clinical services privacy policy
Mary Bradbury is registered with the Information Commissioner’s Office as a Controller (Registration No. ZA544209). This policy describes how Mary Bradbury collects and uses personal information in compliance with data protection law.
During the course of her work Mary Bradbury records and uses personal information about patients, students, clinicians and potential clients.
patients
Contact details and emergency contact details are collected directly from patients.
Notes are recorded following sessions and consultations. This information is used for patient treatment and administration. The lawful basis for using personal information for this purpose is ‘to fulfil a legal obligation’. Health care professionals provide care under the Health and Social Care Act and are required by law to maintain records about patient health, treatment, and care. These records help to provide the best possible treatment.
Patient records are most likely to include sensitive personal information. This could be about a person’s health, sex life, religious beliefs and/or ethnicity. Patient records may also include information about a person’s criminal history. The lawful basis for recording sensitive personal information is ‘explicit consent’. Sensitive personal information is only recorded and used by Mary Bradbury with the explicit consent of the individual concerned.
students and BPC registered clinicians
Supervisees provide their contact details and some session notes, which are used for administration and clinical supervision. The lawful basis for using personal information for this purpose is ‘for the performance of a contract’.
potential clients
Contact details are provided by potential clients and used to contact them. The lawful basis for using personal information for this purpose is ‘legitimate interest’ as it is necessary and reasonable to record and use a person’s contact details if they express an interest in treatment.
personal information retention
Records containing personal information may be electronic, on paper or a mixture of both. A combination of working practices and technology are used to ensure that personal information is kept confidential and secure. In line with data protection requirements it is kept only for as long it is needed, before being destroyed or deleted.
- Patients’ records are kept for 5 years after the last treatment session.
- Students’ and BPC Clinicians’ personal information is kept for 5 years.
- Potential clients’ personal information is kept for 6 months.
sharing of personal information
Mary Bradbury does not share personal information about patients, students or clinicians with any individuals or organisations unless the person the information is about has given their prior permission for it to be shared, she is legally required to share it, or if someone’s life is at risk.
data protection rights
Data protection law gives individuals certain rights with respect to their personal information. If you have a question about this privacy policy, wish to see a copy of your personal information or wish to object to or restrict the use of your personal information held by Mary Bradbury, please email query@marybradbury.co.uk.
July 2026