1. Important information about who I am

What this notice covers: how I collect, use, share and retain your personal data when you use my supervision services.

What it doesn't cover: third party sites (e.g. Zoom’s privacy policy applies to video sessions).

Changes to notice: see section 10.

2. What data do I collect about you, for what purpose and on what ground I process it?

Personal data means any information relating to an identified or identifiable individual. It does not include data where the identity has been removed (anonymous data).

I process the following categories of personal data:

Communication Data

Any communication you send me (contact form, email, text, social media, phone). Purpose: communicating with you, record-keeping, legal claims. Lawful basis: legitimate interests (responding to you, record-keeping, establishing, exercising or defending legal claims).

Customer Data

Name, title, billing address, email, phone, purchase details. Purpose: supply supervision services, transaction records. Lawful basis: contract performance.

User Data

Website usage data. Purpose: operate website, security, backups, administration. Lawful basis: legitimate interests (website and business administration).

Technical Data

IP address, browser type, time zone, page interactions (Google Analytics, WordPress, Pykthos). Purpose: website performance, user experience, marketing effectiveness. Lawful basis: legitimate interests for website security and administration; consent for Google Analytics.

CRM Data

Information stored in Pykthos and accessed through Pykthos and the LeadConnector mobile app, including your name, contact details, bookings, payment status, completed forms, agreements and consent records. Purpose: manage bookings, provide supervision services, maintain appropriate records and administer my practice. Lawful basis: contract performance and legitimate interests in practice administration; explicit consent for special-category information about you.

Marketing Data

Preferences for marketing communications. Purpose: promotions and relevant content. Lawful basis: consent.

Supervision Data

Information you provide about yourself, your professional practice and your supervision needs through enquiries, forms and supervision sessions. This may include limited, pseudonymised information about cases discussed. Purpose: assess your needs, provide supervision, maintain appropriate records and support safe and ethical practice. Lawful basis: contract performance and legitimate interests in professional accountability and record-keeping.

Special Category Data

Health information or other special-category information about you that is relevant to supervision, together with limited special-category information contained in case discussions. Purpose: provide appropriate supervision and support safe client work. Special-category condition: explicit consent for information about you; health or social care purposes for case information necessarily processed as part of confidential professional supervision.

3. How is your personal data collected?

I collect data from or in relation to you:

• Directly from you when you fill in forms on my website, book supervision sessions, complete intake forms, complete assessment forms, or provide information during supervision sessions
• Indirectly, when you discuss client work during supervision. You should avoid unnecessary identifying details and use first names or pseudonyms wherever possible.
• Automatically from your device when you visit my website or use my booking system (Pykthos)
• From third parties such as payment processors (Stripe, PayPal POS), and analytics providers (Google Analytics).

I do not purchase data from data brokers or third-party lists.

4. Who I share your data with and why

Service providers

These may act as processors or independent controllers depending on the service:

• Pykthos, HighLevel and LeadConnector: website hosting, booking management, CRM, forms, automated communications and mobile access to CRM records
• PayPal POS: payment processing
• Stripe: payment processing
• Google Calendar: appointment scheduling
• HostPapa: business email, domain hosting and legacy website hosting
• WordPress: maintained legacy website that redirects to carolyngillan.com
• Apple/iCloud: device services and backups
• WhatsApp: communications where used
• TalkMobile: mobile telephone and SMS services
• Google Analytics: website performance
• Zoom: online supervision sessions
• My clinical supervisor: in a manner that seeks to protect your identity and the identities of any clients discussed

Other recipients

These recipients act as controllers:

• My professional indemnity insurers: claims or complaints
• Regulatory bodies and public authorities: where required by law, such as the ICO or police.
• Healthcare professionals, emergency services or safeguarding authorities: where necessary for safeguarding or to protect vital interests, or where required or permitted by law
• My legal advisors/accountants: compliance/tax obligations

5. International data transfers

Some of my service providers and their subprocessors may process or store personal data outside the UK, including in Canada and the United States.

Where personal data is transferred outside the UK, I take steps to ensure that the transfer is covered by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where contractual safeguards are used, I complete the required data protection test.

You can contact me for further information about international transfers or the safeguards used.

6. Your rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data I hold about you (Subject Access Request).
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data where there is no compelling reason for me to continue processing it.
• Restriction: Request restriction of processing while I verify, correct, or consider an objection.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Portability: Receive your data in a structured, commonly used, machine-readable format (where applicable).
• Withdraw consent: Withdraw consent at any time where I am relying on consent (this will not affect the lawfulness of earlier processing).

How to make a data-protection complaint

If you have concerns about how I have collected, used or protected your personal information, please contact me at [email protected]. I will acknowledge your complaint within 30 days, investigate your concerns and respond without undue delay. If I need additional time to complete my investigation, I will keep you informed of my progress.

You also have the right to complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk. You do not need to contact me before approaching the ICO, although I would welcome the opportunity to address your concerns.

Automated decisions: Rights relating to solely automated decision-making (I do not use this).

How to exercise your rights

• Email me at [email protected]
• Requests are free unless manifestly unfounded or excessive
• I will respond within 1 month (extendable to 3 months for complex requests)
• I may request ID verification
• I will provide a reason if I cannot comply with your request

7. Data security

I am committed to protecting your personal data and have implemented appropriate technical and organisational measures:

Technical measures

• Secure cloud storage with encryption (at rest and in transit)
• HTTPS encryption on my website
• Password protection and two-factor authentication on supported key systems
• Secure payment processing via PayPal POS and Stripe
• Regular software updates and antivirus protection

Organisational measures

• Access controls (least privilege, need-to-know principle)
• Paper supervision records stored securely in a locked filing cabinet
• Ongoing data protection awareness and review
• Regular security reviews and backups
• Incident response procedures for data breaches

I cannot guarantee the security of data transmitted over the internet.

Confidentiality obligations with supervisors

My clinical supervisor is bound by a confidentiality agreement that requires them to protect any information they learn about you during case discussion. This agreement prohibits disclosure of your information to third parties except where required by law or where you have given explicit consent. The confidentiality obligation continues after my supervisory relationship with them ends.

8. Data retention

I retain personal data only for as long as necessary, taking account of its purpose, my professional, legal and insurance obligations, and your data-protection rights.

Retention periods are:

• Supervision records: Eight years from our last supervision session. This includes assessment information, special-category data, agreements, consent forms, supervision notes, relevant case-discussion information and professionally significant communications.
• Financial records: Six years from the end of the relevant tax year.
• Routine communications: Only for as long as needed. Professionally significant information may be added to your supervision record.
• Technical and analytics data: Up to 14 months.
• Marketing data: While you remain subscribed, with minimal information retained afterwards to honour your opt-out.

When a retention period ends, I securely delete or destroy the information, unless I am legally or professionally required to retain it for longer.

You may request earlier deletion, although the right to erasure does not apply in all circumstances.

9. Cookies and similar technologies

My website uses cookies and similar technologies to improve your experience. Cookies are small text files stored on your device.

Types of cookies I use:

Essential cookies: Strictly necessary for the website to function (e.g. session management). No consent required.

Analytics cookies: Track website usage (Google Analytics). Lawful basis: consent.

You can manage cookies through your browser settings or my cookie banner. See my Cookie Policy for full details.

I do not use cookies to make solely automated decisions about you that have legal or similarly significant effects.

10. Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practices or legal requirements.

Significant changes will be:

• Posted prominently on my website homepage
• Emailed to active supervisees
• Reflected in updated consent forms

Minor updates will be posted on my website with the revision date at the top.

The version displayed on my website describes my current processing practices.

Check back periodically or contact me for the current version.