Merstham Psychology Practice

Dr Kelly Jones, Consultant Clinical Psychologist

The Garden Retreat, Baddiley House, Church Hill, Merstham, Surrey, RH1 3BJ

Tel: 01737 448060 | drkellymjones@gmail.com | www.mersthampsychology.com

 Last updated: June 2026 | Next review: June 2027

This Privacy Policy explains how Merstham Psychology Practice collects, uses, stores and protects your personal information. It applies to all clients, prospective clients, and visitors to this website, as well as visitors to the practice premises.

I take your privacy seriously. As a psychologist handling sensitive health information, I am committed to the highest standards of confidentiality and data protection — not just because the law requires it, but because your trust is the foundation of everything I do.

Please read this policy carefully. If you have any questions, contact me at drkellymjones@gmail.com or 01737 448060.

I am Dr Kelly Jones, a Consultant Clinical Psychologist registered with the Health and Care Professions Council (HCPC) [PYL23694]. I am the sole practitioner at Merstham Psychology Practice.

As the data controller for this practice, I am registered with the Information Commissioner's Office (ICO) [1259658]. This means I am legally responsible for deciding how your personal data is collected, stored and used, and for ensuring that all activities comply with UK data protection law.

• Your full name, date of birth and contact details (address, phone number, email address)

• Your GP's name, practice and contact details

• The name and details of any referring clinician (e.g. physiotherapist, consultant)

• Health insurance details where applicable (for example, your BUPA membership number)

• Payment information and invoicing records

• Emergency contact details

Because I provide psychological therapy, I collect and process health information about you. This is defined as special category data under UK GDPR and receives additional legal protection. It includes:

• Your reason for seeking therapy and relevant personal background

• Clinical assessment findings and psychological formulations

• Session notes and records of our therapeutic work together

• Information about your physical health, medication and other relevant treatment

• Risk-related information where applicable

All health and clinical information is treated with the strictest confidentiality, in line with my professional duties as a registered psychologist and the requirements of UK GDPR.

CCTV cameras and a Ring video doorbell are in operation around the exterior of the practice premises for security and safety purposes. Images of individuals approaching or arriving at the practice may be captured. Clear signage is displayed at the premises to notify visitors that video surveillance is in operation. This footage is described fully in Section 9.

When you visit this website, standard technical data may be collected automatically by the website platform (GoDaddy), including your IP address, browser type and pages visited. This is used only for the security and basic functioning of the website and is not used to identify individual visitors.

UK GDPR requires me to have a lawful reason for every use of your personal data. The legal bases I rely on are:

Administrative and contact information

Contract (Article 6(1)(b)): processing your contact and administrative details is necessary to provide the service you have requested. I also rely on legitimate interests (Article 6(1)(f)) for purposes such as maintaining payment records and responding to enquiries.

Health and clinical information (special category data)

I rely on Article 9(2)(h) of UK GDPR — processing necessary for the provision of health and social care — combined with Schedule 1, Part 1(2) of the Data Protection Act 2018. This provides a lawful basis for clinical note-keeping and record management without requiring your consent for routine processing.

AI note-taking — Heidi Health

Heidi Health processes session content, which is special category health data. I rely on your explicit consent (Article 9(2)(a)), obtained separately and in advance. You are free to decline without any impact on your care.

AI case formulation support — Claude by Anthropic

I use Claude only with anonymised, non-identifying clinical descriptions. Because no personal data is shared with the tool, UK GDPR's special category provisions do not apply, and I rely on legitimate interests (Article 6(1)(f)).

Video surveillance — CCTV and Ring doorbell

I rely on legitimate interests (Article 6(1)(f)) for the operation of video surveillance at the practice premises. The legitimate interest is the security of the premises and the safety of clients, staff and visitors. I have assessed that this interest is not overridden by individuals' privacy rights, given the external-only positioning of cameras, prominent signage, short retention periods, and the security context of a sole-practitioner healthcare setting.

I use your personal and health information only for the following purposes:

• To provide you with psychological assessment and therapy

• To communicate with you about appointments, sessions and your care

• To write to your GP or referring clinician with your consent (see Section 5)

• To process payment and manage invoices and financial records

• To fulfil my legal and professional obligations, including safeguarding duties

• To receive clinical supervision, in a form that protects your confidentiality (see Section 5)

• To support my clinical work using AI tools, within the limits described in Section 8

• To maintain the security and safety of the practice premises, via video surveillance (Section 9)

⚠ I will never sell, rent, or share your personal information for marketing or commercial purposes.

Your information is kept strictly confidential. There are limited circumstances in which I share information about you:

With your GP or referring clinician

With your prior consent, I write to your GP or referring clinician following assessment and at the end of therapy, and at clinically significant points during treatment. You can withdraw consent to such correspondence at any time.

Clinical supervision

As a registered psychologist I am professionally required to receive regular clinical supervision. I may discuss aspects of our clinical work in supervision to maintain the quality and safety of your care. I use the minimum information necessary and take care to protect your identity — your full name, contact details and any directly identifying information are not shared. My clinical supervisor is bound by equivalent professional confidentiality obligations.

WriteUpp — practice management system

I use WriteUpp (provided by Pathway Software UK Limited) to store clinical records, manage appointments and process invoices. WriteUpp acts as my data processor — they store and process data on my behalf, under my instructions, and are contractually bound to protect it in accordance with UK GDPR. Data is stored on secure, encrypted servers within the European Union. You can read WriteUpp's privacy policy at writeupp.com/privacy.

Health insurers

If your therapy is funded by health insurance (for example, BUPA), I may need to share limited clinical information with my administrator and your insurer to process a claim. I will always discuss this with you and obtain your agreement before doing so.

Legal and safeguarding obligations

In rare circumstances I may be required or professionally obligated to share information without your consent. This includes:

• If I have serious concerns about risk to your life or the life of another person

• If disclosure is required by a court order or by law

• If required by a statutory body in the exercise of its legal functions

• If CCTV or Ring doorbell footage is requested by the police for crime prevention or detection purposes

Where possible I will discuss this with you first. I always limit disclosure to the minimum information necessary for the specific purpose.

All clinical notes, session records and client details are stored in WriteUpp, a UK-based, GDPR-compliant practice management system. Access is protected by a unique login and two-factor authentication. Data is stored on encrypted servers within the EU.

I use Gmail for email. My address is drkellymjones@gmail.com. I recommend avoiding sending sensitive clinical information by email. If you need to share anything confidential, please telephone or raise it in session. Google's privacy policy is available at policies.google.com/privacy.

Online therapy sessions are conducted via Zoom. Zoom is used as a secure video platform only — I do not use Zoom's AI or note-taking features. Sessions are not recorded without your explicit prior consent. Zoom's privacy policy is available at zoom.us/privacy.

CCTV footage is stored securely within the Swann Security system. Ring doorbell footage is stored via Ring's cloud infrastructure. Retention periods and further details are set out in Section 9.

I take reasonable technical and organisational steps to protect all personal data I hold, including device encryption, strong password management, and secure storage. In the event of a data breach likely to affect your rights and freedoms, I will notify the ICO within 72 hours and inform you without undue delay.

I retain clinical records for seven years following the end of therapy, in line with guidance from the British Psychological Society (BPS) and HCPC. For clients who were under 18 at the start of therapy, records are retained until their 25th birthday or for seven years after therapy ends, whichever is later.

Administrative and financial records are retained for six years in line with HMRC requirements.

If you contacted me but therapy did not commence, I will hold your contact details and any correspondence for no longer than two years and emails are deleted immediately.

Video surveillance footage retention periods are set out in Section 9.

After the relevant retention period, all records are permanently and securely deleted from WriteUpp and any other storage.

SECTION 8 — USE OF ARTIFICIAL INTELLIGENCE (AI) TOOLS

Please read this section carefully — it explains how AI supports your care, which tools I use, and what choices you have.

I use AI tools in two specific, limited ways to support the quality of my clinical work. I do not use AI to make decisions about your care — all clinical judgements are made by me as your psychologist. AI tools assist my thinking and administration only, and I personally review and verify everything any AI tool produces before it has any bearing on your care or your records.

I am fully transparent about this use because I believe you have the right to know how technology supports your care. If you have any questions or concerns at any point, please raise them with me.

What this is

I may use Heidi Health, an AI-powered clinical scribe, to assist in producing draft session notes for both face-to-face and online sessions. Heidi listens to our session and generates a draft summary, which I then review, edit and verify before it is saved as your clinical record. The final note is always my own professional work — Heidi produces a draft only.

How Heidi Health handles your data

Heidi Health is GDPR-compliant and meets NHS digital security standards (DTAC and DSPT). All data is hosted within the UK. Audio recorded during a session is used only to generate the draft note and is then permanently deleted — it is not stored after processing is complete. Heidi Health acts as a data processor under a formal Data Processing Agreement, meaning your data is processed only on my instructions and cannot be used for any other purpose, including AI model training. You can read more at heidihealth.com.

Your consent

I will always ask for your explicit consent — verbally and in writing — before using Heidi Health in any session, whether face-to-face or online. You are entirely free to decline, and doing so will have no effect on your access to therapy or the quality of your care. You may withdraw consent at any time by letting me know before a session begins.

Human oversight

I review every Heidi Health draft before saving it, correcting errors and adding clinical context as needed. All AI-assisted notes are marked as such, with confirmation that they have been reviewed and verified by me. I take full professional responsibility for all clinical records.

What this is

I may use Claude (an AI assistant made by Anthropic) to support my clinical thinking — for example, to explore different psychological frameworks, consider alternative formulations, or think through complex presentations from different perspectives. This is similar in purpose to consulting a clinical reference or discussing a case in supervision: it supports my professional judgement rather than replacing it.

How your confidentiality is protected

When I use Claude for formulation support, I do not enter your name, date of birth, contact details, or any other information that could directly identify you. I provide only a clinical description — for example, age range, presenting difficulties, relevant history and patterns — with all identifying details removed. Your personal data is not shared with Claude in any form.

How Anthropic handles data

Anthropic's privacy policy states that inputs to Claude are not used to train its AI models by default. You can read Anthropic's privacy policy at anthropic.com/privacy. Because I use only anonymised information, this tool does not process your personal data.

Transparency

Because only anonymised, non-identifying information is used when consulting Claude, your personal data is not shared with Anthropic and your formal consent is not legally required. However, I believe in full transparency: I will tell you at the start of our work together that I use AI in this way, and I welcome any questions or discussion. If you have any concerns, please raise them with me at any time.

⚠ AI is never used to make clinical decisions about your diagnosis, treatment, or care. Your name, contact details, date of birth, or any directly identifying information is never entered into any AI tool. AI is never used to communicate with you on my behalf. Zoom's AI or note-taking features are not used in online sessions. AI-generated content is never included in your clinical record without my personal review and verification.

In relation to my use of AI tools, you have the right to:

• Decline the use of Heidi Health at any time, for any session, without giving a reason, and without any impact on your care

• Ask me which AI tools I currently use and how they handle data

• Ask me to explain any AI-assisted process in plain language

• Raise any concern about AI use with me directly, or with the ICO

SECTION 9 — VIDEO SURVEILLANCE (CCTV AND RING DOORBELL)

This section explains the video surveillance in operation at the practice premises and your rights in relation to it.

For the security of the practice premises and the safety of clients, visitors and the practitioner, the following video surveillance systems are in operation at the external areas of the practice:

• CCTV cameras, provided by Swann Security, covering external areas around the practice premises

• A Ring video doorbell, provided by Ring (an Amazon company), at the practice entrance

Video surveillance operates on the exterior of the premises only. No cameras are positioned inside the therapy room or any internal area of the practice. Your therapy sessions are entirely private and are never recorded by any surveillance system.

Clear signs are displayed at the practice premises to notify all visitors that video surveillance is in operation before they enter the area under surveillance. This is a legal requirement under UK GDPR and ICO guidance, and I take care to ensure signage is clearly visible on approach to the premises.

Swann Security CCTV

CCTV footage captured by the Swann Security system is stored securely using Swann's cloud infrastructure, which uses Amazon Web Services (AWS). Swann is GDPR-compliant, and all data is encrypted and stored within the UK. Footage is retained on a rolling basis for a maximum of 30 days, after which it is automatically overwritten and deleted. Access to footage is restricted to me as the data controller.

Ring video doorbell

Ring doorbell footage is stored via Ring's cloud service (an Amazon company). Ring uses encryption to protect stored footage. Footage is retained for a maximum of 30 days, after which it is deleted. Ring's privacy policy is available at ring.com/privacy. I have reviewed Ring's data handling terms and am satisfied that its use is proportionate to the security purpose for which it is deployed.

Access to all video surveillance footage is restricted to me and my husband (homeowner). I take responsibility as the data controller. Footage is not shared with third parties except in the following limited circumstances:

• With the police or other law enforcement agencies, for the prevention or detection of crime, where there is a lawful basis for disclosure

• In response to a court order or other legal requirement

• In the event of a serious safety incident at the premises where footage is relevant

Footage will never be shared for commercial purposes or uploaded online.

In line with ICO guidance on the use of smart doorbells and CCTV in a business context, I have conducted a Data Protection Impact Assessment (DPIA) for these surveillance systems. The DPIA confirms that:

• The purpose of surveillance is specific and legitimate — the security of the premises and the safety of individuals

• Cameras are positioned to capture only the external areas of the practice and do not extend to neighbouring properties or public spaces beyond what is necessary

• No facial recognition or biometric processing is used

• Retention periods are the minimum necessary for the security purpose

• The privacy impact on individuals is proportionate to the security benefit

If you have been captured on CCTV or Ring doorbell footage, you have the right to:

• Request access to footage in which you appear (subject access request)

• Request deletion of footage in which you appear, where there is no overriding legitimate reason to retain it

• Object to the processing of your image by these systems

To make a request, contact me at drkellymjones@gmail.com or 01737 448060. I will respond within one month. Please note that footage may already have been automatically deleted within the 30-day retention period before a request is received.

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to all personal data I hold about you:

Right of access

You may request a copy of the personal information I hold about you. I will respond within one month. In rare cases where disclosure would be likely to cause serious harm, I may withhold specific information in line with legal provisions.

Right to rectification

If you believe any information I hold is inaccurate, you can ask me to correct it. Where you disagree with a clinical opinion, I will add a note to your record — though I am not required to alter professional judgements.

Right to erasure

You can ask me to delete your personal data. However, this right is limited for clinical records — I am legally and professionally required to retain records for the periods set out in Section 7. Information not subject to these obligations will be deleted on request.

Right to restrict processing

In certain circumstances you can ask me to restrict how I use your data while, for example, a dispute about accuracy is being resolved.

Right to withdraw consent

Where I rely on your consent — for example, for Heidi Health note-taking — you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

Rights relating to automated decision-making

I do not use automated decision-making or profiling to make decisions with legal or significant effects on you. All AI-generated content is subject to my personal review and professional judgement before it has any bearing on your care.

To exercise any of these rights, please contact me at drkellymjones@gmail.com or 01737 448060. I will respond within one month.

This website uses cookies to support its basic functions. These may include essential cookies (required for the site to work) and analytics cookies (to understand how visitors use the site). You can set your browser to block cookies, though this may affect how the website functions.

This website is hosted by GoDaddy. Please refer to GoDaddy's privacy policy at godaddy.com/legal/agreements/privacy-policy for information about how technical and cookie data is handled.

If you have any concern about how I handle your personal data, please contact me in the first instance:

• Email: drkellymjones@gmail.com

• Phone: 01737 448060

• Post: Dr Kelly Jones, Merstham Psychology Practice, The Garden Retreat, Baddiley House, Church Hill, Merstham, Surrey, RH1 3BJ

If you are not satisfied with my response, or believe I am processing your data unlawfully, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk

• Helpline: 0303 123 1113

• Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

You also have the right to raise concerns about my professional conduct with the HCPC at hcpc-uk.org.

I will update this policy when there are changes to the law, professional guidance, or my practice — including any changes to the AI or surveillance systems I use. The current version will always be available on this page, with the date it was last updated shown at the top.

I may update this privacy notice from time to time as necessary. The terms that apply to you are those posted here on our website on the day you use this website. It is advised that you print a copy for your records.  If you have any question regarding this privacy policy, please contact me.