Privacy Policy

Last Updated: 19 Ottobre, 2026

This privacy policy applies between you, the User of this Website, and Resilient Wellbeing Ltd (trading as Resilient Wellbeing Clinic), the owner and provider of this Website (hereafter referred to as “we,” “us,” “our,” or “the Clinic”). Resilient Wellbeing Clinic takes the privacy of your information very seriously. This privacy policy applies to our use of any and all data collected by us or provided by you - or your child - in relation to the services you (or your child) require from us and in relation to the use of the Website.

1. Definitions and Interpretation

In this privacy policy, the following definitions are used:

• Data: Collectively all information that you submit to Resilient Wellbeing Clinic via the Website or via other channels (e.g., email, phone) for the provision of services. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.

• Cookies: A small text file placed on your computer by this Website when you visit certain parts of the Website and/or when you use certain features of the Website. Details of the cookies used by this Website are set out below (see Cookies).

• Data Protection Laws: Any applicable law relating to the processing of personal Data, including but not limited to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and any national implementing and supplementary laws, regulations, and secondary legislation.

• GDPR: Refers to the UK General Data Protection Regulation.

• Resilient Wellbeing Ltd trading as Resilient Wellbeing Clinic / we / us: A company incorporated in England and Wales with registered number 12872501 whose registered office is at Unit 2, Bedford Mews, East Finchley, London, N2 9DF.

• UK and EU Cookie Law: The Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by subsequent regulations.

• User / you: Any third party that accesses the Website and is not either (i) employed by Resilient Wellbeing Clinic and acting in the course of their employment or (ii) engaged as a self-employed consultant or otherwise providing services to Resilient Wellbeing Clinic and accessing the Website in connection with the provision of such services.

• Therapist: Refers to the self-employed or employed psychologists who provide therapeutic services to you or your child under or in connection with the Clinic.

• Website: The website that you are currently using, https://resilientwellbeingclinic.com, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

• Third Parties: External organisations or individuals who receive or process personal information in connection with our services. Depending on their activities, they may act as processors on our behalf or as independent or joint controllers.

Unless the context requires a different interpretation:

1. The singular includes the plural and vice versa.

2. A reference to a person includes firms, companies, government entities, trusts, and partnerships.

3. “Including” is understood to mean “including without limitation.”

4. Reference to any statutory provision includes any modification or amendment of it.

2. Scope of This Privacy Policy

This privacy policy applies only to the actions of Resilient Wellbeing Clinic and Users with respect to this Website and the services we offer. It does not extend to any websites that can be accessed from this Website, including but not limited to any links we may provide to social media websites.

For purposes of the applicable Data Protection Laws, Resilient Wellbeing Clinic is the “data controller.” This means that we determine the purposes for which, and the manner in which, your (or your child’s) Data is processed when you engage with our Clinic’s services or this Website. For more details on our data controller status (including the role of employed vs. self-employed therapists), please refer to Section 6 below.

3. What Information Do We Collect?

We may collect the following Data (which includes personal data) from you or your child:

• Personal identity data such as name and date of birth;

• Gender;

• Job title;

• Profession;

• Contact information such as address, email addresses, and telephone numbers;

• Demographic information such as postcode, preferences, and interests;

• Financial information such as credit/debit card numbers;

• Healthcare providers supporting you (e.g., GP/GP surgery details);

• Health insurance details (if referred by a health insurance company): referral information, authorisation for psychological services, number of sessions authorised, policy number, etc.;

• IP address (automatically collected);

• Web browser type and version (automatically collected);

• Operating system (automatically collected);

• A list of URLs starting with a referring site, your activity on this Website, and the site you exit to (automatically collected).

We may also collect, store, and use the following “special categories” of information about you or your child:

• Health information (including any medical condition or disability) necessary for understanding if you/your child require additional support;

• Therapy records (e.g., letters, outcome measures and/or reports, summary of therapy session content).

How We Collect Data

1. Data given to us by you or your child:

When you contact us through the Website, by telephone, post, email, or any other means;
When you register with us and set up an account to receive our services;
When you complete surveys that we use for research purposes (though you are not obliged to respond);
When you make payments to us, via the Website or otherwise;
When you select to receive marketing communications from us;
When you use our services.

2. Data received from third parties:

Where relevant to your enquiry or care, we may receive:

Referral information, relevant clinical history and correspondence from GPs, referring clinicians or other healthcare professionals.
Referral, authorisation, funding and claims information from insurers or other agreed funders.
Contact details, relevant background information and information about parental responsibility or other authority from parents, guardians or authorised representatives.
Technical information about website use from analytics providers, where permitted by applicable cookie and data protection requirements.

We use this information only where necessary and lawful for the purposes explained in this policy.

3. Data collected automatically:

Some information about your visit to the Website (IP address, date, times, frequency, how you interact with content).
Data collected via cookies, in line with your browser’s cookie settings. See Cookies.

3.1 Information needed to provide our services:

We need certain information to arrange and provide our services, including identification and contact details, appointment and payment information, and relevant information needed to assess suitability and provide care safely. Where someone acts on another person’s behalf, we may also need information confirming their authority.

We will explain which information is required and which is optional. If necessary information is not provided, we may be unable to arrange an appointment, administer payment or provide some or all of the requested services. Optional information and consent to marketing are not conditions of receiving treatment.

4. How We Use Data

We use personal information for the following purposes:

Enquiries, bookings, treatment and payment administration: Article 6(1)(b), where necessary to enter into or perform a contract with you.
Providing and coordinating care where the person receiving treatment is not the contracting party: Article 6(1)(f), where necessary for our legitimate interests in delivering and administering appropriate care, subject to the individual’s rights and interests.
Service management, necessary record keeping, security, complaints and establishing or defending legal claims: Article 6(1)(f), where necessary for our legitimate interests in operating a safe service, resolving concerns and protecting legal rights.
Compliance with applicable legal obligations: Article 6(1)(c), including relevant accounting, regulatory and data protection requirements.
Activities requiring consent: Article 6(1)(a), where we explain the activity and obtain valid consent.

We rely on legitimate interests only where the processing is necessary and those interests are not overridden by the individual’s rights and interests.

Health and other special category information

In addition to an Article 6 basis, we require an appropriate Article 9 condition to process health and other special category information.

For assessment, treatment, care coordination, clinical safeguarding and the management of healthcare services, we rely on Article 9(2)(h) and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This processing is carried out by or under the responsibility of an appropriate professional, or by a person subject to the required duty of confidentiality.

Where necessary to establish, exercise or defend legal claims, we rely on Article 9(2)(f). Where a separate disclosure or activity relies on explicit consent, we use Article 9(2)(a) and explain what that consent covers.

Consent to treatment is separate from the lawful basis for processing information. Ending treatment does not automatically require deletion of records that we must lawfully retain.

Marketing

We send electronic marketing with consent or, where all legal requirements are met, under the products and services soft opt-in.

The soft opt-in applies only where we obtained your contact details directly during a sale or discussion about purchasing our services, promote our own similar services, and offered a clear opportunity to opt out both when collecting your details and in every subsequent marketing message.

Where applicable, our Article 6 basis is consent or our legitimate interests in promoting relevant services. We do not use health or therapy information to select or target marketing without explicit consent.

You may stop marketing at any time using the unsubscribe option or by contacting info@resilientwellbeingclinic.com. This does not affect treatment or necessary appointment communications.

Children’s information

The same data protection requirements apply to children’s information, with particular consideration for their interests, understanding and confidentiality. Where a parent or guardian contracts for treatment, we do not rely on that contract alone as the Article 6 basis for processing the child’s information.

Consent to treatment and parental involvement are assessed according to the child’s competence and applicable legal and professional requirements. A parent or guardian does not automatically have unrestricted access to a child’s clinical information.

Automated decisions

We do not make decisions producing legal or similarly significant effects about your care solely through automated processing.

5. Who We Share Data With

We share relevant information only where necessary and lawful, with:

Practitioners involved in your care and authorised administrative personnel.
Providers supporting our clinical systems, communications, website, secure storage and payments.
GPs, referring professionals and other healthcare services where appropriate for care coordination.
Insurers where necessary for authorised treatment, claims or payment administration.
Professional advisers, including accountants, lawyers and insurers, where necessary for their work.
Emergency services, safeguarding bodies, regulators, courts or other authorities where disclosure is legally required or otherwise lawfully justified.

Access and disclosures are limited to the information needed for the relevant purpose. Confidential clinical information is shared with appropriate consent or another lawful justification consistent with confidentiality obligations.

Where necessary for urgent protection or safeguarding, information may be disclosed without prior consent. Such disclosures must have a lawful basis and be necessary and proportionate.

We put appropriate contractual safeguards in place where providers process information on our behalf. Other recipients may act as independent controllers for their own lawful activities.

6. Responsibility for Your Personal Information

Resilient Wellbeing Ltd, trading as Resilient Wellbeing Clinic, is the controller of personal information processed for the Clinic’s services, including administration and official clinical records.

Employees process information under the Clinic’s authority. Self-employed practitioners act as processors for activities carried out on the Clinic’s behalf under its documented data-processing instructions. They retain independent professional judgment in providing treatment.

Where a practitioner independently determines a separate lawful purpose for processing, such as defending a professional claim, they act as a controller for that separate activity.

Access is restricted to authorised individuals who need information for their role. Requests concerning information held by the Clinic should be sent to info@resilientwellbeingclinic.com.

7. Keeping Data Secure

We use appropriate technical and organisational measures to safeguard your (or your child’s) Data, including:

• Password protection for user accounts and access to therapy notes;

• Secure servers;

• SSL encryption (typically indicated by a lock icon in the browser) for payment transactions;

• Antivirus and malware protection on devices used to store data;

• Password-protected attachments for sensitive communications, where appropriate.

If you suspect any misuse, loss, or unauthorized access of your Data, please contact us immediately at info@resilientwellbeingclinic.com.

For tips on how to protect your own data and devices, you may wish to visit https://www.getsafeonline.org/.

8. Data Retention

We retain personal information for as long as necessary for the relevant purpose, taking account of care needs, legal and professional obligations, insurance requirements and the establishment or defence of claims.

Our normal retention periods are:

Adult clinical records: Seven years after treatment ends.
Children’s clinical records: Until the individual’s 25th birthday, subject to any justified longer period.
Invoices and accounting records: Seven years after the end of the relevant accounting period.

A longer period may be necessary for ongoing care, a complaint, claim, safeguarding matter or another specific legal or professional requirement. We review such retention and restrict use to the relevant purpose.

For enquiries that do not lead to treatment, retention depends on whether the enquiry remains active and whether information is needed for a related complaint, legal obligation or claim. We assess deletion requests against those needs.

We retain minimal marketing suppression information where necessary to respect an objection to marketing.

When information is no longer needed, it is securely deleted or anonymised. Residual backup copies remain protected and are removed through the applicable backup cycle, unless a specific lawful preservation requirement applies.

9. Your Rights and Data Protection Complaints

Depending on the processing and applicable legal conditions, you may request:

Access to your personal information.
Correction of inaccurate or incomplete information.
Deletion or restriction of processing.
Transfer of qualifying information in a portable format.
An objection to processing based on legitimate interests.

You may object to direct marketing at any time.

Where processing relies on consent, you may withdraw that consent without affecting processing lawfully carried out beforehand.

These rights are subject to applicable conditions and exemptions. For example, records may need to be retained for lawful healthcare or legal purposes. Where a request cannot be met in full, we will explain the reason as required by law.

Contact info@resilientwellbeingclinic.com to exercise your rights. We may request proportionate information to verify identity or authority. We respond within the applicable statutory time limits, normally one month for an access request, and explain any lawful extension. Requests are normally free; a fee or refusal is permitted only where the law allows.

Children have their own data protection rights. Requests made on their behalf are assessed according to competence, authority, confidentiality and applicable law.

You may also complain about our handling of personal information using the same email address. We normally acknowledge complaints within five working days and, in any event, within the statutory acknowledgement period. We investigate appropriately, provide relevant progress updates and communicate the outcome without undue delay.

You have the right to complain to the UK data protection regulator. Information about making a complaint is available at https://ico.org.uk/make-a-complaint/.

10. International Transfers

Our practice-management, communications, video-consultation, payment and website providers may process personal information outside the UK, including in the United States.

Where required, transfers are covered by UK adequacy arrangements, including the UK Extension to the EU–US Data Privacy Framework for eligible recipients, or contractual safeguards such as Standard Contractual Clauses with the UK Addendum.

Practitioners and staff require prior Clinic approval for overseas access to client information, subject to applicable security and transfer requirements.

For further information about our international transfers, including how to obtain a copy of the relevant safeguards, contact info@resilientwellbeingclinic.com.

11. Links to Other Websites

Our Website may, from time to time, provide links to other websites. We have no control over such external sites and are not responsible for their content. This privacy policy does not extend to your use of such sites; you are advised to review their own privacy policies.

11.1 Unauthorised Use of Business Information

All content, details, and information related to our business, including but not limited to our name, logo, products, services, images, and text, are proprietary to us. Unauthorized copying, reproduction, republishing, uploading, posting, transmitting, or duplicating of any of the material is prohibited without express written permission.

Any unauthorized listing, use, or distribution of our business information on third-party platforms or directories without our explicit consent is strictly prohibited. Offenders may be subject to legal action. We reserve the right to protect our intellectual property, reputation, and brand identity.

12. Changes of Business Ownership and Control

Resilient Wellbeing Clinic may expand or reduce our business. This may involve the sale and/or transfer of control of all or part of the Clinic. Where relevant, Data provided by Users will be transferred along with that part of the business so that the new owner or controlling party can continue to use the Data for the purposes for which it was originally supplied. We will always take steps to ensure your privacy rights continue to be protected.

13. Cookies and Similar Technologies

Our website uses cookies and similar technologies for the purposes explained in our Cookie Policy.

Where consent is legally required, the relevant technologies will not be used before that consent is obtained. Technologies used without consent must meet an applicable legal exemption and its conditions, including any required information and objection mechanism.

You can manage relevant choices through the website’s cookie controls. The Cookie Policy explains the technologies used, their purposes and duration, relevant providers and available choices.

Browser settings may offer additional controls but do not replace consent where it is required.

We may also allow external third-party organisations to place Cookies on the Website for functionality, analytics, or other purposes. More details are set out in our Cookie Policy.

14. Your legal rights

This policy explains how we handle personal information. It does not limit your statutory data protection rights, your right to complain to the UK data protection regulator, or your right to seek a legal remedy.

15. Changes to This Privacy Policy

We review this policy when our processing activities or legal requirements change. The current version and its update date will be published on our website.

Where required, we will bring material changes to your attention before the relevant processing begins. Continuing to use the website does not constitute consent to new processing that requires consent.

If you have any questions or concerns about this policy or wish to exercise any of your rights, please contact us by email at:

info@resilientwellbeingclinic.com