GlitterBrain Psychology Data Privacy Policy
Last updated: 28th July 2026
Hey, you read the small print… me too!
Diving into the details is at the core of GlitterBrain Psychology, and that includes how we handle your data.
In this policy, “we”, “us” and “our” refers to Dr Emma Marie Williams, Principal Clinical Psychologist (HCPC Registration PYL36073), practising as a sole trader under the trading name GlitterBrain Psychology, supported by a small administrative team who process data under her direction. Dr Em is the data controller for the personal data described in this policy and is registered with the Information Commissioner’s Office (ICO), registration number ZB280269. Every member of our support team has signed a confidentiality agreement and processes data only under Dr Em’s direction as data controller.
This policy covers how we handle your personal data across everything GlitterBrain Psychology does:
– The website, free resources, shop and email correspondence
– Social media content and engagement
– Webinars, workshops and events
– Clinical services, including one-to-one therapy and therapy groups
Dr Em also practises under the trading name Dr Em Psychology (drempsychology.com), which has its own privacy notice covering the same clinical standards. Both are operated by the same data controller.
Your trust matters to us, so if you have any questions, don’t hesitate to email GlitterBrainPsychology@gmail.com
- Who are GlitterBrain Psychology
GlitterBrain Psychology is a UK-based practice run by Dr Em, Principal Clinical Psychologist, and her support team. We are committed to creating inclusive, evidence-based educational content and clinical services related to neurodiversity, mental health and wellbeing.
An important distinction. GlitterBrain offers two kinds of services, and they are treated differently:
Educational content (social media, website resources, webinars, workshops) is for general informational and psychoeducation purposes only. It is based on clinical, research and personal experience and is offered as informed opinion rather than bespoke, individualised advice. This content is not a substitute for therapy, assessment, medical or clinical advice, and engaging with it does not create a therapeutic relationship or clinical record. If you require personal mental health or medical support, please contact your local mental health or physical health providers.
Clinical services (one-to-one therapy and therapy groups) are formal clinical work. Before any clinical service begins, you will receive and sign a therapy agreement and detailed clinical privacy information. Your clinical records are handled with the additional protections described in section 5 below.
We are not a crisis service and cannot provide urgent or crisis support. Any messages sent via the website, email or social media are not continuously monitored. A mental health crisis is an emergency, so it is important to access support as soon as possible. In the UK: contact your GP during working hours, call 999 in an emergency, phone 111 (the 24-hour NHS advice line), or contact the Samaritans on 116 123 (24 hours). Outside the UK: please contact your local emergency services or crisis line. - Age Restrictions
By using our website or services, you confirm that you are over 18 years of age. We do not knowingly collect or store personal data from anyone under 18. - What is Personal Data?
“Personal Data” refers to any information that can identify you directly or indirectly – such as your name, email address, address, voice recording, or IP address. It does not include anonymised data. - What data we collect and why (summary)
Contact information (name, email, phone, address)
Lawful basis: legitimate interest, to respond to enquiries, send updates, send resources.
Client and purchase data (delivery/billing address, payment info, webinar and event bookings)
Lawful basis: contract, to fulfil services and product delivery.
User-generated content (voice notes, DMs, emails, written stories, event responses, feedback forms)
Lawful basis: consent, to fulfil services. Consent can be gained to share anonymised or identifiable content.
Website usage (cookies, IP address, device type, browser, interactions)
Lawful basis: legitimate interest, site performance and analytics.
Marketing and preferences (opt-ins for email correspondence, competitions, surveys, feedback forms)
Lawful basis: consent, and legitimate interests only where permitted, for example to contact existing customers about similar products.
Clinical data – clinical clients only (health history, therapy notes, GP details, relevant third-party agencies)
Lawful basis: explicit consent and contract, see section 5.
We do not carry out automated decision-making or profiling. - Clinical services: additional protections
This section applies if you access clinical services (one-to-one therapy or therapy groups) with Dr Em.
Sensitive data. To deliver clinical services we need to collect special categories of personal data, including sensitive personal information about your difficulties, relationships, medical history and life events along with health data such as GP details, insurance provider details and therapy notes. Our lawful ground for processing this data is your explicit consent and the performance of a contract between you and us. This is so we can consult with you on whether our services are appropriate, conduct psychological assessment or therapy (as agreed between us), invoice for services, and communicate with relevant third parties to support your treatment and manage risk where relevant. Whenever possible this will be with your express consent, though at times it is required to proceed without consent in order to take steps to ensure the safety of you or others.
You will be asked to give explicit consent to this processing, via the therapy agreement, before any clinical services begin.
Where clinical records live. Your personal and clinical data, including health history and session notes, are stored securely in Cliniko, a recognised GDPR-compliant, password-protected practice management system. You have the right to access, correct, or withdraw consent to your information at any time, subject to professional record-keeping obligations.
AI-assisted note-taking. Tools such as Heidi Health are sometimes used to reduce administrative load. No voice recordings are stored, and transcripts are used only to inform clinical notes so that pertinent aspects of the interaction can be captured and stored within the Cliniko practice management system.
Session recording. On occasion we may ask your permission to record a session, for example for comprehensive assessment documentation, court-mandated work, or evidence of clinical practice for supervision. This would always be discussed with you beforehand, with informed consent gained before any recording took place. Recordings are password protected and deleted after their agreed use.
Confidentiality and disclosure. We will not disclose confidential information about you to a third party without your consent, unless we are required to share information in the proper course of our duties to protect your safety or the safety of another person, to comply with a legal obligation or court order, or where your sessions are funded by a third party (such as an insurer) who requires information to justify continued payment.
Supervision. As a Clinical Psychologist, Dr Em participates in clinical supervision, discussing clinical work with another practitioner using first names only. Supervisors do not have access to your clinical records and are bound by the same rules of confidentiality.
Clinical data retention. Clinical records are kept for a minimum of eight years and a maximum of ten years after discharge, in accordance with the NHS Records Management Code of Practice 2021.
Note: webinars, workshops, events and social media are not clinical services. Engagement with these services does not create a clinical record or a therapeutic relationship. Registration data for these services is handled as non-clinical customer data under section 4. - Non-clinical written submissions and shared content
This relates to non-clinical content such as social media, webinars or events.
Content shared by clinical clients is never shared. Clinical confidentiality (section 5) always takes precedence. Dr Em cannot be held responsible for any content that you choose to share on public platforms, such as sharing details of your experience on social media, Google reviews or other platforms. What you choose to share publicly in relation to your experience with us is for you to manage. Social media is a public, non-clinical space. Comments and messages received there are treated as general engagement, and are not part of any clinical record. If you are a clinical client, please use the contact routes in your therapy agreement for anything relating to your care, rather than social media or public comments.
With regards to non-clinical content such as commenting on social media, send us emails or direct messages about non-clinical content or offering event feedback or reviews, you’re consenting to us:
– Storing and reviewing the content
– Editing it for clarity or length
– On occasion, permission may also be sought to use the information you send us (anonymously, or with identifying details only with your permission) in social or educational content. What you share with us will not be shared without your express permission unless clearly stated. For feedback forms, respondents will have agreed that elements of the feedback may be anonymously shared in our workshops, social media, or promotional content. We will never share names, handles, or identifying details without your explicit permission.
You can withdraw your submission at any point before publication by contacting GlitterBrainPsychology@gmail.com. Once published, we may not be able to fully remove it from third-party platforms, as many elements are outside our control. - Third-Party Services & Their Privacy Policies
We work with trusted platforms that may access or process your data. When you leave our website, we encourage you to read the privacy notice of every website you visit. You can read the privacy policies of those we most frequently use here:
– Amazon (for some affiliate links) – https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ
– Cliniko (clinical practice management including storage of clinical notes) – https://www.cliniko.com/policies/privacy/
– Doodle – https://doodle.com/en/privacy-policy/
– Flodesk (email and newsletter software) – https://flodesk.com/privacy
– Google (Workspace, Drive, Analytics, Meet, Gmail) – https://policies.google.com/privacy
– Heidi Health (AI-assisted clinical note-taking) – https://www.heidihealth.com/legal/privacy-policy
– Meta – https://www.facebook.com/privacy/policy/
– DreamHost (website hosting) – https://www.dreamhost.com/legal/privacy-policy/
– PayPal – https://www.paypal.com/uk/legalhub/paypal/privacy-full
– Podia (host of psychological skills packages) – https://www.podia.com/privacy
– Starling Bank – https://www.starlingbank.com/legal/privacy-notice/
– Stripe (payment processing) – https://stripe.com/gb/privacy
– TikTok – https://www.tiktok.com/legal/page/us/privacy-policy/en
– YouTube – https://www.youtube.com/howyoutubeworks/privacy/
– Zoom (webinars and online sessions) – https://www.zoom.com/en/trust/privacy/
At the point of publishing we have done whatever we can to ensure all third parties we work with meet legal standards for data protection.
Beyond the platforms listed above, our website and content sometimes include links to other external sites, for example recommended products, resources or social media. We’re not responsible for the privacy practices of these third-party sites, so please check their policies before submitting your data. - Cookies and tracking
Cookies are small text files stored on your device when you visit a website. Below is a summary of the types of cookies used and why they are used.
a. Essential or “strictly necessary” cookies
These cookies are required for the website to function. They include:
– WordPress session, security, and login cookies
– DreamHost server logs (IP address, date and time, error logs) to keep the site secure and running smoothly
– Payhip session and cart cookies used when accessing electronic, access anytime resources (such as worksheets)
These cookies cannot be switched off because they enable the core features of the site.
b. Functional cookies
Functional cookies help the website operate more smoothly. Examples include:
– WordPress preferences (for example, remembering if you dismissed a banner)
– Payhip user-experience cookies that support access to your account or purchased content
These are not used for advertising.
c. Analytics cookies (Google Analytics)
We use Google Analytics to understand how visitors use the website so that we can improve content and functionality. Google Analytics collects information such as:
– which pages are visited
– how long visitors stay
– which device or browser is used
– general location based on IP address (which is anonymised)
These cookies are not essential, and visitors can opt out at any time.
d. Third-party cookies
When you click through to external platforms (such as Payhip, Amazon or social media sites), those third parties may set their own cookies according to their own privacy and cookie policies. We do not control these cookies and therefore cannot make changes to them.
e. How to manage or disable cookies
You can manage cookies through your browser settings. Every browser allows you to:
– block cookies
– delete cookies
– clear browsing data
– set rules per website
Shortcuts for common browsers:
– Chrome: https://support.google.com/chrome/answer/95647
– Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
– Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
– Edge: https://support.microsoft.com/help/4027947
Please note that disabling essential cookies may affect how the site functions. - International Transfers
Some third-party tools may transfer your data outside the UK/EEA. When they do, we ensure they follow GDPR-standard safeguards, including UK-approved adequacy decisions, Standard Contractual Clauses, or equivalent approved mechanisms. If none of these safeguards is available, we may request your explicit consent to the specific transfer, which you may withdraw at any time. - Data Security
We take security seriously. Only authorised people can access your data, and only when it is necessary. We use encrypted storage, secure platforms, and conduct regular risk reviews to protect your information.
Information sent by email, telephone message or website form is kept on those platforms only as long as needed to complete the communication. For clinical clients, relevant information is transferred to our secure practice management system and deleted from the original platform.
We have procedures in place to deal with any suspected personal data breach. In the unlikely event of a breach we will notify the ICO and, where legally required, all individuals whose data may have been accessed. - Data Retention
We only keep your data for as long as we need it for the purposes described in this notice, or to meet legal, accounting, or reporting requirements.
– Clinical records: minimum eight years, maximum ten years after discharge (NHS Records Management Code of Practice 2021)
– Purchase and transaction records: up to 7 years for tax and accounting purposes
– Email marketing data: until you unsubscribe or we close our mailing list
– Enquiries that do not become clients: 12 months
When data is no longer needed, we delete or anonymise it securely. - Your Rights
You have rights to:
– Access your personal data
– Correct or update it
– Request deletion
– Object to processing
– Withdraw consent
You can make a request for any of the above at glitterbrainpsychology@gmail.com. Note that for clinical records, deletion rights are subject to professional record-keeping obligations as outlined in section 11.
If you are not happy with how we collect and use your data, you have the right to complain to the ICO (www.ico.org.uk). We would be grateful if you would contact us first so we can try to resolve it. (ICO), registration number ZB280269. - Changes to This Privacy Notice
We may update this notice when needed. The latest version will always be available
on our website. - Complaints
If you have questions or concerns about how we use your data, please contact us first at GlitterBrainPsychology@gmail.com and we’ll do our best to resolve them. You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO): www.ico.org.uk.