Privacy Policy

---

Overview

Privacy Policies are agreements that specify what type of data a website collects from users and how that data will be used. Known as “personal information” or “personally identifiable information,” regulated data typically includes anything that can be used to identify an individual, and is not limited to a user’s name. Personal information may include a user’s address, date of birth, marital status, contact information, ID issue and expiration date, financial records, credit information, medical history, where one travels, and intentions to acquire goods and services, among others. 

1. Who I am

I am Dr Sarah Osunsanya, HCPC-registered Clinical Psychologist (Registration No. PYL046268).

I am the Data Controller for the personal information I collect as part of providing psychological services.

2. What information I collect

I may collect the following personal data:

• Parent/guardian contact details
• Child’s name, DOB, gender, school, GP
• Medical, developmental and psychological history
• Assessment data (including psychometric test results)
• Session notes
• Email correspondence
• Invoices and payment records
• Emergency contact information
• Safeguarding information (where relevant)

Special category data: Health information is processed under Article 9(2)(h): “provision of health or social care”.

3. Why I collect this information

• To assess, understand and treat psychological difficulties
• To produce reports and liaise with relevant professionals (with consent)
• To safeguard children
• For invoicing and administrative purposes
• To comply with legal obligations (e.g., HCPC standards, safeguarding law)

4. Lawful bases for processing

Under UK GDPR my lawful bases are:

Article 6(1)(e) – performance of a task in the public interest (healthcare); or

Article 6(1)(f) – legitimate interests

Article 9(2)(h) – provision of health care

Consent is used for transparency, not as the primary lawful basis.

5. How information is stored

Encrypted electronic records stored via [system/software]

Password-protected devices with multi-factor authentication

Paper notes stored in locked cabinet

Encrypted backups

Emails sent via encrypted platform where possible

6. Who information is shared with

Information will only be shared when:

You/your child provide explicit consent

There is a risk of harm or safeguarding concern

A court order requires disclosure

With other professionals involved in care (e.g., GP, school, paediatrician)

I will never sell or share data for marketing.

7. How long information is kept

Children’s clinical records are retained for 7 years after their 18th birthday (or per insurer requirement).

Financial records are kept for 7 years (HMRC requirement).

8. Your rights

You have the right to request:

• Access to your data
• Correction
• Restriction
• Deletion (where lawful)
• Objection to processing
• Children’s rights depend on age and competence (Gillick competence guidance applies).

9. Contact details

If you have any questions regarding this Privacy Policy or the practices of this Site, please contact us:

Data Controller: Dr Sarah Osunsanya

Email: info@irokotreepsychology.com 

Telephone: 07749646214

You may also contact the Information Commissioner’s Office (ICO) if concerned: www.ico.org.uk 

Last Updated: This Privacy Policy was last updated on 23.11.2025.