Judith Johnson PhD

Client privacy notice

Last updated: 26 September 2026

This notice is for people who have therapy with me, or who have an initial consultation with me. It explains what information I keep about you, why, who else may see it, how long I keep it and your rights. It sits alongside my website privacy notice, which covers enquiries, comments and subscriptions.

In brief

  • I keep a confidential clinical record of our work, as all registered psychologists must.
  • Your records are stored in Zanda, a secure practice management system, not in my ordinary email.
  • I only share information about you with your agreement, except in the rare situations described below.
  • I keep your records for 7 years after our last contact, then securely delete them.
  • You can ask to see your records at any time.

Who I am

I am Dr Judith Johnson, a Clinical Psychologist registered with the Health and Care Professions Council (HCPC number PYL30177). I work as a sole practitioner, and for the purposes of UK data protection law I am the controller of the information described in this notice. I am registered with the Information Commissioner’s Office (ICO), registration reference ZC258909.

My private practice is separate from my work at the University of Manchester and Manchester Catalys. Information about you is never shared with, or stored on the systems of, either organisation.

What information I keep

  • Contact and identity details: your name, date of birth, address, email address and phone number.
  • GP and emergency contact details: your GP’s details, and the name and phone number of someone I can contact in an emergency. Please let that person know you have given me their details.
  • Clinical information: what you tell me in your questionnaire and in our sessions, my notes of each session, any questionnaires or measures you complete, and letters or reports I write with your agreement. This will include information about your mental and physical health, and may include other sensitive information you choose to share.
  • Appointments and correspondence: the dates of our appointments, attendance and cancellations, and messages we exchange.
  • Billing information: invoices and payments. If you pay by card, your card details are handled by Stripe and I do not see or store them.
  • Your agreement: the Terms of Therapy and Consent form you sign.

Sessions are not recorded, by me or by the video service.

Why I use it and my lawful basis

I use your information to provide therapy safely and well, to keep the clinical records that my professional body and regulator require, to arrange appointments, to invoice you and to meet my legal and insurance obligations.

Under UK data protection law I need a lawful basis for this:

  • To provide therapy and run our agreement: this is necessary for the contract between us (UK GDPR Article 6(1)(b)).
  • Health information: I use this to provide health care, as a registered health professional bound by a duty of confidentiality (UK GDPR Article 9(2)(h), and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2). This means I do not rely on your consent to keep clinical records, because I need to keep them to practise safely. Your agreement to therapy itself is always voluntary, and you can stop at any time.
  • Tax and accounting records: I keep these because the law requires it (UK GDPR Article 6(1)(c)).
  • Supervision and insurance: I rely on my legitimate interests in practising safely and being properly insured (UK GDPR Article 6(1)(f)). If I ever needed to share health information with my insurer or legal adviser because of a complaint or claim, I would rely on UK GDPR Article 9(2)(f) (legal claims).
  • If someone is at serious risk: see “Confidentiality and its limits” below.

Confidentiality and its limits

What you tell me is confidential. I will not share information about you with anyone, including your GP or family, without your agreement, except in these rare situations:

  • if I believe you or someone else is at serious risk of harm;
  • if I have a safeguarding concern about a child or an adult at risk;
  • if a court orders me to, or the law otherwise requires it.

Where it is safe and practical, I would talk to you first before sharing anything, and I would share only what is needed.

Who else sees your information

I use the following services to run my practice. Zanda, and Zoom through Zanda, process your information on my behalf under a data processing agreement. Stripe, Google and WhatsApp also have their own privacy policies, which explain how they handle the information that passes through their services.

  • Zanda (practice management system): stores your records, forms, appointments and invoices, and sends appointment and invoice emails. My account is set up with Zanda’s UK service.
  • Zoom: provides the video sessions, through Zanda. Sessions are not recorded.
  • Stripe: processes card payments if you choose to pay by card.
  • Google (Gmail): for general email about practical arrangements. Please do not send clinical information by email; we can discuss it in session instead.
  • WhatsApp: I may use WhatsApp calls or messages for some appointments or practical arrangements, if you are happy with this. WhatsApp calls and messages are end-to-end encrypted, but WhatsApp (Meta) can see that we have been in contact. Please tell me if you would prefer me not to use it.

Other people who may see limited information about you:

  • My clinical supervisor: like all psychologists, I discuss my work in regular clinical supervision. I do this without using your name or details that would identify you. My supervisor is also bound by confidentiality.
  • My accountant and HM Revenue and Customs: they may see invoice and payment records (your name and the amounts paid), but not clinical information.
  • My professional indemnity insurer and legal advisers: only if there is a complaint, claim or legal matter, and only what is needed to deal with it.
  • Your GP or other professionals: only with your agreement, or in the situations described under “Confidentiality and its limits”.

I never sell your information or use it for marketing.

Transfers outside the UK

Some of these providers, or companies that support them, are based in or may process information in the United States or the European Union. Where this happens, they state that they use recognised legal safeguards for international transfers.

Keeping your information safe

My records are kept in Zanda, which is protected by encryption and two-factor authentication. I do not keep paper notes.

How long I keep it

  • Clinical records (including your forms, notes and correspondence): 7 years after our last contact, then securely deleted.
  • Invoices and payment records: for as long as tax law requires, then deleted.
  • If you only have an initial consultation and do not go on to have therapy, I will keep a brief note of the consultation for the same period, as it is still a clinical contact.

I may keep records for longer if there is an ongoing complaint, claim or legal matter.

Your rights

You have the right to:

  • ask for a copy of the information I hold about you, including your clinical notes;
  • ask me to correct information that is wrong or incomplete (if you disagree with something clinical I have written, I will add your view to the record);
  • ask me to delete your information, although I may need to keep clinical and financial records for the periods above;
  • ask me to restrict how I use your information, or object to my using it;
  • ask for your information in a format you can take elsewhere, where this applies.

There are some limited exceptions to these rights, for example where giving access could cause serious harm, or would reveal information about someone else. If one of these applied, I would explain why.

To make a request, please tell me in session, reply to any email from me, or use the contact form and say that your message is a privacy request. I will respond within one month, and there is no charge in most cases.

Complaints

If you have a concern about how I use your information, please talk to me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

I may update this notice from time to time. If I make an important change while you are a client, I will tell you. The date at the top shows when it was last changed.