Dr Tina Vaughan – Clinical Psychologist
Last updated: 7 October 2026

I am committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how I collect, use, store and protect personal data when you contact me or receive psychological services from me.

I process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with relevant professional and regulatory requirements.

1. Who I am

I am Dr Tina Vaughan, Clinical Psychologist, an independent sole-trader practitioner.

For the purposes of data protection law, I am the Data Controller for the personal information I hold about you.

Email: drtinavaughan@gmail.com
ICO registration: ​ZA806680

If you have any questions about how your personal information is handled, you can contact me using the details above.

2. What information I collect

Depending on the service you are receiving and how you contact me, I may collect and process the following information:

Personal and contact information

  • Name

  • Contact details, such as email address, telephone number and postal address

  • Date of birth or age

  • Emergency contact details where relevant

Information relating to your psychological care

This may include information about your mental and physical health, psychological history, current circumstances, assessments, clinical observations, formulations, treatment or intervention, and your progress.

This may also include information you choose to share about other aspects of your life where this is relevant to the psychological service being provided.

Administrative and financial information

  • Appointment dates and times

  • Records of correspondence and enquiries

  • Payment records

  • Information needed for accounting and financial administration

3. How I collect your information

I may collect information:

  • When you contact me by email, telephone, through my website or by another agreed method

  • When you make an enquiry or arrange an appointment

  • During psychological appointments

  • Through information you provide as part of an assessment or intervention

  • From another professional or organisation where this is relevant and you have provided appropriate consent, or where there is another lawful basis for obtaining the information

  • Through online forms, questionnaires or other secure systems used as part of your care

I aim to collect only information that is relevant and necessary for providing and managing psychological services.

4. How I use your information

Your information may be used to:

  • Provide psychological assessment, intervention and support

  • Understand your needs and develop an appropriate formulation and plan

  • Maintain accurate clinical records

  • Communicate with you about appointments and your care

  • Manage payments and other practice administration

  • Meet professional, legal and regulatory responsibilities

  • Respond appropriately to safeguarding or other serious concerns

  • Maintain the security and effective operation of my practice

I do not use your personal information for purposes unrelated to your care or the running of my practice unless there is a lawful basis for doing so.

5. Lawful basis for processing

Under the UK GDPR, the lawful basis for processing your personal information will depend on the circumstances.

This may include:

Contract: where processing is necessary to provide the psychological services you have requested.

Legal obligation: where I need to process information to comply with a legal requirement.

Legitimate interests: where processing is necessary for the appropriate administration, management and development of my practice, provided this does not override your rights and interests.

Health or social care: information concerning your health is special category data. Where I process health information in connection with providing psychological services, I rely on the relevant UK GDPR conditions for health or social care provided by a regulated health professional.

Consent: where I specifically rely on your consent for a particular use of your information. Where consent is the lawful basis, you can withdraw it at any time, although this will not affect processing that has already taken place lawfully.

6. Confidentiality

As a clinical psychologist, I take the confidentiality of your information seriously.

Information you share with me will normally remain confidential and will only be shared with others where there is an appropriate lawful basis for doing so.

There may be circumstances in which confidentiality cannot be maintained, for example where:

  • There is a serious and significant concern about risk of harm to you or another person

  • There is a safeguarding concern

  • Disclosure is required by law, a court or another statutory authority

  • Disclosure is necessary to meet professional or regulatory requirements

Where it is appropriate and safe to do so, I will discuss any proposed disclosure with you beforehand.

7. Sharing your information and the services I use

I do not sell your personal information or share it for marketing purposes.

To provide and manage my psychological services, I use a small number of specialist digital services. These services may process personal information on my behalf as part of providing their functions.

Zanda

I use Zanda as my practice management system. Zanda is used for:

  • Managing appointments and bookings

  • Maintaining clinical notes and other clinical records

  • Managing client information

  • Sending relevant appointment communications

  • Managing invoices and payments

Zanda acts as a data processor in relation to personal information that I enter into the platform. Zanda states that data for UK practices is hosted in the UK and that its platform is subject to appropriate security and data protection measures.

Stripe

I use Stripe through Zanda to process secure card payments. Payment information is processed through Stripe rather than being recorded directly by me in my clinical notes. Zanda's Stripe integration allows card payments to be made through the Zanda system and states that Stripe is a PCI Service Provider Level 1.

Google Meet

I use Google Meet for online psychological appointments where this has been agreed with you. Information relating to an online appointment may therefore be processed by Google as part of providing the video-conferencing service.

I do not routinely record online sessions.

My website

My website, drtina.co.uk, provides information about my services and includes a contact form. Information you submit through the contact form may include your name, email address and any information you choose to include in your message.

I use information submitted through the website to respond to enquiries and, where appropriate, to arrange psychological services.

I only request information through the website that is reasonably necessary to respond to your enquiry. Please avoid including detailed or sensitive clinical information in an initial website enquiry.

Where another organisation processes personal data on my behalf, I take reasonable steps to ensure that appropriate contractual, security and data protection arrangements are in place.

8. How I protect your information

As an independent practitioner, I take the security of your personal and clinical information seriously.

I use electronic systems designed to support the secure management of healthcare information, including Zanda for clinical records and practice administration, and Stripe for payment processing.

My security measures include:

  • Password-protected accounts and devices

  • Appropriate access controls

  • Two-factor authentication where available

  • Secure electronic clinical record storage

  • Keeping software and devices appropriately updated

  • Limiting access to client information to what is necessary

  • Avoiding unnecessary paper records

  • Taking care when discussing or viewing confidential information in shared or public environments

Zanda states that data stored within its platform is encrypted both in transit and at rest and that access to client data is controlled.

I regularly review the systems and processes used within my practice to ensure that they remain appropriate for the type and sensitivity of information I hold.

9. Where your information is stored and processed

My practice is primarily paperless and clinical records are maintained electronically.

Clinical information and practice records are stored within the systems described in this Privacy Policy. In particular, Zanda states that information belonging to UK practices is hosted in AWS data centres within the United Kingdom.

Some services used by my practice may process information outside the UK as part of their operation. Where personal information is transferred outside the UK, appropriate safeguards will be used where required under UK data protection law.

I do not routinely download or store complete clinical records on my personal computer outside the clinical record system.

10. How long I keep your information

I retain your personal information only for as long as there is a legitimate and appropriate reason to do so.

Clinical records will be retained in accordance with applicable legal, professional and regulatory guidance. The appropriate retention period may depend on factors including the nature of the service provided and the age of the client.

Administrative and financial records, including payment and accounting information, will be retained for the period required by applicable tax and accounting requirements.

Information held by third-party systems such as Zanda and Stripe may also be subject to their own retention periods and policies.

When information is no longer required, I will take appropriate steps to securely delete or dispose of it.

11. Your data protection rights

Depending on the circumstances, you have rights under data protection law to:

  • Ask for a copy of the personal information I hold about you

  • Ask for inaccurate or incomplete information to be corrected

  • Ask for your information to be erased where there is no legal or legitimate reason for me to continue holding it

  • Ask for processing to be restricted in certain circumstances

  • Object to certain types of processing

  • Request transfer of certain personal information to another organisation where the right to data portability applies

  • Withdraw consent where I am relying on consent as the basis for processing

Some of these rights are subject to legal and professional limitations. For example, information may need to be retained where there is a legal or professional requirement to do so.

If you would like to exercise one of these rights, please contact me in writing. I may need to verify your identity before providing information.

12. Access to clinical records

You generally have the right to request access to personal information contained in your clinical records.

Requests will be considered in accordance with data protection law and relevant professional guidance. In some circumstances, information may be withheld or redacted, for example where disclosure would be likely to cause serious harm or would reveal confidential information relating to another person.

13. Website and cookies

My website may use cookies or similar technologies that are necessary for the website to function.

Where additional cookies or technologies are used to collect information about how visitors use the website, this will be explained in the website's Cookie Policy and, where required, your consent will be requested.

If you contact me through my website, the information you provide will be used to respond to your enquiry and, where relevant, to arrange psychological services.

14. Complaints

If you have concerns about the way I have handled your personal information, I encourage you to contact me first so that I can try to resolve the matter.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

ICO website: www.ico.org.uk

15. Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes to my practice, the systems I use, or relevant legal and regulatory requirements.

The most recent version will be available on my website and will show the date on which it was last updated.

Privacy Policy