Nicola Kennelly Psychology

Privacy Policy

In order for a child/young person to undergo a clinical psychology assessment and intervention we need those with parental responsibility, young people aged over 13 years, and those responsible for commissioning services to understand the privacy arrangements. This is in line with the General Data Protection Regulation (GDPR) which is a regulation in EU law on data protection and privacy for all individuals within the European Union. For the purposes of this regulation, Dr. Nicola Kennelly is the data controller and data processor.

  • What information is to be collected:
    Information will be collected (from children, young people, their carers and professionals involved) through direct questioning, questionnaires, and reviewing previous correspondence and documents. The legal reason for collecting this data will depend on the purpose of the assessment e.g. to understand and benefit the development or mental health of a child/young person, or to advise in care or legal proceedings. Please see the Information Commissioners Office website: for a further explanation of the legal reasons to collect data. The reason I collect data will be satisfied by one of the following legal reasons:
    • The individual whom the personal data is about has consented to the processing.
    • The processing is necessary for administering justice, or for exercising statutory, governmental, or other public functions.
    • The processing is in accordance with the "legitimate interests" condition.
      The information collected will be classified as sensitive personal data. Examples include identifying information, mental and physical health history, care history, and information about relationships and important third-party information. The legal reasons for collecting this information are:
    • The individual whom the sensitive personal data is about has given explicit consent to the processing.
    • The processing is necessary in relation to legal proceedings; for obtaining legal advice; or otherwise for establishing, exercising or defending legal rights.
    • The processing is necessary for medical purposes, and is undertaken by a health professional or by someone who is subject to an equivalent duty of confidentiality.
  • Where will the information be stored:
    Clinical notes, correspondence, and questionnaires will be kept in a hard copy psychology file (stored in a locked filing cabinet) and/or in an electronic file (on my laptop). The laptop is password protected and will be backed up on an encrypted hard drive. Some information may also be visible on a password protected mobile phone. Files, laptop, hard drive and phone will be carried and transferred by vehicle. Records will be kept until a young person is 25 years old and then be destroyed.
  • Consent:
    Consent must be appropriate to the age and capacity of the individual. Where appropriate one person with parental responsibility and children aged over 13 years old will be asked to provide their consent for an assessment/intervention to take place where appropriate. A summary of the privacy policy will be embedded into the consent form and the children will have a child friendly format. They will be directed to this privacy policy for further information. However please be aware of the following extract from the BPS Practice Guidelines (third edn.): 'young people who are deemed to be competent to make their own decisions 'Gillick competent' can give their own consent to involvement with a psychologist, and then parental consent is not required. Similarly, a young person who is 'Gillick competent' can give consent even if parents have declined to give consent; such young people can also ask that parents are not informed of any involvement, and this should be respected by the psychologist.'
  • Confidentiality:
    In general most things shared with me can remain confidential. By law though, some information will need to be shared if I am concerned that someone may come to some harm. Attempts will always be made to find an agreed solution together, as to how the information is shared if this is deemed necessary. This will not be possible in situations deemed as high risk.
  • Exceptions and other information sharing:
    • I advertise through my website, and through word of mouth and some information may be shared with me on first contact from commissioners and families who seek my support. My privacy policy will be visible on the website and attached to emails in response.
    • Anonymous information can be shared with my clinical supervisors to assist my practice, in line with my professional standards.
    • In a young person's best interests, some information can also be shared with other agencies and professionals for their wellbeing. For example parents, carers, care staff, teachers, social workers, and other health professionals may need information to meet a young person's needs; to manage risks; and to assess progress and outcomes. As professionals we tend to work as a team around a child or young person as integrated care planning is good practice. In such circumstances information could be shared in person, on the telephone, through letters, or anonymised or password protected emails. When sharing information in this way I will endeavour to share my opinion only. The law permitting, I will not share anything that you have specifically told me is confidential. If you have any objections and if you have any concerns about who I may share information with at the outset please let me know.
  • Rights, withdrawal of consent, complaints:
    Further information about your rights can be found on the website for the Information Commissioners Office (ICO): Consent is able to be withdrawn at any time. If you have a complaint about the way your data is managed please let me know in the first instance so I can assist on However if this is not handled to your satisfaction please also contact the ICO.