this may include correcting or deleting data, updating our processes, or offering an apology.

If You’re Not Satisfied

If you are not satisfied with Sudworth Psychology’s response or how we have handled your complaint, you can escalate your concern to the Information Commissioner’s Office (ICO): www.ico.org.uk

You do not need to come back to us first, but we encourage you to give us the opportunity to resolve the issue in the first instance.

Record‑Keeping and Learning

Sudworth Psychology will keep a log of all data protection complaints, including the actions taken and outcomes reached. We use this information to improve our processes and strengthen our data protection practices.

Review of This Policy

Sudworth Psychology will review this policy regularly to ensure it remains accurate, accessible, and compliant with current legislation and ICO guidance.