Privacy Policy

Hello there!

Thank you for checking out our privacy policy. At Claire Wilson Consulting Limited we take our client’s privacy seriously. We’re committed to protecting your privacy and handling your information in a responsible way while you use our website and services. We want you to understand that this is a safe place for you to discuss your feelings and concerns, and we operate in a highly confidential environment. This policy sets out how data is collected and processed through the use of our website and when you use our services.

We encourage you to read this policy alongside any other privacy notices we might provide, so you’re fully in the loop about how and why we use your information.

Who’s in charge of your data?

The controller of your data is Claire Wilson Consulting Limited and we can be contacted on:

Email address: office@drclairewilsonconsulting.com

Not happy with something?

We’re committed to treating your personal data with respect, transparency, and care. If you ever have questions or concerns about how your data is used, we want to hear from you, and we’ll do our best to resolve things quickly and fairly. Under the Data (Use and Access) Act 2025, you have the right to raise a complaint about how your personal data is handled. Here’s how:

Step 1: Email us at office@drclairewilsonconsulting.com with a brief description of your concern. You don’t need to use legal language – just tell us what’s worrying you.
Step 2: We’ll acknowledge your message and respond without undue delay, usually within 10 working days.
Step 3: If you’re not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

What type of data do we collect about you?

‘Personal data’ is information that identifies you. If we’ve removed your identity (by making the data anonymous), it won’t be classed as personal data. We might collect, use, store, and share various types of personal data about you as follows:

Identity details such as first and last name, username or similar identifier, marital status and title, date of birth and gender.
Contact details such as your billing address, email address and telephone number.
Technical information such as your internet protocol (IP address), your login data, browser type, version, browser plug-in types and versions, time zone setting and location, operating system and platform and other technology on the devices you use to access our website.
Financial information such as your bank account and payment card details.
Information about transactions like details about payments to and from you, and other details of services you have purchased from us.
Account details such as your username, password, purchases made by you, and your interests, preferences, feedback and survey responses.
Usage information about how you use our website and services.
Marketing information such as your preferences on receiving marketing from us, along with your communication preferences.
Special Category Data: Includes information about your health, including information about your existing and previous medical health conditions, medication details, psychiatric history and any other relevant health information to enable us to carry out our services to you. Where you have provided explicit consent, this also includes audio and/or video recordings of EMDR therapy sessions, which are processed solely for clinical supervision purposes. We do not collect any other Special Category Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Consents for Health Data: We require your specific consent to process Special Category Data so, when you submit your details, we will ask you to confirm your consent to this processing (for therapy clients).

How do we collect your personal data?

We use different methods to collect data from and about you. The majority of the time, our information is collected directly when you contact us in the following ways:

When you enquire about and/or apply for our services;
When you fill in any new client onboarding forms;
When you complete any forms before or during an appointment;
Verbally during discussions and therapy sessions;
Via audio and/or video recording of EMDR therapy sessions, where you have given your explicit prior consent for the purpose of clinical supervision;
Correspondence with us via post, phone, email or otherwise;
When you subscribe to our service or publications;
When you request marketing communications to be sent to you;
When you enter a promotion or complete a survey; or
When you give us feedback or contact us.

Another method we may use to collect data includes the use of automated technologies or interactions, like website cookies or other similar technologies. This includes information about your equipment, browsing actions and patterns and information about your browsing activity if you visit another website that uses the same cookies as us. This means we receive information about how you use these third-party websites.

This data collection helps us to improve user experience, and to gather information about how you use our website. For more information, please refer to our Cookie Policy, which can be accessed here.

We may also receive data from third-parties such as:

Technical information from Analytics providers such as Google
Advertising networks such as Psychology Today or Counselling Directory if you contacted this way
Search information providers such as Google
Publicly available sources, such as Companies House and the Electoral Register.

What happens if you don’t provide us with the required data?

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services or goods). In this case, we may have to cancel a service or product you have with us but we will notify you if this is the case at the time.

What are the purposes for which we use your personal data?

The purposes for which we will be using your data include:

To register you as a new client.
To provide our services and to process and deliver any orders, including: a) to manage payments, fees and charges and b) to collect and recover money owed to us.
To manage our relationship with you e.g., to notify you about changes to our terms of this privacy policy or to ask you to leave a review and/or take a survey.
To send you relevant marketing information about our services.
To enable you to complete a survey.
To administer and protect our practice and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).
To deliver relevant website content to you and measure or understand the effectiveness of the content we serve to you.
To use data analytics to improve our website, services, marketing, client relationships and experiences.
To make suggestions and recommendations to you about services that may be of interest to you.

We rely on one or more of the following lawful conditions to process your data as outlined above:

To fulfil our contract with you;
For our legitimate interests; or
To comply with legal obligations.

In some scenarios, we’ll ask for your consent, especially for collecting sensitive data. We may process your personal data for more than one lawful reason at a time, depending on the specific purpose for which we are using your data. If you’d like more information on the specific legal ground we are relying on, on occasions where we rely on more than one legal ground, please feel free to contact us.

Our Lawful Basis: Recognised Legitimate Interests

We sometimes process your personal data under what’s called a “recognised legitimate interest”. This is a lawful basis introduced by the Data (Use and Access) Act 2025. This means we use your data in ways that support important public or organisational aims, while respecting your rights and freedoms.

Examples include:

Helping prevent fraud or misuse of our services
Supporting safeguarding and professional standards
Responding to emergencies or protecting wellbeing
Improving accessibility and inclusion in our resources

We always carry out a balancing test to make sure our interests don’t override yours. You have the right to object to this type of processing at any time, and we’ll explain your options clearly.

If you’d like to know more or raise a concern, just email us at office@drclairewilsonconsulting.com. We’re committed to transparency and respectful data use.

Do we use Cookies?

Cookies help make our website work better for you, remembering your preferences and improving your experience. You can control cookie settings in your browser. Cookies make your browsing experience on our site as smooth as possible, because they remember your preferences.

Our website uses cookies to distinguish you from other users of our website. Please refer to our Cookie Policy here to learn more:

AI Usage

Artificial Intelligence (AI): We use a limited amount of AI technology to help us work more efficiently, and only ever in a way that keeps your information secure and under our control. In particular, as part of our medico-legal assessments we may use an AI-powered transcription service (PLAUD) to transcribe expert witness assessments, interviews and meetings, and to search those transcripts for detail not captured in our handwritten notes. At present we do not use AI to record, transcribe or analyse therapy sessions. Any AI tools we use are deployed in compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR).

When using AI tools, we ensure:

Personal data is processed lawfully, fairly, and transparently.
Data minimisation principles are upheld, meaning we only provide AI tools with the information strictly necessary for the intended purpose.
Robust security measures are in place to protect your personal data during any processing involving AI tools.
When using AI tools, we ensure that personal data is retained only for as long as necessary to fulfil the purposes outlined in our policy, after which it is securely deleted or anonymised.
A qualified clinician (Dr Wilson) reviews any AI-generated transcript or summary. We do not rely on AI-output – this is an aid to search sections of the raw discussion and gather more details above the raw notes made in the interview, and the professional judgement and conclusions in our reports remain entirely our own.
Our AI provider acts only as our data processor. It is contractually prohibited from using your information for its own purposes, and your recordings, transcripts and summaries are not used to train or develop AI models.

We have the specific AI tools we are using within our business, the purpose, the types of data we are collecting and our legal basis for this processing.

AI Tool Name

Purpose

Types of Data Used

Legal Basis for Processing

PLAUD

(AI voice recording and transcription)

To record and transcribe expert witness / medico legal assessments / interviews / meetings, and to produce and search written transcripts and summaries when preparing reports.

Audio recordings and transcripts, which may include identifying details and special category data (including health information) about the person being assessed and others referred to during the assessment.

Legitimate interest

Legal Claims

For further enquiries on our AI usage or to exercise your rights, please contact us using the details provided in this policy.

In our therapy work: We do not currently use AI to record, transcribe, or analyse session or client information. If this ever changes we will update this policy, tell affected clients, make sure an appropriate lawful basis and safeguards are in place, and ensure that any provider is bound not to use your information for its own purposes or to train AI models.

Do we make automated decisions about you?

We do not make any decisions about you based solely on automated processing. Where we use AI tools – for example to transcribe an assessment – the output is always reviewed by a qualified clinician (always Dr Claire Wilson) and any opinion, decision or report remains a matter of our own professional judgement.

Do we use your data for marketing purposes?

If we send you marketing communications and you no longer wish to receive them, you can opt out anytime by contacting us or clicking on the ‘unsubscribe’ button on our marketing communications. Our lawful ground of processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely to grow our practice).

Do we use third-party links?

Our website might link to third-party websites, tools and apps. Clicking on these links may allow third parties to collect or share your data. We do not control said websites and are not responsible for said websites’ privacy policies. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Expert Witness and medico-legal work – Additional information

Because we are sometimes instructed as an expert witness, some things work differently from our therapy service. This section explains how we handle your information in that role.

Our role and who instructs us. We are usually instructed by solicitors, courts or other parties to a legal case, and the person we assess is often not the person who instructs us. When acting as an expert, we are an independent data controller in our own right – we are not processing your information on behalf of the instructing solicitor – and we exercise our own professional judgement about what our report contains.

The limits of confidentiality. An expert assessment is not confidential in the way therapy is. The information you give us, and our findings, are prepared for the purpose of legal proceedings and will be set out in a report disclosed to the party who instructed us and, in most cases, to other parties and to the court or tribunal. Our overriding duty is to the court. We will explain this to you before we begin the assessment.

Information we receive about you from others. To prepare our reports we are usually sent information about you from other sources – for example, our instructing solicitor (could be claimant or defence), medical and other records, witness statements, and reports by other professionals. Where we hold information about you that we did not obtain from you directly, you still have the right to be told how we use it; this is normally provided to you by your instructing solicitor and through this policy. Again, this is something we will inform you of at the start of our interview.

Our legal basis. For this work we rely on our legitimate interests in preparing expert evidence and the proper administration of justice (Article 6(1)(f)), and – for health and other special category information – on the condition that processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)).

Use of AI in assessments. As explained in our AI Usage section above, we may use an AI-powered transcription service (PLAUD) to transcribe expert assessments, interviews and meetings. Any transcript is reviewed by a qualified clinician (Dr Claire Wilson) and the opinions and conclusions in our report remain entirely a matter of our own professional judgement.

Who we share your information with. In addition to the recipients listed elsewhere in this policy, in expert work we may share your information with: the solicitor or party instructing us; other parties to the case and their legal representatives; barristers/counsel; the court or tribunal; any single joint expert or other experts instructed in the case; and our professional regulator (the Health and Care Professions Council) where required.

Your rights in a legal context. Some of your data protection rights work differently where information is processed for legal proceedings. For example, the right to erasure does not generally apply to information we need to keep for, or that forms part of, legal proceedings, and some information may be subject to legal professional privilege or to court rules on disclosure. We will always consider your rights and explain how they apply to your situation. Please note, if a Subject Access Request relates to a case we have been instructed on, we will liaise with the instructing solicitor before responding to inform our approach to release.

Children in civil cases. Where we assess a child or young person as part of a civil case, we handle their information with particular care and in line with our wider commitment to children’s privacy (see our Children’s Data section). For children the parent, guardian or litigation friend will be involved in the assessment and is a point of contact for us. We always explain to the child, in age-appropriate terms who we are and what we are doing – for example that our job is to see how they are getting on after something difficult has happened, what they are doing well, and whether anything might help them. We do not generally introduce the legal context of the assessment directly with the child ourselves, but will respond in age-appropriate terms if the child raises it, or where the family is open about it and it comes up naturally.

How long we keep expert files. We keep expert assessment records and reports for longer than ordinary therapy records, because of the time limits that apply to legal claims and the need to justify our opinion if it is later questioned. We keep these records until the later of (a) ten years after the conclusion of the proceedings, or (b) the assessed person’s 28th birthday where they were a child at the time. Where the person assessed lacks the capacity to bring a claim themselves, we review these records rather than deleting them automatically, as the usual time limits may not apply.

Professional standards. We work to the standards of the Health and Care Professions Council (HCPC) and the British Psychological Society (BPS), including their guidance on record-keeping, confidentiality and expert practice.

Do we ever share your personal data?

We take your data’s security seriously and only allow certain people to access it. We may share your personal data with the parties set out below for the purposes as stated further above.

Service providers, acting as processors who provide IT and system administration services.
Professional advisers including healthcare professionals, lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
If you are referred by your health insurance provider, then we may need to share details about your appointment schedule with your insurer for the purposes of billing and to provide treatment updates.
As a HCPC-accredited clinician, we are obliged to consult with another mental health professional for supervision purposes. This is to ensure we reflect and improve on our clinical skills. When discussing clients in supervision we only refer to clients by their first name and identifiable information is minimised. Where you have provided explicit consent, audio and/or video recordings of EMDR therapy sessions may be shared with our qualified EMDR clinical supervisor solely for this purpose. Recordings are transferred securely via encrypted email or password-protected cloud link, and access is restricted to the therapist and their EMDR supervisor only.
Sometimes we may need to share details with your GP or a social worker. We will always get your consent prior to doing this. When the information concerns risk of harm to the client or another person then we may need to disclose information about you without your consent for your own safety or for the safety of someone else.
If you are referred to another psychologist or healthcare professional for specialist care or assessment, your relevant information may be shared with them to ensure continuity of care and appropriate treatment.
HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
Debt collection agencies in the event that payment is not received for services rendered. This will be done to recover any outstanding debts, and the debt collectors will process your data solely for this purpose.
We may need to share your personal data with courts, legal representatives, or other relevant authorities for medico-legal purposes. This includes situations where we are required to do so by law, or where it is necessary to protect your vital interests or the interests of another person. We ensure that this data sharing is conducted lawfully and with due regard for your privacy rights.

All of the above third parties have a requirement to respect the security of your personal data. We do not permit them to use your personal data for their own purposes – they are only permitted to process your data for specified purposes in line with our instructions.

Do we ever transfer your data internationally?

We may transfer your data outside of the United Kingdom/EEA, but only when we can be sure it is protected.

Many of our external third parties are based outside the United Kingdom/EEA and so their processing of your personal data will involve a transfer of data outside the United Kingdom.

For medico-legal work, our AI-transcription provider (PLAUD) is a US-based company that processes data through regional data centres. PLAUD states that they currently have data centres in the US, Europe (Frankfurt), Singapore and Japan. All LLMs used in PLAUD have zero training and zero data retention policies, enforced contractually via DPAs. All data is encrypted and there is no training by default. AI transcription is carried out by sub-processors (OpenAI, Google and Microsoft) under agreements that prohibit retention or use of your data for model training. Where this involves a transfer outside the UK, we rely on PLAUD’s data processing agreement and approved transfer safeguards (the UK Addendum to the EU Standard Contractual Clauses).

Encrypted file storage (Tresorit). Tresorit AG is a Swiss company (Switzerland has UK/EU adequacy) with affiliates in the EEA, and primarily stores data within the EEA or Switzerland. Tresorit states that data may also be transferred to countries outside the EU or Switzerland in accordance with applicable law. Because Tresorit uses end-to-end, “zero knowledge” encryption, your files are never stored in an unencrypted or readable form – so even where data is held or transmitted outside the EEA, the content cannot be read by anyone in those locations. Tresorit is ISO 27001:2022 certified.

WriteUpp (clinical practice management system). WriteUpp is a UK provider, but notes that many of their external third parties are based outside of the UK so their processing of personal data involves a transfer of personal data from the UK to another country. They state they will only transfer personal data to countries that have been deemed to provide an adequate level of protection for Personal Data, and ensure that appropriate safeguards and transfer mechanisms are in place.

Xero (our financial and accounting system). Xero is a well-used system and access is via Dr Claire Wilson, her employed administrator and via their own access, the accountant of Claire Wilson Consulting Limited. Xero notes the following: “When we share personal data, it may be transferred to and processed in countries other than the country you live in—such as Australia, New Zealand and the United States—due to the location of our teams and data hosting locations. These countries may have laws different to the ones that apply in your country. Rest assured, when we transfer personal data to another country, we put safeguards in place to protect your personal data”.

Email and website providers (including Google and Microsoft). These providers may process data outside of the EU and operate under approved international transfer safeguards.

Notability (session notes). Notability is provided by a US company. We store only raw handwritten notes with no client identifiers in this system and once therapy is completed or an expert case typed up, these notes are transferred to Tresorit. Because the notes held in Notability contain no client identifiers, no identifiable personal data is transferred outside the United Kingdom through this system.

Whenever we transfer your personal data out of the United Kingdom, we make sure it is protected by at least implementing one of the following safeguards:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the United Kingdom
Where we use certain service providers, we may use specific contracts approved by the UK Information Commissioner’s Office and the European Commission which give personal data the same protection it has in Europe.

Please contact us if you want further information on the specific process used by us when transferring your personal data out of the United Kingdom.

How secure is your data with us?

We have strong security measures in place to keep your personal information safe. Only authorised individuals who have a need to know are granted access to your data, such as our employees or trusted partners. They will process your data in accordance with our confidentiality terms.

In the rare circumstances that there is a personal data breach, we have procedures in place and will notify you, along with any applicable regulator, when we’re legally required to.

We use Gmail for our longer-standing email addresses and Microsoft Outlook for our current domain email address. Both are well established, security-accredited providers. We also use a professionally hosted website (Process Black). Please be aware that ordinary email is not a completely secure method of communication. Where we are sending particularly sensitive information we will use password-protected attachments or a secure Tresorit link. Please be mindful of the above when emailing us. If you would prefer to use a particular secure method please let us know.

We store documents and case files in Tresorit, an end-to-end encrypted, “zero-knowledge” storage services, which means files are encrypted in a way that even the storage provider cannot read. Files are protected by encryption both while stored and transferred, and access is limited to authorised individuals who need it for your care or legal matter.

We use WriteUpp, a practice-based management system designed for clinicians, to manage therapy client records, appointments and invoicing. WriteUpp acts as our data processor and holds this information under a data processing agreement and appropriate security measures.

Notability is used as a writing app within a secure password protected iPad. These notes are anonymised and include the raw notes Dr Wilson makes during medico-legal appointments and therapy appointments. Once therapy or the assessment is completed, these are deleted from Notability and stored in Tresorit.

Children’s Data & Age-Appropriate Design

We’re committed to protecting the privacy of children and young people who use our services or access our resources. If our website, services or content are likely to be used by children under 18, we follow the Age-Appropriate Design Code and the updated rules under the Data (Use and Access) Act 2025.

Here’s what that means in practice:

We design our services with children’s safety and understanding in mind
We avoid using unnecessary tracking or profiling tools
We explain things clearly, using child-friendly language wherever possible
We ask for parental or guardian consent when needed
We give children meaningful choices about their data

If you’re a parent, guardian, or educator and have questions about how we handle children’s data, just email us at office@drclairewilsonconsulting.com

Children’s Information and Consent

We work with children and young people of different ages, and the rules about consent vary depending on age and circumstances.

Age and Consent

Under 13: We always require consent from a parent or person with parental responsibility.
Ages 13-15: We usually require parental consent, though young people may be able to consent themselves if they fully understand the implications (assessed case-by-case).
Ages 16-17: Young people can generally consent to processing of their health data themselves, though we may involve parents/carers with the young person’s agreement.
Age 18+: Adults provide consent themselves. We will not share information with parents without explicit consent (except in safeguarding situations).

Verifying Parental Authority

We verify parental authority by:

Requesting confirmation of relationship to the child
Checking parental responsibility (we may request documentation such as court orders if parents are separated)
Confirming with schools or referring professionals where appropriate

When Young People Turn 16 or 18

When a young person turns 16, they gain the right to consent to health data processing. When they turn 18, they have full control over their information. For ongoing cases, we will discuss how to manage consent and communication going forward.

Separated Parents

If parents are separated, both parents with parental responsibility generally have equal rights to information about their child, unless court orders specify otherwise. Please inform us of any relevant arrangements or restrictions.

What is our process for retaining your data?

We only keep your data as long as necessary for the reasons we collected it.

By law we have to keep medical information about patients for 7 years after treatment has finished. For any children we treat, we are obliged to retain the medical information until the child’s 25^th birthday. By law we have to keep basic information about our clients (including contact, identity, financial and transaction data) for six years after they cease being patients for tax purposes.

EMDR Session Recordings: Where you have consented to the recording of an EMDR therapy session for clinical supervision purposes, the recording will be securely deleted within 7 days of our EMDR supervisor viewing the recording. Recordings are not retained beyond that period and are not used for any purpose other than clinical supervision.

Discovery Calls

Where we conduct a discovery call or initial consultation with a prospective client, the following retention periods apply:

Where no clinical judgement was formed: If the call was exploratory in nature and we collected only basic contact details (such as your name, email address and telephone number), and you do not proceed as a client, we will securely delete that information within one month of the call. This aligns with the storage limitation principle under UK GDPR.
Where a clinical judgement or risk-related decision was made: If, during the discovery call, we formed any clinical assessment of suitability, noted a safeguarding concern, or made any risk-related decision, we will retain a brief record of that call even if you do not proceed as a client. This is consistent with good clinical governance and is supported by UK GDPR’s provisions for processing in the context of health-related data and legal claims. In such cases, retention periods will follow applicable professional body guidance – 7 years for adults from the date of the call, and until the individual’s 25th birthday where the prospective client was a child at the time of the call.

For information that does not fall under the definition of basic, to determine the appropriate retention time, we look at what kind of data it is, how sensitive it is, the risks if it’s misused, why we need it, and if there are other ways to achieve the same goals. We also consider applicable legal, regulatory, tax, accounting and other requirements.

What are your legal rights in relation to your data?

You have the following rights regarding your personal data:

Access: You have the right to ask us what personal data we hold about you and to receive a copy of that data. This is called a Subject Access Request (SAR).

We’ll respond within one calendar month, but if we need to verify your identity first, we may pause the clock while we do so. This helps protect your data and ensures we’re sharing it with the right person. If your request is complex or repetitive, we may apply proportionality rules under the Data (Use and Access) Act 2025, which allow us to limit the scope or extend the response time. We’ll always explain why and keep you informed. To make a request, just email us at office@drclairewilsonconsulting.com with the subject line “DSAR Request”. You don’t need to use legal language – just let us know what you’d like to see or understand. If you’re unhappy with how we handle your request, you can raise a concern with the Information Commissioner’s Office (ICO) at www.ico.org.uk

Correction: If the personal data we have about you is incomplete or incorrect, you can ask us to correct it.
Erasure: You can ask us to delete your personal data. It’s important to note, however, that there might be legal reasons that prevent us from fulfilling this request. If such reasons exist, we will inform you when you make your request.
Objection: In certain situations, you have the right to object to the processing of your personal data.
Restriction of Processing: You can request that we restrict the processing of your personal data under specific circumstances.
Data Portability: You have the right to request the transfer of your personal data directly to you or to a third party of your choice.
Withdrawal of Consent: At any point where we rely on your consent to process your personal data, you have the right to withdraw this consent. Withdrawal of consent will not affect the legality of the processing done before the consent was withdrawn. Should you withdraw your consent, we might be unable to provide you with certain products or services. We will inform you if that is the case when you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

We won’t charge any fees for you to request access to your personal data. However, a reasonable fee may be charged if your request is clearly unjustified, repetitive or excessive. We also reserve the right to not comply in this scenario.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Changes and Contact

We regularly review our privacy policy. Please keep us updated if your personal data changes. If you have any questions or need to exercise your rights, just get in touch.

Thanks for reading our privacy policy. If you have any questions, please don’t hesitate to contact us.