Privacy Notice

1. About this notice

Asteria Psychology (“Asteria”, “we”, “us” or “our”) is committed to protecting personal information and respecting confidentiality. This notice explains what information we collect through our website, why we use it, the lawful bases we rely upon, who may receive it, how long we keep it, and the rights people have.

It applies to website visitors, people who contact us, people who submit or are named in a referral, mailing-list subscribers, workshop or event participants, and people making other website-based enquiries.

If you become a client of Asteria, we will provide a separate Client Privacy Notice explaining how we handle clinical notes, correspondence, therapy records, risk information and other information created or received during psychological care.

This notice is written with reference to the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and other applicable UK data-protection law, as amended from time to time.

2. Glossary

3. Who we are and who controls your information

Asteria Psychology is a UK clinical psychology practice. For the website and referral activities described in this notice, Asteria Psychology determines why and how personal information is used and acts as the controller.

For privacy questions, requests or concerns, email admin@asteriapsychology.com.

Our Clinical Psychologists are subject to professional confidentiality and applicable professional and regulatory standards.

4. Our privacy principles

We will:

• collect only information that is relevant and reasonably necessary;
• explain why information is needed and how it will be used;
• take particular care with health and other sensitive information;
• limit access to people who genuinely need it for their role;
• use suitable contracts and safeguards when suppliers process information for us;
• keep information only for an agreed and justifiable period;
• maintain appropriate security, confidentiality and incident-management arrangements;
• be transparent about significant changes to how information is used; and
• respect people’s data-protection rights.

We will not:

• sell, rent or trade personal information;
• use referral or clinical information for advertising;
• add somebody to a marketing list simply because they contacted us or made a referral; or
• make solely automated decisions about whether somebody may receive psychological support.

5. Information we may collect

Information you provide directly

• name, contact details and communication preferences;
• the identity and relationship of a person submitting a referral for somebody else;
• the reason for referral and the type of support being sought;
• physical or mental-health information, disability or neurodivergence information;
• family, relationship, cultural, religious or community circumstances;
• ethnicity, language or accessibility information where relevant and voluntarily provided;
• information about previous or current healthcare or professionals involved;
• workshop, booking, payment or invoicing information, where applicable;
• mailing-list preferences; and
• information contained in emails, documents or other communications sent to us.

Information obtained from another person or organisation

We may receive information from a GP, healthcare professional, employer, insurer, family member, supporter, advocate, organisation or another person submitting a referral. This may include contact details, referral reasons, health information and information about the referrer’s relationship to the person concerned.

Where we receive personal information from another source, we will provide the person concerned with appropriate privacy information within the legally required period, normally at first contact and no later than one month, unless a lawful exception applies.

Information collected through the website

• IP address and security logs;
• browser, device and operating-system information;
• pages visited, referral source and website interaction information;
• cookie and consent choices; and
• information needed to diagnose technical problems and protect the website.

Non-essential analytics information is collected only where the relevant cookie or similar technology has been accepted.

6. How and why we use information

The table below summarises the main purposes and lawful bases we use. More than one basis may apply where the same information is needed for different purposes.

7. Health and other special-category information

Referral and enquiry information may include health, disability, neurodivergence, ethnicity, religion or other information that receives additional protection under data-protection law.

Where processing is necessary to assess or provide psychological care, we rely on Article 9(2)(h) of the UK GDPR for health or social care, together with the relevant UK-law condition and professional-confidentiality safeguards. We use only the information reasonably necessary for the relevant purpose.

The privacy-notice checkbox on our referral form records that the person has been shown and has read this notice. It is not intended to act as blanket consent for all processing.

Please do not include a complete clinical history in a general website message. The referral form should be used to provide only enough information for us to understand the request and decide the appropriate next step.

8. Referrals concerning another person

A person submitting information about somebody else must be authorised to do so and should provide only information that is relevant and necessary. Where appropriate, the person concerned should know that the referral is being made.

We may contact the person concerned to provide this notice, verify the referral and obtain additional information. We may also contact the referrer where clarification is required.

A referral does not guarantee that Asteria can offer an appointment or service. If Asteria is not suitable, we may explain this and provide general signposting where appropriate.

There is generally no statutory obligation to submit information through the website. However, if required information is not provided, we may be unable to respond, assess the referral, administer a booking or provide the requested service.

9. Who may receive or process information

Access is limited to people and organisations that need the information for an appropriate purpose. These may include:

• Asteria’s Clinical Psychologists and authorised administrative support;
• website hosting, website management, form, backup and security providers;
• email, secure storage, booking, payment, video-consultation and practice-management providers, where used;
• professional supervisors or consultants, where clinically appropriate and subject to confidentiality;
• accountants, legal advisers, insurers and other professional advisers;
• healthcare professionals, referrers or organisations involved in care, where there is a valid basis to share;
• emergency services, safeguarding bodies, regulators, courts, law-enforcement bodies or public authorities where disclosure is necessary and lawful; and
• a purchaser, successor or professional custodian if the practice is transferred, closed or becomes unable to continue, subject to appropriate safeguards.

Service providers acting as processors are required to handle information only on our instructions, maintain confidentiality and use appropriate safeguards. We do not sell, rent or trade personal information.

10. International transfers

Some suppliers may store information or allow support access from outside the United Kingdom. Where a restricted international transfer occurs, we use an appropriate legal mechanism, such as UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.

You may contact us for further information about the safeguards relevant to a particular service provider.

11. How we protect information

We use proportionate technical and organisational measures, which may include:

• access controls and role-appropriate permissions;
• strong passwords and multi-factor authentication where supported;
• encrypted connections when information is transmitted;
• secure hosting, backups and software updates;
• confidentiality obligations and professional standards;
• data minimisation and separation of website enquiries from clinical records where appropriate;
• supplier due diligence and data-processing agreements; and
• procedures for responding to incidents, data breaches and requests from individuals.

No electronic system can be guaranteed to be completely secure. We respond to suspected incidents promptly and make notifications to affected people and the Information Commissioner’s Office where legally required.

12. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, to meet legal or professional obligations, or to establish, exercise or defend legal claims.

13. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to operate and secure the website. These do not require consent, although we still provide information about them.

We do not place non-essential cookies, such as analytics or marketing cookies, unless a visitor has actively consented through our cookie-preference tool. Visitors can reject optional cookies and can change or withdraw their choices.

Our Cookie Policy identifies the cookies and similar technologies used, their providers, purposes, categories and durations.

Continuing to browse the website is not treated as consent to non-essential cookies.

14. Marketing and mailing lists

We send marketing or optional updates only where the recipient has actively asked to receive them, or another lawful route under electronic-marketing rules clearly applies. Referral and clinical information is not used for marketing.

People can unsubscribe at any time using the link in an email or by contacting admin@asteriapsychology.com. Withdrawal does not affect processing that was lawful before consent was withdrawn.

15. Automated decision-making and artificial intelligence

We do not use information submitted through the website or referral form to make solely automated decisions that have legal or similarly significant effects.

We will not enter identifiable referral or clinical information into a generative artificial-intelligence service unless the proposed use has been specifically assessed, an appropriate contract and lawful basis are in place, and the person has been given any privacy information required.

16. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the following rights. These rights are not absolute and exemptions may apply, particularly where information concerns another person, confidentiality, legal claims, safeguarding or the risk of serious harm.

• Access: ask for a copy of personal information and information about how it is used.
• Rectification: ask us to correct inaccurate information or complete incomplete information.
• Erasure: ask us to delete information in certain circumstances.
• Restriction: ask us to restrict how information is used in certain circumstances.
• Objection: object to processing based on legitimate interests. We will consider the objection and explain whether we have compelling grounds to continue.
• Data portability: receive information provided to us in a structured, commonly used format where the legal conditions apply.
• Withdraw consent: withdraw consent at any time where processing is based on consent, including mailing-list and optional cookie consent.
• Complain: raise a concern with us and complain to the Information Commissioner’s Office.

To exercise a right, email admin@asteriapsychology.com. We may need to verify identity and clarify the request. We will normally respond within one month, although the law permits extensions in some circumstances. We will explain if a right does not apply or if we cannot comply fully.

17. Complaints, external links and contact

Complaints

Please contact us first at admin@asteriapsychology.com if you have a concern about how information has been handled. We will try to resolve the matter.

You may also complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone: 0303 123 1113.

External links

Our website may link to other organisations. We are not responsible for their privacy practices, content or security. Please read the privacy information provided by any external website or service.

Changes to this notice

We review this notice periodically and update it when our services, suppliers, legal obligations or information-handling practices change. The current version will be published on this page with its revision date. Where a change materially affects how existing information is used, we will take reasonable steps to bring it to the attention of affected people before the new use begins.