Privacy policy

This policy explains how I, Dr Chloe Bedford at Marathon Psychology, use and protect the information you share when you enquire or work with me. Enquiry details are used to respond to you; clinical records support our work together. The sections below explain storage, sharing, retention and your rights.

If you have a privacy question, please contact me through the enquiry form. You do not need to include sensitive details in an initial enquiry.

The basics 

  • I keep information about you in order to provide you with a service, and to process payments.
  • I cannot work with you unless you allow me to keep records.
  • I follow the law, and the codes of practice set down by the HCPC and the BPS
  • I have systems in place to protect your data.
  • You are entitled to request a copy of your data free-of-charge, and to have inaccurate information corrected.
  • I aspire to the highest data privacy standards. If you have questions, concerns or feedback then please let me know so that I can address them.
  • You can complain to the Information Commissioners Office (ICO) if you think that I am acting unlawfully: visit ico.org.uk/concerns or phone 0303 123 1113.

Why I keep information

My professional registration requires me to keep information about my clients and the work that I do. I cannot offer you services unless you allow me to keep data about you and our work together.

The legal basis

I have what is known as a legitimate interest for keeping data. I am registered with the Information Commissioners Office (ICO) to do so. I follow the rules set down by my professional regulator (the Health and Care Professions Council; HCPC), and the British Psychological Society (BPS).

The information that I keep

  • I keep personal data e.g. your name, address, phone number. I also keep sensitive data e.g. notes about our meetings, your gender, social history.
  • If you complete the enquiry form, I use the details you provide to respond to your enquiry. The form runs on this WordPress website, hosted on Google Cloud. Enquiries are delivered to the practice through Google Workspace. The website does not keep a separate database of form submissions or email contents. Google reCAPTCHA helps protect the form from spam and automated abuse; Google processes technical information, including your IP address and browser/device information, for this purpose. Google’s Privacy Policy and Terms of Service apply to reCAPTCHA.
  • If you are referred by your health insurance provider, then I may also collect and process personal data provided by that organisation. This includes basic contact information, referral information, and health insurance policy number and authorisation for psychological treatment.

What I do with the information

I use the data I collect for three reasons: (1) to provide you with services, (2) for billing and processing payments (3) to safeguard you (your child) and help prevent serious harm.

How I share information:

  • Except for processing by the service providers described below, your information is kept confidential and not shared with anyone without your consent, unless I believe that there is a serious risk of harm to yourself or someone else. I will always endeavour to make sure that you are informed of this, unless I do not feel that it is safe to do so. 

You have the right to: 

  • Request details of all the information that I keep and to receive it within one month at no fee. 
  • Have information corrected if you consider it inaccurate or incomplete.
  • Complain if you think that I am acting unlawfully (see The basics, above). 

How I record and store information

I keep records of our work together, which may include handwritten session notes, assessments, correspondence and clinical summaries. These records can contain sensitive information about your health and personal circumstances.

I may take handwritten notes on a dedicated, secured iPad. I use a client reference rather than your name where practical. These notes remain confidential personal information, even when your name is not included.

My practice uses Google Workspace to store clinical records. Access is restricted to authorised people who need the information for their work. I use security measures including device encryption, access controls and two-step verification to help protect your information.

Where notes are temporarily held on the iPad, I check that they have been transferred successfully to the practice’s records before removing temporary copies in accordance with my record-management procedures.

Service providers

I use technology providers to support the secure operation of my practice, including Google Workspace for record storage. Where a provider processes client information on my behalf, I put appropriate contractual arrangements in place and assess how the service protects that information.

Some providers may process information outside the UK. Where this happens, I ensure that an appropriate legal basis and safeguards for the transfer are in place.

Recording and artificial intelligence

I do not routinely make audio or video recordings of therapy sessions. I do not use generative AI tools to transcribe, summarise or draft your clinical notes. If I propose a change to these practices, I will explain it to you in advance and address the relevant confidentiality and data-protection requirements.

How long I keep clinical records

Adult clinical records: retained for 8 years following the end of treatment.

Clinical records relating to children and young people: retained until the client's 25th birthday (or 26th birthday if treatment ended when the young person was aged 17), in accordance with relevant professional and health-records guidance. Records may be retained for longer where there is a clinical, legal, safeguarding or other justified reason to do so.