Privacy Policy
The Devon Clinic Privacy Policy
Last updated: 21 August 2026
1. Who we are
The Devon Clinic CIO is a registered charity providing a range of mental health, wellbeing and therapeutic services.
The Devon Clinic is committed to respecting your privacy, protecting your personal information and handling your information lawfully, fairly and securely.
For the purposes of this policy, “The Devon Clinic”, “we”, “us” and “our” refer to The Devon Clinic CIO.
Our contact details are:
The Devon Clinic CIO
Telephone: 01803 500300
Email: reception@devonclinic.co.uk
Website: devonclinic.co.uk
Registered Charity Number: 1198409
If you have any questions about how we collect, use or store your information, please contact us using the details above.
2. What this Privacy Policy covers
This Privacy Policy explains:
what personal information we collect;
why we collect it;
how we use it;
how it may be shared;
how long we keep it;
how we protect it;
how clinical records are managed;
how we handle information relating to children and young people; and
your rights regarding your personal information.
This policy applies to people who:
contact The Devon Clinic;
enquire about our services;
become clients;
are referred to us by another organisation;
attend a workshop, course or programme;
participate in a funded project;
make a donation or take part in fundraising;
use our website;
subscribe to communications from us; or
otherwise provide personal information to The Devon Clinic.
3. The information we may collect
The information we collect depends upon your relationship with us and the service you are receiving.
This may include:
Personal and contact information
your name;
address;
telephone number;
email address;
date of birth;
emergency contact details; and
information about a parent, guardian, carer or other relevant person where appropriate.
Information relating to your treatment or support
Depending upon the service you receive, we may process information about:
your physical health;
mental health;
emotional wellbeing;
medication;
medical history;
previous or current treatment;
disability or additional needs;
information relating to trauma or difficult life experiences;
safeguarding concerns;
family or relationship circumstances;
information you choose to disclose during assessment or treatment; and
information necessary to provide safe and appropriate support.
Health information and certain other information is classed as special-category personal data and is given additional protection under UK data-protection law.
We will only collect information that is reasonably necessary for the service being provided or for another legitimate purpose.
Referral information
If you have been referred to us by another organisation, we may receive information from organisations such as:
charities;
healthcare providers;
local authorities;
community organisations;
schools or education providers;
employers;
funding organisations; or
other agencies involved in your support.
We will only use information received through a referral where there is an appropriate lawful basis for doing so.
Financial information
Where appropriate, we may collect information relating to:
payments;
invoices;
donations;
Gift Aid;
refunds; and
financial transactions with The Devon Clinic.
We will not retain payment-card information unless this is necessary and lawful. Payments may be processed through third-party payment providers.
Website and technical information
When you use our website, certain technical information may be collected automatically, including:
IP address;
browser type;
device information;
pages visited;
date and time of visits;
referral source; and
cookie or analytics information where applicable.
Please also see our Cookies Policy.
4. Why we use your personal information
We may use your personal information to:
respond to an enquiry;
arrange appointments;
assess whether a service is suitable for you;
provide counselling, therapy, treatment or support;
allocate you to an appropriate practitioner;
manage referrals;
communicate with you about appointments or services;
administer funded programmes;
monitor the effectiveness of our services;
manage safeguarding concerns;
process payments;
administer donations and Gift Aid;
manage complaints;
meet our legal, regulatory and charitable obligations;
improve the services we provide;
protect clients, practitioners, staff and visitors;
keep appropriate financial and organisational records;
send information or marketing where we have a lawful basis to do so; and
operate and improve our website.
We will not use personal information for purposes that are incompatible with the reason it was originally collected unless we have a lawful reason to do so.
5. Our lawful basis for using your information
UK data-protection law requires us to have an appropriate lawful basis for processing personal information.
Depending upon the circumstances, we may rely upon:
Contract
Where processing is necessary to provide a service that you have requested or to take steps before providing that service.
Legal obligation
Where we are required to process information in order to comply with the law.
Legitimate interests
Where processing is reasonably necessary for the legitimate operation of The Devon Clinic and those interests do not override your rights and interests.
This may include administration, service improvement, responding to enquiries, maintaining appropriate business records and protecting the security of our organisation.
Consent
Where we rely upon your consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.
Vital interests
In exceptional circumstances, information may be processed where this is necessary to protect someone’s life.
6. Health and other special-category information
The nature of our work means that we may need to process information concerning physical health, mental health and other particularly sensitive matters.
This is known as special-category data.
Where we process special-category information, we will ensure that an appropriate condition under data-protection law applies in addition to our ordinary lawful basis.
Depending upon the service and circumstances, this may include:
explicit consent;
provision of health or social care where the relevant legal requirements apply;
protection of vital interests;
establishment, exercise or defence of legal claims;
safeguarding or substantial public-interest provisions where applicable; or
another condition permitted by law.
We will only process sensitive information where it is necessary and appropriate.
7. Clinical records and practitioner responsibilities
The Devon Clinic works with practitioners from a number of professional disciplines.
Practitioners may be registered with, accredited by or members of different professional, governing, registering or accrediting bodies.
All practitioners working from The Devon Clinic are expected to comply with:
applicable data-protection legislation;
The Devon Clinic’s confidentiality and data-protection requirements;
safeguarding requirements;
the ethical and professional standards relevant to their profession;
the requirements of their professional, governing, registering or accrediting body; and
relevant requirements imposed by their professional indemnity insurer.
Practitioners are responsible for ensuring that their clinical records are created, maintained, secured and retained appropriately.
Professional requirements can vary between disciplines.
For this reason, The Devon Clinic does not impose a single maximum retention period that overrides the professional obligations of individual practitioners.
Where a practitioner’s governing, registering, accrediting or professional body requires or recommends a particular retention period, that guidance must be followed.
The same applies where an insurer, legal obligation or safeguarding requirement requires information to be retained for longer.
8. Our general policy on written client records
The Devon Clinic’s general policy is that written client records should be securely destroyed six months after the client’s final appointment or the conclusion of their treatment.
This is our normal default position.
However, the six-month period does not apply where a longer retention period is required or recommended because of:
requirements or guidance issued by the practitioner’s professional, governing, registering or accrediting body;
professional indemnity insurance requirements;
safeguarding concerns;
an ongoing complaint;
an actual or potential legal claim;
a legal or regulatory obligation;
the age of the client;
the nature of the treatment or information concerned; or
another legitimate professional or legal reason.
Where one of these circumstances applies, the longer appropriate retention period will take precedence over The Devon Clinic’s general six-month policy.
Practitioners are responsible for understanding the retention requirements applicable to their own profession.
Records must be securely stored throughout the period for which they are retained.
When records are no longer required, they will be securely destroyed or deleted.
9. Other information and retention periods
The six-month clinical-record policy does not mean that every piece of information held by The Devon Clinic will automatically be deleted after six months.
Different information must be retained for different periods.
For example, we may need to retain:
financial and accounting records;
Gift Aid information;
funding records;
contracts;
complaints;
safeguarding records;
accident or incident records;
employment information;
insurance-related information; and
information relating to legal claims
for longer periods where required by law, regulation, contractual obligations or legitimate organisational requirements.
We will not retain identifiable personal information indefinitely without justification.
Retention periods will be reviewed periodically and information will be securely deleted, destroyed or anonymised when there is no longer a legitimate reason to retain it.
10. Children and young people
The Devon Clinic provides some services to children and young people and therefore may collect and process their personal information.
We recognise that children and young people require particular protection when their personal information is being used.
Where we work with a child or young person, we will take into account:
their age;
their understanding;
their ability to make decisions regarding their information;
parental responsibility where relevant;
safeguarding responsibilities;
confidentiality;
the best interests of the child; and
the professional obligations of the practitioner providing the service.
Where appropriate, information about privacy and confidentiality will be explained to children and young people in language they can reasonably understand.
There may be circumstances in which information needs to be shared without the consent of the child, young person or parent, particularly where there is a safeguarding concern or legal requirement.
11. Confidentiality
Information shared during therapy or treatment will normally be treated as confidential.
However, confidentiality is not absolute.
There may be circumstances in which a practitioner or The Devon Clinic considers it necessary or is legally required to disclose information.
Examples may include:
concerns about the safety of a child or vulnerable person;
a serious and immediate risk of harm;
safeguarding concerns;
legal requirements;
court orders;
prevention or detection of serious crime; or
situations where disclosure is otherwise required or permitted by law.
Where reasonably possible and appropriate, the person concerned will be informed before information is shared.
12. Sharing your information
We do not sell your personal information.
We will only share personal information where there is a legitimate and lawful reason to do so.
Depending upon the circumstances, information may be shared with:
the practitioner providing your treatment;
authorised members of The Devon Clinic team;
organisations that referred you to us where appropriate;
healthcare or social-care professionals;
safeguarding organisations;
emergency services;
regulatory or statutory authorities;
professional advisers;
insurers;
funders where appropriate;
IT, communications, CRM, booking or cloud-service providers;
payment-processing providers;
website-hosting or analytics providers; or
other organisations where sharing is necessary and lawful.
Where an external organisation processes personal information on our behalf, we will take reasonable steps to ensure that appropriate data-protection arrangements are in place.
Where we provide reports to funders, commissioners, trustees or other organisations for monitoring and evaluation purposes, we will use anonymised or aggregated information wherever reasonably possible.
13. Practitioners and data-controller responsibilities
Some practitioners working from The Devon Clinic may have their own legal and professional responsibilities regarding client information.
Depending upon the circumstances and the arrangements under which a service is provided, a practitioner may act as an independent data controller for some clinical information they create and retain.
Where this applies, the practitioner is responsible for meeting their own obligations under data-protection legislation as well as complying with the professional standards that apply to them.
Where The Devon Clinic controls the purposes and means by which personal information is processed, The Devon Clinic will remain responsible for that processing.
14. Information security
We take reasonable technical and organisational steps to protect personal information from:
unauthorised access;
loss;
misuse;
alteration;
accidental disclosure; and
unlawful destruction.
Measures may include:
password protection;
access controls;
secure computer systems;
appropriate physical storage;
secure disposal of written records;
encryption where appropriate;
limiting access to people who need the information;
staff and practitioner confidentiality requirements; and
appropriate arrangements with organisations processing data on our behalf.
No electronic system can be guaranteed to be completely secure, but we take reasonable measures appropriate to the sensitivity of the information we hold.
15. Data breaches
A personal-data breach may include the accidental or unlawful loss, destruction, alteration, disclosure of or access to personal information.
Where a data breach occurs, we will investigate it and take appropriate action.
Where required by law, we will report a breach to the Information Commissioner’s Office and, where appropriate, inform individuals who may be significantly affected.
16. Your data-protection rights
Depending upon the circumstances, you may have the right to:
Be informed
You have the right to understand what information is collected about you and how it is used.
Access your information
You may request a copy of personal information held about you.
Rectification
You may ask us to correct inaccurate information or complete information that is incomplete.
Erasure
In some circumstances, you may ask us to delete personal information.
The right to erasure is not absolute. We may need to retain information where there is a legal, safeguarding, professional, insurance or other lawful reason to do so.
Restriction of processing
In certain circumstances, you may ask us to restrict how your information is used.
Object to processing
You may have the right to object to particular types of processing, including direct marketing.
Data portability
In certain circumstances, you may have the right to receive information you provided to us in a structured, commonly used and machine-readable format.
Withdraw consent
Where we rely upon consent, you may withdraw that consent at any time.
Complain
You have the right to raise a concern with us about how your information has been handled.
You also have the right to make a complaint to the Information Commissioner’s Office.
Some rights are subject to exemptions and will depend upon the circumstances in which your information is being processed.
17. Access to clinical notes
A request for access to clinical records will be handled in accordance with applicable data-protection law.
Clinical notes may contain sensitive information and, in some circumstances, information concerning another person.
There may therefore be limited circumstances where information has to be redacted or cannot lawfully be disclosed.
Requests should initially be made to:
18. Marketing
We may contact you about services, events, fundraising activities or other matters where we have an appropriate lawful basis to do so.
Where consent is required for electronic marketing, we will obtain that consent.
You may unsubscribe from marketing communications at any time.
Stopping marketing communications will not prevent us from contacting you about an existing appointment, treatment, donation, transaction or another matter where communication is necessary.
We do not sell mailing lists or personal information to third-party advertisers.
19. Fundraising and donations
If you make a donation or participate in fundraising for The Devon Clinic, we may process personal information required to:
administer your donation;
process payments;
claim Gift Aid where appropriate;
communicate with you regarding fundraising;
maintain legally required financial records; and
understand and improve our fundraising activities.
Where required, financial and Gift Aid records may be retained for longer than other categories of personal information in order to comply with legal and accounting obligations.
20. Funded services and outcome monitoring
Some services provided by The Devon Clinic are supported by grants, commissioners or other funding organisations.
Where you receive a funded service, we may collect information required to demonstrate that the project is operating effectively.
This may include:
attendance;
demographic information;
referral information;
assessment or outcome measures;
questionnaires;
feedback; and
information about the effect of the support received.
Wherever reasonably possible, information supplied to funders for monitoring purposes will be anonymised or aggregated so that individual clients cannot be identified.
Where identifiable information needs to be shared, we will ensure that there is an appropriate lawful basis for doing so.
21. Cookies and website analytics
Our website may use cookies and similar technologies.
Cookies may be used to:
make the website function correctly;
remember preferences;
understand how visitors use the website;
measure website performance; and
support marketing or advertising where appropriate.
Cookies that are not strictly necessary will only be used where permitted by applicable law and where any required consent has been obtained.
You can change your cookie preferences through the facilities provided on our website or through your browser settings.
Please see our separate Cookies Policy for further information.
22. Third-party websites
Our website may contain links to websites operated by other organisations.
The Devon Clinic is not responsible for the privacy practices of third-party websites.
If you follow an external link, you should review the privacy policy of that organisation.
23. Automated decision-making
The Devon Clinic does not normally make decisions about clients that have legal or similarly significant effects solely by automated means.
If this changes, we will provide appropriate information about the processing and comply with any additional legal requirements.
24. Transfers outside the UK
Some organisations providing technology, cloud, communications or other services to The Devon Clinic may process information outside the United Kingdom.
Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate lawful transfer mechanism and suitable safeguards are in place where required.
25. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
changes in legislation;
changes to regulatory guidance;
changes to our services;
changes to the technology we use; or
changes to the way The Devon Clinic operates.
The current version will be published on our website together with the date on which it was last updated.
26. Contacting us
If you:
have a question about this Privacy Policy;
would like to know what information we hold about you;
want information corrected;
want to exercise a data-protection right;
have concerns about how your information has been used; or
wish to make a complaint
please contact:
The Devon Clinic CIO
Telephone: 01803 500300
Email: reception@devonclinic.co.uk
If you remain dissatisfied with the way we have dealt with your personal information, you may also complain to the Information Commissioner’s Office.