Privacy Policy


What this privacy notices covers

Sheffield CBT is committed to protecting your personal information. In this notice, references to ‘we’ or ‘us’ means Sheffield CBT. “You” in this document means you and/or the child or young person for whom you have responsibility. This notice explains how we collect and use the personal information about you.


Who we are

Sheffield CBT is a private psychological service which provides assessment and treatment of mental health disorders to fee-paying and insurance based patients.

Sheffield CBT operates the website (the “Website”).

Sheffield CBT is a data controller under the data protection rules and our Data Protection Officer is Sarah Carson.


Information we gather.

SDC gathers certain information about you in the following ways:


Information you give us.

When you access one of our services you will give us information. Information may include your name, date of birth, postal address, email address, phone number, and relevant medical details.


Information about you from third parties.

In order for us to offer you the most appropriate service we sometimes acquire information from your GP, but this will only be with specific written (usually emailed) permission from you.


How we may use your information

We rely on the legitimate interest basis to use your personal information in some circumstances. For example, when you access our services, we have a legitimate organisational interest to use your information to respond to you for your benefit.

We also rely on obtaining your consent to use your personal information. For example, we will seek your consent to receive emails about further available services.

We may use your information for a number of purposes including the following:

  1. For invoicing purposes
  2. To Inform you about changed or cancelled services
  3. To provide you with information about our work or our activities that you have agreed to receive
  4. To assess our performance (anonymised)
  5. To ensure we know how you prefer to be contacted
  6. To keep a record of which services you have received from us
  7. To make suggestions and recommendations to you about goods or services that may interest you
  8. To notify you about changes to our service
  9. For any other reasonable purposes of Sheffield CBT, acting always in accordance with the data protection law (as amended from time to time)


It is your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. If you do not want us to use your personal information in these ways, please do not tick the relevant box situated on the form on which we collect your data.

You can change any of your contact preferences at any time including telling us that you don’t want us to contact you for marketing purposes by post or by contacting us on

Should you have a query regarding this please contact our Data Protection Officer.

We will not use your information for marketing purposes if you have indicated that you do not wish to be contacted for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you.


Information Sharing and Disclosure

We may share your information with the following selected third parties:

  1. Your GP- but only with specific, written permission from you.
  2. If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, (for example to government bodies and law enforcement agencies) or in order to enforce or apply other agreements; or to protect the rights, property, or safety of Sheffield CBT, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. No data outside of EU.


Keeping your records

We keep records of your personal information only for as long as required to operate the service in accordance with legal requirements and tax and accounting rules.

We will keep certain personal information for longer in order to confirm your identity, when you were a client of Sheffield CBT and for how long.

However, unless specifically requested in writing by you, assessment materials will be kept for a period of 2 years (unless required to inform on-going support) and then destroyed. Assessment reports will be kept securely in electronic and handwritten form for an appropriate length of time-usually 5 years-to allow your access to them at a future date.

We may retain non-identifiable data for statistical purposes for longer than 5 years.


Where we may store your information

The data that we collect from you will be stored securely at Sheffield CBT and/or electronically on Sheffield CBT online systems.

By submitting your personal data, you agree to this transfer, storing or processing.

Sheffield CBT will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice.



Your rights

You have the right to:

  1. Have any inaccuracies in your data corrected. If you would like to update the details we hold about you please contact our Data Protection Officer via email or by letter.
  2. Request that we delete your personal data.
  3. Object to profiling. Profiling is an automated processing of personal data to evaluate any feature of your behaviour preference or location, including online tracking and behavioural advertising.
  4. Request that we do not process your personal data for marketing purposes.
  5. You have a right to request a copy of the personal information we hold about you. This includes electronic copies of any assessment report we have produced for you. We require you to prove your identity with two pieces of approved identification. Please address requests to the Data Protection Officer at and we will respond within one month, of receipt of your written request and confirmed ID. Please provide as much information as possible about the nature of your contact with us to help us locate your records. This request is free of charge unless the request is manifestly unfounded or excessive.


Changes to this notice and the way we treat personal information

We may update the terms of this privacy notice at any time, so please do check it from time to time.

We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address you have provided to us or by placing a prominent notice on our Website.


Enquires and Complaints

The Data Protection Officer is the first point of contact regarding any enquires arising from this Privacy Notice. Where possible, please raise all enquires in writing.

You may also complain directly to the Information Commissioner’s Office if you are concerned with how we are handling your personal information using their online form which can be found here:


Changes to this Notice

We may change this Privacy Notice from time to time.  If we make any significant changes in the way in which we treat your personal information, we will contact you directly.


This Privacy Notice was last updated 14.04.18