Privacy Policy
Equilibrium Psychology
Last updated: 28 October 2026
1. About this privacy policy
Equilibrium Psychology is committed to protecting your privacy and handling your personal information lawfully, fairly and securely.
This policy explains how Dr Asmita Palmer collects, uses, stores and shares personal information when you visit www.equilibriumpsychology.com, contact the practice, enquire about psychological therapy or receive services.
It applies to prospective clients, current and former clients, and, where relevant, parents, carers or other individuals who contact the practice on someone else's behalf.
The practice operates from England and provides online psychological therapy. Some clients may be located outside the UK.
2. Who is responsible for your information?
The data controller responsible for your personal information is:
Dr Asmita Palmer
Practice name: Equilibrium Psychology
Email: asmita@equilibriumpsychology.com
Telephone: 07482 668561
ICO registration number: ZA036370
Website: https://www.equilibriumpsychology.com
The practice operates from a home-based setting and does not publish its home address on this website. Please use the email address or telephone number above for privacy enquiries.
3. What personal information do I collect?
Depending on your contact with the practice and the services you receive, I may collect:
Identity and contact information: your name, email address, telephone number, age or date of birth, and relevant contact details.
Enquiry and appointment information: information you provide through the website contact form, telephone calls, emails and appointment arrangements.
Clinical information: information relevant to psychological assessment and therapy, including your presenting concerns, personal and family history, mental health, wellbeing, treatment and progress.
Information about children or young people: where relevant to therapy, safeguarding, parental responsibility or consent arrangements.
Payment and administrative information: payment dates, amounts, invoices and information needed to manage fees. Payments are made by bank transfer.
Technical information: limited information that may be collected by the website platform or through cookies and similar technologies when you visit the website.
Please avoid including highly sensitive clinical information in the initial website contact form. You can contact me to discuss an appropriate way to share information.
4. How do I collect your information?
I may collect information:
Directly from you through the website contact form, email or telephone.
During initial discussions and appointment arrangements.
During online therapy sessions and through information you share as part of your clinical work.
From a parent, carer, referrer or another professional where appropriate and lawful.
Through administrative and payment records.
Automatically through essential website functions or other technologies used by the website platform.
Where information comes from someone else, I will handle it in accordance with applicable data protection law and my professional confidentiality obligations.
5. Why do I use your information?
I use personal information only where necessary for purposes such as:
Responding to enquiries and deciding whether the practice may be appropriate for your needs.
Arranging and providing psychological assessment and therapy.
Maintaining accurate clinical records and supporting continuity of care.
Communicating about appointments, cancellations, fees and other practical matters.
Managing payments, accounts and relevant administrative obligations.
Meeting applicable legal, regulatory, professional, safeguarding and insurance requirements.
Protecting clients or other people where a lawful basis exists to take action.
Establishing, exercising or defending legal claims where necessary.
Maintaining the security and functioning of the website and practice systems.
I will not use your personal information for unrelated purposes without an appropriate lawful basis and, where required, informing you first.
6. My lawful bases for processing information
Under UK data protection law, I must have a lawful basis for processing personal data. Health information is also classed as special category data and requires an additional condition for processing. The appropriate bases depend on the circumstances and purpose of the processing.
I may rely on the following:
Contract or steps before entering into a contract: to respond to your request for services, arrange appointments and provide agreed services.
Legitimate interests: for appropriate practice administration, communications, security and the management or defence of legal claims, where these interests are not overridden by your rights.
Legal obligation: where processing is necessary to comply with a legal requirement.
Vital interests: where necessary to protect someone's life or vital interests in circumstances permitted by law.
Health or social care and professional confidentiality provisions: where the relevant legal requirements and safeguards apply to the provision of psychological care.
Legal claims or other applicable statutory conditions: where necessary and permitted by law.
For health information, I will identify and rely on an applicable condition under Article 9 UK GDPR and, where required, the Data Protection Act 2018. The precise condition depends on the circumstances of the processing.
Where consent is the appropriate basis, I will seek it and explain how it may be withdrawn. Withdrawing consent does not affect processing already lawfully carried out, and it may not require information to be deleted where another lawful basis or retention requirement applies.
7. Confidentiality and safeguarding
Information shared during therapy is treated as confidential and is handled in accordance with applicable law and professional standards.
There may be circumstances in which I need to share relevant information without your consent, for example where:
There is a serious concern about your safety or the safety of another person.
There are safeguarding concerns involving a child or an adult at risk.
Disclosure is required by law or a valid court order.
Disclosure is necessary to establish, exercise or defend a legal claim, or is otherwise permitted by law.
Where appropriate and lawful, I will discuss a proposed disclosure with you. Only information that is relevant and necessary will be shared.
8. Online therapy using Zoom
Online therapy sessions are conducted using Zoom.
I use Zoom to facilitate remote appointments. Zoom may process personal information in accordance with its own privacy terms, and its technical processing may involve infrastructure or service providers in different countries.
Therapy sessions are not routinely recorded by me. If recording were ever proposed, I would address this separately with you in advance and ensure that there was an appropriate lawful basis and any required consent or safeguards.
You should also consider your own privacy when attending sessions, including using a private space and a secure device and internet connection.
Zoom's privacy information is available at: https://www.zoom.com/en/trust/privacy/
9. Website, contact forms and cookies
The website is hosted through Squarespace. When you use the website or its contact form, information you submit may be processed by Squarespace to provide the website and form functionality.
Squarespace may also process technical information, such as device or browser information, IP address, security logs and information associated with website functionality, in accordance with the services enabled on the site.
The practice does not currently use Google Analytics or Meta/Facebook tracking tools. However, Squarespace or other enabled website features may use cookies or similar technologies for essential functionality, security, preferences or other purposes.
Where the law requires consent for non-essential cookies or similar technologies, the website should provide an appropriate consent mechanism. You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.
For more information about Squarespace's data handling, please see: https://www.squarespace.com/privacy
10. Email, telephone and other communications
I may contact you by email or telephone to respond to enquiries, arrange appointments, discuss practical matters or communicate about your therapy.
Email and ordinary telephone communications may not provide the same level of security as a dedicated clinical system. Please consider this when deciding what information to share through these channels. If you have concerns about receiving sensitive information by email or telephone, please discuss this with me.
I take reasonable steps to protect communications and restrict access to personal information.
11. Payments and financial information
Fees are paid by bank transfer.
I may retain information such as payment dates, amounts, invoice details and the information needed to identify and reconcile a payment. I do not need your full banking login details or passwords to receive a bank transfer, and you should never send these to me.
Financial and accounting records are retained for the applicable legal and accounting periods.
12. Who may receive your information?
I do not sell your personal information.
Where necessary and lawful, information may be shared with:
Service providers that support the website, online appointments, communications, storage or practice administration, including Squarespace and Zoom.
Relevant healthcare professionals or other professionals involved in your care, where appropriate and lawful.
Professional advisers, insurers or legal representatives where necessary.
Regulators, courts, law enforcement bodies or public authorities where disclosure is legally required or otherwise permitted.
Emergency services or safeguarding agencies where necessary and lawful to protect someone.
I aim to share only the information needed for the relevant purpose. Service providers may process information under their own legal obligations and contractual arrangements.
13. International clients and international data transfers
Although Equilibrium Psychology is based in England, some clients may live abroad or attend sessions while outside the UK.
The UK data protection rules that apply to the practice will depend on the circumstances. If personal information needs to be transferred to a separate organisation outside the UK, I will consider the applicable international-transfer requirements and use an appropriate legal mechanism or safeguard where required.
Some service providers, including providers of online meeting or website services, may process information internationally. Their own privacy terms explain more about their processing and infrastructure.
Providing online therapy to someone located abroad may also raise legal, professional, safeguarding, insurance or regulatory considerations beyond data protection. These will be considered where relevant before or during the provision of services.
14. How long do I keep your information?
I keep personal information only for as long as necessary for the purpose for which it was collected, taking account of applicable legal, professional, regulatory, insurance and accounting requirements.
Adult clinical records: my intended standard retention period is seven years after the end of therapy or the last clinical contact, as appropriate under the practice's retention arrangements.
Children's and young people's records: these may need to be retained for longer, taking account of the client's age, relevant professional guidance, safeguarding considerations and legal or insurance requirements.
Enquiries and correspondence: these may be kept for a different period depending on their content, purpose and whether they become part of a clinical record.
Financial and accounting records: these are retained for the periods required by applicable financial and tax rules.
Where a complaint, legal claim, safeguarding matter or other legitimate requirement makes longer retention necessary, relevant information may be kept for longer where permitted by law.
When information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.
The seven-year period for adult clinical records is the practice's intended standard, not a universal UK GDPR requirement. The applicable professional guidance, insurer requirements and circumstances of an individual case may require a different period.
15. How do I protect your information?
I take reasonable and appropriate steps to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.
These steps may include restricting access to records, using appropriate device and account security, protecting stored information, taking care when communicating sensitive information, and using reputable service providers.
No method of transmitting or storing information can be guaranteed to be completely secure. If a personal data breach occurs, I will assess it and take any steps required by law, including notifying affected people or the Information Commissioner's Office where necessary.
16. Your data protection rights
Subject to applicable law and any relevant exemptions, you may have the right to:
Access your personal information and request a copy.
Rectify information that is inaccurate or incomplete.
Request erasure of information in certain circumstances.
Restrict processing in certain circumstances.
Object to processing that relies on legitimate interests, where applicable.
Request data portability where the legal conditions for this right are met.
Withdraw consent where processing is based on consent.
These rights are not absolute. For example, I may need to retain certain clinical or financial records to comply with legal or professional obligations or to establish, exercise or defend legal claims.
To exercise a right, contact me at asmita@equilibriumpsychology.com. I may need to verify your identity before responding. I will respond within the time required by applicable law.
17. Complaints
If you have concerns about how I handle your personal information, please contact me first using the details in this policy so that I can try to resolve the issue.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
18. Automated decision-making
I do not currently use your personal information to make decisions about you solely by automated means that produce legal or similarly significant effects.
If this changes, I will update this policy and provide any additional information required by law.
19. Changes to this policy
I may update this privacy policy to reflect changes in the practice, the services or the law. The latest version will be published on the website with the date it was last updated.
20. Contact
For questions about this privacy policy or the handling of your personal information, contact:
Dr Asmita Palmer
Equilibrium Psychology
Email: asmita@equilibriumpsychology.com
Telephone: 07482 668561
ICO registration number: ZA036370