Effective date: 14 September 2026

 

This Privacy Policy explains how Blue Skies Psychology Limited collects, uses, stores and protects personal information when providing psychological therapy, psychological assessment, professional supervision and related services.

​

1. Who we are

Blue Skies Psychology Limited (“Blue Skies Psychology”, “we”, “us” or “our”) is a private psychology practice based in Scotland. Blue Skies Psychology Limited is the organisation responsible for the personal information it processes in connection with its practice.

For data protection enquiries, please contact dataprotection.blueskies@proton.me.

​

2. Information we collect

Depending on the service provided, we may collect and process:

• identifying and contact information, such as name, address, date of birth, telephone number and email address;

• GP details and emergency contact information where relevant;

• information provided during an enquiry, referral or initial contact;

• information about health, psychological wellbeing, mental health, neurodevelopmental needs, physical health and relevant treatment history;

• assessment information, clinical notes, formulations, reports, correspondence and professional opinions;

• questionnaires and outcome measures, including PHQ-9 and GAD-7 where used;

• appointment and attendance information;

• information relating to insurance or third-party funding;

• payment and invoicing information; and

• information necessary to provide online or other electronic services.

 

For people who make an enquiry but do not become clients, we may retain limited information while the enquiry is being dealt with. Once the enquiry has been dealt with and there is no ongoing reason to retain the information, it will normally be securely deleted or destroyed.

For professional supervision clients, we may process contact details, supervision arrangements, invoices and information discussed in supervision, including professional or clinical information where relevant.

​

3. How we collect information

We may collect information directly from you through enquiries, intake forms, consultations, appointments, correspondence, questionnaires, telephone calls and other communications. We may also receive information from referring professionals, insurers, employers or other organisations where this is relevant to providing services and lawful to do so. We will normally explain what information we need and why we need it at the point at which it is collected.

​

4. How we use information

We use personal information as necessary to:

• respond to enquiries and arrange appointments;

• assess your needs and provide psychological therapy, assessment or supervision;

• maintain appropriate clinical and professional records;

• communicate with you about appointments and services;

• administer payments, invoices and insurance arrangements;

• meet professional, regulatory and legal obligations;

• maintain the security and effective operation of the practice;

• manage referrals to appropriate independent associate psychologists where relevant; and

• deal with complaints, incidents, legal matters and requests concerning personal information.

 

We do not use clinical information for marketing purposes.

​

5. Lawful bases for processing

We process personal information only where there is a lawful basis under UK data protection law. Depending on the circumstances, this may include:

• performance of a contract or taking steps at your request before entering into a contract;

• compliance with a legal obligation;

• our legitimate interests in operating and administering a professional healthcare practice, where those interests are not overridden by your rights and interests; and

• consent, where consent is the appropriate lawful basis for a particular activity.

 

Where we rely on consent, you may withdraw it at any time, although this will not affect processing that was lawful before withdrawal.

​

6. Health and other special category information

Information about health and psychological wellbeing is special category personal data under UK GDPR and receives additional protection.

Where we process health information for the provision of psychological care, assessment or related professional services, we identify an appropriate Article 6 lawful basis and an applicable Article 9 condition for processing special category data, together with any additional safeguards required by UK law.

We only process information that is relevant and necessary for the service being provided.

​

7. Confidentiality

Psychological services are provided subject to professional duties of confidentiality. We take reasonable and appropriate steps to keep personal information confidential. Confidentiality is not absolute. Information may need to be disclosed where required by law, where necessary to protect someone from serious harm, for safeguarding purposes, or in other circumstances where disclosure is lawful, necessary and proportionate. Where practicable, we will discuss significant disclosures with you in advance. This may not be possible where doing so would increase risk or otherwise conflict with a legal or professional obligation.

​

8. Sharing information with other professionals

We do not routinely send clinical reports or letters to GPs or other professionals.

Where you request a report, letter or other communication to another professional, we will normally seek your agreement before sharing it and may charge for preparation of reports or letters where applicable.

Information may be shared without your consent where there is a lawful basis to do so, for example where there is a significant risk of harm, a safeguarding concern, or a legal requirement. Any disclosure will be limited to information that is relevant and necessary.

​

9. Insurers and third-party funding

Where your psychological services are funded by an insurer or other third party, we may need to share information necessary to administer the funding arrangement, verify eligibility, obtain authorisation, submit invoices or otherwise provide the service.

The amount of clinical information shared will be limited to what is necessary for the relevant purpose and permitted under the applicable arrangement.

​

10. Jane App

We use Jane App as a practice management system. It may be used for appointment booking and management, client intake forms, consent to terms and conditions, electronic signatures, questionnaires and outcome measures, appointment reminders, enquiry and insurance information, payment-related administration and, where appropriate, clinical information and digital clinical notes.

Jane states that UK and European customer data is stored in a regional data centre in London and that data is encrypted in transit and at rest. Jane provides individual user accounts and supports additional security measures such as two-step verification.

Certain Jane features may involve temporary processing by service providers outside the UK, including services used for SMS communications and certain other functionality. We take this into account when deciding which Jane features to use and how information is processed.

Jane acts as a service provider for the data held within the practice system. Blue Skies Psychology remains responsible for determining what client information is collected, why it is used, who may access it and how long it is retained.

​

11. Online appointments

Where online appointments are provided through Jane or another approved platform, the service may process technical information necessary to establish the connection. We do not routinely record or store therapy, assessment or supervision sessions.

Online consultations should take place in a private environment where possible.

​

12. Email and electronic communications

We use Proton Mail Business for practice email. Email is used for enquiries, appointment administration, clinical correspondence where appropriate and other practice communications. Email is not guaranteed to be completely secure, so please consider the nature of information sent by email. We may use WhatsApp for communication where appropriate. Please be aware that electronic communications involve inherent security and privacy risks.

​

13. Telephone and WhatsApp

We may communicate with clients by telephone and WhatsApp using a business mobile phone where appropriate for appointment and practice communication. We will not normally use WhatsApp as the primary location for storing detailed clinical records.

​

14. Website contact and cookies

Our website www.blueskiespsychology.co.uk  is hosted by Wix. We may collect personal information when you use the website, for example when you submit an enquiry through our contact form. This may include your name, contact details and any information you choose to include in your message.

Information submitted through the website is used to respond to your enquiry or arrange an appointment. We do not ask you to provide detailed clinical or health information through the website contact form and would ask you not to include sensitive clinical information in an initial website enquiry.

Our website may also use cookies and similar technologies. Cookies are small files or pieces of data stored on your device or accessed by your browser. They may be used to help the website operate, maintain security, remember preferences and, depending on the features enabled on the website, understand how the website is used.

​

Wix Content Management System (CMS) uses essential cookies or similar technologies that are necessary for the operation of the website. Our website also contains a Google Maps component, which Wix has identified as an analytics-related component. Where cookies or similar technologies are not strictly necessary for the operation of the website, we will obtain your consent before they are used, where required by law.

We do not use Google Analytics as a separate analytics service.

​

Where a cookie consent banner is provided, you can choose whether to allow non-essential cookies and similar technologies. You can change your cookie preferences through the available cookie settings. You can also manage or delete cookies through your web browser settings, although disabling some cookies may affect how the website functions.

​

15. Invoices and payments

Payments are generally made by bank transfer. We may also use PayPal or GoCardless.

FreeAgent is used for invoicing and financial administration. Financial records may need to be retained for longer than clinical records where required by tax, accounting or other legal obligations.

​

16. Professional supervision

The psychologist(s) working within Blue Skies Psychology undertake regular professional and clinical supervision in accordance with relevant professional and regulatory requirements.

​

Supervision may involve discussion of clinical cases and, where necessary, relevant personal information about clients. Information shared in supervision is limited to what is necessary for appropriate professional supervision and is treated as confidential. Where possible, identifying information is minimised or anonymised when clinical cases are discussed. Supervision records are stored securely and are subject to appropriate confidentiality and data protection safeguards.

​

17. Independent associate psychologists

Blue Skies Psychology may work with self-employed associate psychologists. Associates may provide psychological therapy, assessment, supervision or other services through the practice.

​

Associates are independent professionals and are expected to maintain their own professional, regulatory, insurance and data protection responsibilities, including appropriate registration with the Information Commissioner's Office where required and their own privacy information.

Blue Skies Psychology may receive enquiries and make appropriate referrals to associates. Depending on the arrangements in place, Blue Skies Psychology may administer appointments and billing, while the associate provides the clinical service and invoices Blue Skies Psychology for their agreed fees.

The precise controller/processor responsibilities of an associate will depend on the actual processing arrangements and contractual terms. We will ensure that appropriate data protection arrangements are in place and that clients are informed where another independent professional is responsible for their clinical processing.

​

18. Virtual assistant and administrative support

Blue Skies Psychology uses the services of a virtual assistant to provide administrative and other support to the practice.

Where the virtual assistant processes personal information on behalf of Blue Skies Psychology, they act as a data processor and process information only for authorised purposes and in accordance with the instructions of Blue Skies Psychology.

​

Their duties may include:

• entering or updating information within Jane App;

• assisting with practice administration and appointment-related information;

• assisting with the preparation or typing of clinical correspondence and letters at the direction of the psychologist;

• assisting with the preparation of clinical formulation diagrams;

• assisting with invoicing and financial administration; and other administrative tasks required to support the operation of the practice.

 

In carrying out these tasks, the virtual assistant may have access to personal information and, where necessary for the task, special category information relating to clients. Access is limited to the information reasonably required to carry out the particular task.

The virtual assistant has an individual user account within Jane App and does not use the psychologist's login credentials. Access to practice systems is managed by Blue Skies Psychology and is restricted according to the requirements of their role.

The virtual assistant is subject to appropriate confidentiality and data protection obligations and is required to maintain appropriate technical and organisational security measures when processing personal information on behalf of Blue Skies Psychology.

 

Blue Skies Psychology has appropriate contractual arrangements in place governing the processing of personal information by the virtual assistant, including requirements relating to confidentiality, security, use of information, data breaches and deletion or return of information when appropriate.

The virtual assistant is registered with the Information Commissioner's Office where registration is required for her own business activities. However, ICO registration does not itself determine whether an individual or organisation is a controller or processor. For client information processed on behalf of Blue Skies Psychology, their role is determined by the nature of the processing and the arrangements between them and Blue Skies Psychology.

Blue Skies Psychology remains responsible for ensuring that personal information processed on its behalf is handled appropriately and securely.

 

19. Use of artificial intelligence

Blue Skies Psychology does not currently use artificial intelligence tools to process identifiable clinical information.

If AI or other automated/digital note-taking tools are introduced in future, any use involving personal or special category information will be subject to appropriate data protection assessment, contractual safeguards, security measures and professional considerations before use.

Identifiable clinical information will not be entered into an AI system unless the processing has been appropriately assessed and is lawful and suitable for the service being provided.

​

20. Other data processors and service providers

We use trusted third-party service providers where necessary to operate the practice. These may include Jane App, Wix, Proton Mail, FreeAgent, payment providers, accountants, communications providers, professional IT providers and our virtual assistant.

Where a third party processes personal information on our behalf, we will take appropriate steps to ensure that there is a suitable legal and contractual framework, that information is used only for authorised purposes, and that appropriate confidentiality and security measures are in place.

 

21. Retention of information

Clinical records and associated personal information are normally retained for seven years from the date of the client's last contact with Blue Skies Psychology. At the end of the retention period, records will be securely destroyed or deleted, subject to any continuing legal, regulatory or other lawful reason to retain particular information. Information relating to an enquiry that does not result in the person becoming a client will normally be securely deleted or destroyed once the enquiry has been dealt with and there is no ongoing reason to retain it.

Financial and accounting records may be retained for periods required by tax, accounting or other legal obligations.

​

22. Information security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Paper clinical records are stored in a locked filing cabinet within a locked room. Electronic information may be stored on password-protected devices and within secure practice systems. Access to systems is restricted according to role and individual user accounts are used where available. We regularly review our security arrangements and will take appropriate steps to address identified risks.

 

23. Personal data breaches

If a personal data breach occurs, we will assess the incident promptly and take appropriate steps to contain and remedy it.

Where required by UK data protection law, we will notify the Information Commissioner's Office and/or affected individuals within the applicable timescales.

 

24. Your data protection rights

Subject to applicable legal exemptions, you may have rights under UK data protection law including the right to:

• request access to your personal information;

• request correction of inaccurate or incomplete information;

• request erasure in certain circumstances;

• request restriction of processing in certain circumstances;

• object to certain processing, including processing based on legitimate interests;

• request data portability where applicable; and

• withdraw consent where processing relies on consent.

 

Some rights are subject to exemptions and may not apply in every circumstance, particularly in relation to professional or legal obligations and clinical records.

​

25. Access to clinical records

You can request access to personal information held about you. Requests should be made to dataprotection.blueskies@proton.me.

We will verify your identity where appropriate and respond within the timescale required by applicable data protection law. In some circumstances, information may be withheld or redacted where a legal exemption applies.

 

26. Complaints

If you have concerns about how Blue Skies Psychology has handled your personal information, please contact us first at dataprotection.blueskies@proton.me so that we can investigate and try to resolve the matter.

You also have the right to complain to the Information Commissioner's Office, the UK's independent supervisory authority for data protection.

Information Commissioner's Office. Helpline: 0303 123 1113. Website: https://ico.org.uk/ 

 

28. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, systems, legal requirements or data protection practices.

The current version will be made available on our website and will show the date on which it was last updated.

​

Last updated: 14 September 2026