Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR and must be provided at the time you collect the personal data.

‍

Individuals must be provided with the purposes for processing their personal data, retention periods for that personal data, and who it will be shared with.

‍

We are also required to give:

• The lawful basis for the processing
• The source of the personal data (if the personal data is not obtained from the individual it relates to).
• The name and contact details of our organisation
• The contact details of our data protection officer (if applicable).
• The details of transfers of the personal data to any third countries or international organisations (if applicable).
• The rights available to individuals in respect of the processing.
• The right to withdraw consent (if applicable).
• The right to lodge a complaint with a supervisory authority.
• The details of the existence of automated decision-making, including profiling (if applicable).

We provide this information in sets of privacy notices which are relevant to the groups of people we are collecting data from and for which purposes.

The information collected from the patients we treat with CBT and the purposes for which we process and share it, is obviously quite different to the individuals who visit our website and complete a ‘contact us’ form, or our employees, for example.

For this reason, we maintain different sets of privacy notices for different audiences and ensure they are provided at the point of collection, and available in places where we interact with them.
We regularly review, and where necessary, update our sets of privacy notices and inform individuals of this where possible.

‍