GDPR Policy

Last updated: April 2025

​

1. Data Controller and Processor

I act as both the Data Controller and the Data Processor, solely responsible for your privacy. The registered data controller is Dr. Emma Mercer operating as Elm Psychology Services Ltd (trading as Elm Psychology).

​

2. Information I Collect

I only request and collect information that is necessary to provide services effectively and safely, for legal, contractual, and legitimate reasons. This may include:

• Name and age

• Address and contact details (email, phone number)

• Your child's name, date of birth, and relevant identifying information

• Educational, developmental, and relevant medical history

• Consultation notes

• Assessment data

• Observation records

• Care plans and recommendations

• Reports (which may include reports to schools, other professionals, or local authorities)

 

3. How I Use Your Information

Your information is used to:

• Provide educational psychology and EMDR therapy services

• Communicate with you about your care

• Liaise with other professionals involved in your care (with your consent)

• Maintain accurate records of the care provided

• Anonymise data for research and service improvement

 

4. Data Storage and Security

I take the security of your data seriously. Your information is processed and stored as follows:

• Paper records (assessment records and consultation notes) are secured in a locked cabinet

• Electronic records are stored on a password-protected, encrypted device

• Emails are password-protected and encrypted

• Phone communications are protected by fingerprint/facial recognition and passcode

 

5. Data Retention

In line with professional guidelines, I retain client data for a period of 7 years.

 

6. Sharing Your Information

I may share your information with other professionals involved in your care, but only with your explicit consent.

Exceptions to this are situations where there is a safeguarding concern or legal requirement to share information without consent.

 

7. Information Sharing and Disclosure

I will not share information about you or your child with anyone outside of Elm Psychology Services Ltd without your explicit consent, except in the following circumstances:

• When required by law

• When there is a safeguarding concern or risk to an individual's safety

• When required by a court order or legal process

 

Where online assessment tools are used in my work, third parties may process and hold electronic data on behalf of Elm Psychology Services Ltd. This data is held and processed securely and is in an anonymous format which means individuals cannot be identified.

 

8. Consent for Young People 16+

In line with data protection regulations, where a young person is 16 years of age or older and has capacity to do so, they may provide consent for my involvement and data processing themselves. In such cases, I will work directly with the young person while maintaining appropriate communication with parents/carers as agreed with the young person.

 

9. Your Rights

Under GDPR, you have the right to:

• Request access to your personal data (free of charge, within one month of request)

• Request correction of your personal data

• Request deletion of your data (where appropriate)

• Object to processing of your personal data

• Request restriction of processing your personal data

• Request transfer of your personal data

• Withdraw consent

 

10. Data Breaches

In the unlikely event of a data breach that risks your rights and freedoms, I will notify you and the Information Commissioner's Office (ICO) within 72 hours.

 

11. Changes to This Policy

I may update this policy from time to time. Any changes will be posted on the website.

 

12. Contact Information

If you have any questions about this policy or how I handle your personal information, please contact me at info@elmpsychology.org.

 

13. Complaints

If you are unhappy with how I've handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (www.ICO.org.uk).

​

​

**Important Note:** While I take steps to ensure your information is secure, communications by text, email, messenger, social media, WhatsApp, and the website may not be fully secure. Please keep this in mind when using these methods to communicate sensitive information.

​

By using the services, you acknowledge that you have read and understood this policy.

 

Company Information:  
Elm Psychology Services Ltd (trading as Elm Psychology)  
Dr. Emma Mercer, Educational Psychologist  
HCPC Registration: PYL38502