Dr Samuel Clack, Clinical Psychologist, London

Privacy Policy

Last updated: 9 November 2026

Who I am

I am Dr Samuel Clack, a practitioner psychologist (clinical psychology) registered with the Health and Care Professions Council (HCPC), registration number PYL046273. I practise as a sole trader under the business name Kindset Psychology from Islington Therapy House, 364 City Road, Angel, London EC1V 2PY. I am the data controller for the personal information described in this policy, and I am registered with the Information Commissioner’s Office (ICO), registration number CSN7042083.

I am committed to confidentiality and to protecting your personal information. I handle it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the standards set by the HCPC.

Contact: samuel@kindsetpsychology.com

What information I collect

Depending on how you use my service, I may collect:

  • Contact and identity details (name, address, email, phone number, date of birth)
  • Health and clinical information, including your history, assessments, questionnaires, session notes and treatment plans
  • Details of your GP, next of kin or emergency contact
  • Referrer details and information from other professionals involved in your care (such as your GP, solicitor or insurer), where relevant
  • Payment and billing information
  • Emails, messages and other correspondence
  • Website information: basic visitor statistics (page views, number of visitors, country of origin and the website that referred them) and any details you submit through the website contact form

Information about your health is “special category data” under UK GDPR and receives extra protection.

How I get your information

Most information comes directly from you: when you contact me through the website, by email or phone, complete forms or questionnaires, or take part in sessions. Some may come from a referrer or another professional, with your knowledge.

How I use your information

I use your information to:

  • Assess you and provide psychological therapy
  • Keep accurate clinical records and plan your care
  • Arrange appointments, send reminders and manage administration
  • Issue invoices and process payments
  • Respond to enquiries made through my website
  • Meet legal, regulatory and safeguarding obligations

I do not use your information for marketing, and I do not sell it.

Legal basis for using your information

Under UK GDPR I must have a lawful basis for each use of your data. Mine are:

  • Contract (Article 6(1)(b)): to provide the therapy services you have asked for, including appointments and billing.
  • Legitimate interests (Article 6(1)(f)): to keep records, run my practice securely, respond to enquiries and understand how people use my website, where this does not override your rights.
  • Legal obligation (Article 6(1)(c)): where the law requires me to keep records or disclose information.
  • Vital interests (Article 6(1)(d)): in a life-threatening emergency where you cannot consent.
  • Consent (Article 6(1)(a)): where I ask your permission to share information with someone else, such as your GP or solicitor. You can withdraw consent at any time.

Because health information is special category data, I also rely on one of the following conditions under Article 9:

  • Health or social care (Article 9(2)(h) and Schedule 1 of the Data Protection Act 2018): processing needed to provide and manage your care, by a professional who is bound by a duty of confidentiality.
  • Vital interests (Article 9(2)(c)): to protect you or someone else in an emergency.
  • Legal claims (Article 9(2)(f)): where needed to establish, exercise or defend legal claims.
  • Explicit consent (Article 9(2)(a)): where I ask for your explicit consent to a particular use.

Confidentiality and its limits

What you tell me is confidential. I will not share your information without your consent, except in these situations:

  • Safety and risk: if I am concerned about your safety or the safety of others, including children or vulnerable adults, I may need to share information to get appropriate help. Where possible, I will talk to you first.
  • Legal requirements: a court or other legal authority may require me to disclose records, and the law places duties on me in relation to certain serious crimes. If you think this may apply to you, please tell me in advance.
  • Supervision: the HCPC requires me to have regular clinical supervision. I may discuss my work with a supervisor or professional colleagues, in a professional setting, with your identity kept anonymous as far as possible.
  • Other professionals: depending on the nature of your referral, I may need to liaise with others involved in your care, such as your GP, solicitor, or insurance and rehabilitation companies. I will ask your permission before contacting them, unless I am required by law or acting to protect someone’s safety.

Who I share information with (service providers)

I use a small number of trusted providers to run my practice. Most act on my instructions and are bound by data processing agreements. These include:

  • Google Workspace (Google): email, secure backup of my records on Google Drive, and Google Meet for online sessions
  • Notability (Ginger Labs): the app where I write and keep your clinical notes, each individually password-protected and stored on my encrypted device
  • Hnry (my accountancy provider): acts as a separate data controller under its own privacy policy, and sees some billing details, including your surname but not your first name
  • WordPress and Jetpack (Automattic): host my website, store contact form messages and provide basic visitor statistics

I do not use AI or transcription tools to record, transcribe or summarise your sessions.

Transfers outside the UK

Some of my providers store or process data outside the UK. Google Workspace (email, backups on Google Drive and Google Meet) stores data in Google data centres worldwide. Google’s data processing terms include the UK Addendum to the EU Standard Contractual Clauses, which is a UK-approved safeguard for these transfers. WordPress and Jetpack (Automattic, a US company) may process website data, including contact form messages and visitor statistics, in the United States, under the same UK Addendum safeguard. Hnry, my accountancy provider, may process the limited billing details it receives in the UK, Europe and other countries, as set out in its privacy policy.

How I keep your information secure

Your clinical notes are kept in Notability, where each record is individually password-protected, and I use multi-factor login. Backups are held in Google Drive (through Google Workspace) and on an encrypted hard drive. My devices are password-protected and encrypted. Only I have access to your records. Sensitive documents, such as reports, are sent by encrypted email.

Communicating with me

Email and text are convenient but not completely secure. By agreeing to use them, you accept this small risk for appointment and administrative matters. I would ask you to avoid sending detailed clinical information by email.

I do not monitor email or phone messages for emergencies. If you are in crisis, please contact your GP, call NHS 111, call Samaritans on 116 123, or call 999 in an emergency.

Online sessions take place on Google Meet and are not recorded. Please make sure you are in a private place where no one else can hear or see the session.

How long I keep your information

I keep clinical records for 7 years after your therapy ends, then securely delete or destroy them, including backups. Billing records are kept for 7 years for tax and accounting purposes. If you contact me and we do not go on to work together, I delete your enquiry after 12 months.

Your rights

You have the right to:

  • Access the personal information I hold about you
  • Rectification: ask me to correct information that is inaccurate or incomplete
  • Erasure: ask me to delete your information in certain circumstances
  • Restriction: ask me to limit how I use your information in certain circumstances
  • Object to certain uses of your information
  • Portability: ask for information you gave me to be transferred to you or another organisation, in certain circumstances
  • Withdraw consent at any time, where I rely on consent

These rights are not absolute. For example, I may need to keep clinical records for the legal retention period even if you ask me to delete them, and I will explain if this applies.

There is no charge to make a request. I will respond within one month. To make a request, contact me at samuel@kindsetpsychology.com.

Website, cookies and analytics

My website is hosted by WordPress and uses the Jetpack plugin to collect basic visitor statistics: the number of page views and visitors, visitors’ country of origin and the website they came from. I use this information in aggregate to understand how the site is used and to improve it.

The site stores one small item on your device, called wpEmojiSettingsSupports, which WordPress uses to check that emoji display correctly. It does not identify or track you. I do not use advertising or marketing cookies.

If you use the contact form, the details you enter are emailed to me and a copy is stored on my website by WordPress. I delete these website copies every 3 months. The emailed copy is kept in my email account and deleted after 12 months if we do not go on to work together. If we do, relevant information becomes part of your clinical record.

Complaints

If you are unhappy with how I have handled your information, please contact me first at samuel@kindsetpsychology.com. I will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO):

If you have concerns about my professional conduct, you can contact the HCPC at https://www.hcpc-uk.org.

Changes to this policy

I may update this policy from time to time. The current version is always on this website, with the date above.