Legal & privacy
Privacy Notice
- Effective from: 1 October 2026
- Last updated: 1 October 2026
- Version 1.0
CLAIREN Psychotherapy & Addiction Treatment (“CLAIREN”) is committed to protecting the privacy, confidentiality and security of the personal information entrusted to the practice.
This Privacy Notice explains what information CLAIREN collects, why it is collected, how it is used and protected, when it may be shared, how long it is retained, and the rights you have in relation to your information.
CLAIREN processes personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 as amended, including by the Data (Use and Access) Act 2025.
As a psychotherapy and addiction-treatment practice, CLAIREN also handles client information in accordance with applicable professional and ethical obligations concerning confidentiality, privacy and record keeping, including the COSCA Statement of Ethics and Code of Practice where applicable to the practitioner.
At a glance
Who controls your information?
CLAIREN Psychotherapy & Addiction Treatment, operated by Sander Tubbergen, is the data controller responsible for personal information processed by the practice.
What information do we collect?
Depending on your relationship with CLAIREN, this may include your name and contact details, information relating to an enquiry, appointment and payment information, correspondence, clinical records and information concerning your physical or mental health, substance use, behavioural addictions, relationships and personal circumstances.
Why do we use it?
Primarily to respond to enquiries, assess whether CLAIREN is an appropriate service for you, provide psychotherapy and addiction treatment, maintain appropriate clinical records, coordinate care where necessary, administer the practice and comply with legal, professional, ethical and safeguarding obligations.
Who receives it?
CLAIREN does not routinely disclose client information to employers, insurers, family members or other third parties.
Information may, however, be processed by carefully selected service providers necessary to operate the practice and may be disclosed where you authorise this or where disclosure is otherwise necessary or permitted by law, professional obligations or safeguarding requirements.
Does the website track me?
No analytics, advertising or behavioural-tracking cookies are used.
The website hosting/security infrastructure uses a strictly necessary Cloudflare security cookie. This cookie is used for website security and operation and is not used by CLAIREN for advertising, behavioural profiling or analytics.
What are your rights?
Data-protection law gives you rights over your personal information. These include rights of access, rectification, erasure and restriction in appropriate circumstances, as explained below.
1. Who we are
CLAIREN Psychotherapy & Addiction Treatment is a private psychotherapy and addiction-treatment practice founded by Sander Tubbergen.
For data-protection purposes, the controller is:
Data controller: Sander Tubbergen
Trading as: CLAIREN Psychotherapy & Addiction Treatment
Registered business address:
CLAIREN
3F1 Third floor
3 Hill Street
New Town
Edinburgh
EH2 3JP
Privacy email: sander@clairentreatment.co.uk
Privacy and data-protection contact:
Sander Tubbergen
Founder and Data Controller
Questions concerning this Privacy Notice or CLAIREN's handling of personal information should be directed to the contact details above.
2. The information we collect
The information CLAIREN collects depends on how you interact with the practice.
Information you provide when making an enquiry
When you contact CLAIREN by telephone or Signal, we may collect:
- your name and preferred form of address;
- your telephone number and other contact information you choose to provide;
- your preferred method and time of contact;
- information concerning the reason for your enquiry;
- information you choose to provide concerning your health, substance use, mental health, behavioural difficulties, relationships or personal circumstances;
- information necessary to assess whether CLAIREN may be an appropriate service for you; and
- information about how you heard about CLAIREN, where you choose to provide it.
Please avoid providing more sensitive clinical information than is reasonably necessary during an initial enquiry.
Information collected if you become a client
Where you enter into a therapeutic relationship with CLAIREN, information may include:
- identity and contact information;
- relevant medical and clinical history;
- mental-health information;
- substance-use and addiction history;
- information concerning behavioural addictions or compulsive behaviours;
- current or previous treatment;
- prescribed medication where clinically relevant;
- psychological, emotional and relational information;
- family and social circumstances where clinically relevant;
- risk and safeguarding information;
- assessment information;
- treatment plans;
- clinical and session notes;
- correspondence relating to your care;
- referrals and relevant information received from other professionals;
- appointment records; and
- payment and administrative records.
Clinical records are limited to information that CLAIREN considers relevant and appropriate for the provision, continuity, safety and professional accountability of your care.
Special-category information
Information concerning physical or mental health is classified as special-category personal data under Article 9 UK GDPR and receives additional legal protection.
Depending on the information you provide during psychotherapy or addiction treatment, records may also incidentally contain other categories of specially protected information, such as information concerning religious or philosophical beliefs, racial or ethnic origin, sex life or sexual orientation.
CLAIREN processes special-category information only where both an appropriate Article 6 lawful basis and an Article 9 condition apply.
3. Information received from other people
CLAIREN may occasionally receive information about you from another person or organisation.
This might include:
- a family member or partner making an enquiry on your behalf;
- a referring counsellor, psychotherapist, psychologist, doctor or other healthcare professional;
- another professional involved in your care;
- a professional adviser or representative acting with your authority; or
- emergency, legal or safeguarding services where relevant.
Receiving information from another person does not mean that CLAIREN will automatically disclose information about you in return.
Where CLAIREN obtains your personal information from another source, we will provide you with the information required under applicable data-protection law within the required timeframe unless an applicable legal exception applies.
4. How we use your information
CLAIREN may process personal information for the following purposes.
Responding to enquiries
To respond to telephone or Signal enquiries, provide information about CLAIREN's services, arrange an initial consultation and communicate with you about your enquiry.
Assessing suitability
To understand what support you are seeking and determine whether CLAIREN is an appropriate service for your circumstances.
Where CLAIREN is not clinically appropriate for your needs, information may be used to help identify or recommend a more appropriate source of support.
Providing psychotherapy and addiction treatment
Where a therapeutic engagement is agreed, information is used to assess your needs, formulate and provide treatment, review progress, manage clinical risk and provide continuity of care.
Maintaining clinical records
CLAIREN maintains proportionate professional records of assessment, treatment and clinically relevant information for continuity of care, professional accountability, safeguarding and other legitimate legal and professional purposes.
Coordinating care
Where appropriate and where there is a lawful basis to do so, CLAIREN may communicate with another clinician or professional involved in your care.
Where practicable, this will normally be discussed with you beforehand.
Managing the practice
Information may be processed for appointment management, payments, supervision, complaints handling, legal advice and other legitimate administrative requirements.
Meeting legal, professional and safeguarding responsibilities
Information may be processed where necessary to meet applicable legal requirements, professional and ethical obligations, safeguarding responsibilities, or for the establishment, exercise or defence of legal claims.
5. Our lawful bases for processing
Data-protection law requires CLAIREN to identify a lawful basis under Article 6 UK GDPR for processing personal information.
Where special-category information such as health information is processed, an additional condition under Article 9 UK GDPR must also apply.
The basis used depends on the particular processing activity.
| Processing activity | Article 6 UK GDPR basis | Article 9 condition where special-category data is involved |
|---|---|---|
| Responding to initial enquiries | Legitimate interests and/or steps taken at your request before entering into a contract | Explicit consent where appropriate, or another applicable Article 9 condition |
| Assessment and determining suitability for treatment | Steps taken at your request before entering into a contract and/or legitimate interests | Article 9(2)(h): health or social care/treatment, where applicable |
| Providing psychotherapy and addiction treatment | Performance of a contract | Article 9(2)(h): provision of health or social care/treatment |
| Maintaining necessary clinical records | Performance of a contract, legitimate interests and/or legal obligation, depending on the record and purpose | Article 9(2)(h), and where applicable another condition permitted by law |
| Coordinating care with another professional | Performance of a contract, legitimate interests and/or consent depending on the circumstances | Article 9(2)(h) and/or explicit consent where appropriate |
| Payments and practice administration | Performance of a contract and/or legal obligation | Normally not applicable |
| Professional supervision | Legitimate interests in maintaining safe, ethical and professionally accountable clinical practice | Article 9(2)(h), where applicable, with information minimised or anonymised where reasonably practicable |
| Legal claims and professional complaints | Legitimate interests and/or legal obligation | Article 9(2)(f): establishment, exercise or defence of legal claims, where applicable |
| Safeguarding or protection of vital interests | Legal obligation, legitimate interests and/or vital interests depending on the circumstances | The applicable Article 9 condition, including vital interests or a condition provided by UK law where the relevant requirements are satisfied |
| Website security | Legitimate interests and use of technologies strictly necessary to provide and secure the website | Not applicable |
Where CLAIREN relies on Article 9(2)(h), processing is undertaken in connection with the provision of health or therapeutic care and subject to applicable duties of professional confidentiality.
Where consent is relied on as the legal basis for a particular processing activity, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully undertaken before consent was withdrawn.
Consent to psychotherapy or treatment and consent used as a lawful basis under data-protection legislation are separate concepts.
6. Confidentiality and disclosure
Confidentiality is fundamental to the therapeutic relationship.
CLAIREN handles client information in accordance with applicable legal requirements and professional and ethical standards concerning privacy and confidentiality.
Information disclosed during therapy is not routinely shared with employers, insurers, family members, colleagues or other third parties.
Confidentiality is, however, not absolute.
Information may be disclosed without your consent where disclosure is required or permitted by law or is otherwise professionally justified. Circumstances may include:
- complying with a court order or other binding legal requirement;
- meeting applicable safeguarding responsibilities;
- protecting your vital interests or those of another person where the applicable legal requirements are satisfied;
- preventing or responding to serious harm in circumstances where disclosure is legally and professionally justified;
- establishing, exercising or defending legal claims;
- responding to an appropriate regulatory or professional requirement; or
- another circumstance in which disclosure is required or permitted under applicable law.
Any decision to disclose confidential information without your consent will be considered carefully on its individual circumstances.
Where disclosure is necessary, CLAIREN will seek to disclose only information that is relevant and proportionate to the purpose.
Where lawful and appropriate, CLAIREN will seek to discuss the disclosure with you.
7. Who may process or receive your information
CLAIREN limits access to personal information to what is necessary for the operation of the practice and delivery of care.
Depending on the services used, information may be processed by:
Clinical-record systems
CLAIREN uses a bespoke, password-protected, storage encrypted clinical database for secure record keeping. CLAIREN does not use third-party database systems for clinical records.
Communications providers
Providers necessary to deliver business communications, including telephone and Signal communications.
Payment and accounting providers
Payment processors, banking providers and accounting systems where required to administer private payments and comply with financial obligations.
Website infrastructure
CLAIREN's website is hosted by Webflow, and Cloudflare provides security and website-delivery functionality.
Professional advisers
CLAIREN's professional indemnity insurer, solicitor or other professional adviser where access to limited information is necessary.
Other clinicians
Where another healthcare professional or specialist becomes involved in your care, relevant information may be shared where there is an appropriate lawful basis and professional justification to do so.
This will normally be discussed with you first.
Service providers acting as processors are required to handle information in accordance with applicable data-protection requirements and contractual obligations.
9. International transfers
Some technology providers used in operating a modern private practice may process or store information outside the United Kingdom.
Where personal information is transferred internationally, CLAIREN will ensure that the transfer is made using a mechanism permitted by UK data-protection law.
Depending on the provider and destination, this may include:
- UK adequacy regulations;
- the UK Extension to the EU-US Data Privacy Framework where applicable to an eligible participating organisation;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses; or
- another lawful transfer mechanism.
Where required, CLAIREN will also consider the risks associated with the international transfer and the safeguards provided by the recipient.
Information about safeguards applicable to a particular provider may be requested using the privacy contact details above.
10. How long we keep information
CLAIREN does not retain personal information indefinitely.
Information is retained only for as long as reasonably necessary for the purpose for which it was collected, taking account of clinical and professional requirements, data-protection principles, safeguarding considerations, professional indemnity requirements and applicable legal limitation periods.
The following retention framework applies:
| Information | Retention |
|---|---|
| Initial enquiries that do not proceed to treatment | Normally up to 6 months after last substantive contact, unless there is a legitimate reason to retain particular information for longer |
| Appointment and consultation administration | Normally up to 6 months after last contact where treatment does not proceed; relevant information may become part of the clinical record where treatment begins |
| Active clinical records | For the duration of the therapeutic relationship |
| Former-client clinical records | 6 years after the last contact |
| Payment, invoice and accounting information | Retained for the period required by applicable tax, accounting and legal requirements |
| Data-protection requests and complaints | Retained for an appropriate period to demonstrate compliance and manage any related legal or regulatory matter |
| Website security information | Retained only for the period necessary for security and operational purposes by the relevant infrastructure provider |
Clinical information may need to be retained notwithstanding a request for deletion where CLAIREN has a lawful and professionally justified reason for doing so.
When information reaches the end of its applicable retention period, it is securely deleted, destroyed or irreversibly anonymised as appropriate.
11. Security
CLAIREN uses appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.
These measures include, where applicable:
- access-controlled systems;
- encrypted storage and transmission where supported by the relevant system;
- strong authentication and account-security controls;
- device security;
- restricted access to clinical information;
- secure website delivery using HTTPS/TLS;
- careful selection of service providers;
- confidentiality requirements applying to professional supervision; and
- procedures for responding to security incidents and personal-data breaches.
Security measures are reviewed as the practice and technology used by CLAIREN develop.
No electronic communication or storage system can be guaranteed to be entirely free from risk. CLAIREN therefore avoids making absolute guarantees of electronic security.
If a personal-data breach occurs, CLAIREN will assess it in accordance with applicable data-protection law and will notify the relevant supervisory authority and affected individuals where legally required.
12. Telephone and Signal communications
CLAIREN accepts initial enquiries by telephone and Signal.
Signal provides end-to-end encrypted messaging between supported devices. However, the privacy and security of communications can also depend on the security of the devices and accounts used by the people communicating.
For that reason, please avoid sending more sensitive clinical information than is reasonably necessary during an initial enquiry.
Where a therapeutic engagement proceeds, CLAIREN will explain the appropriate channels for ongoing clinical communication.
14. Automated decision-making and profiling
CLAIREN does not use solely automated decision-making to determine whether you are accepted for treatment, determine your treatment, assess clinical risk or make other significant decisions concerning your care.
Clinical decisions are made by a clinician.
CLAIREN does not create advertising or behavioural profiles of website visitors or clients.
15. Children's information
CLAIREN's services are principally intended for adults and the website is not directed at children.
CLAIREN does not knowingly use the website to solicit personal or clinical information from children.
If CLAIREN becomes aware that personal information concerning a child has been provided in circumstances where there is no lawful reason to retain it, appropriate steps will be taken to delete that information.
Where information concerning a child must be retained for a lawful, safeguarding or other legitimate purpose, it will be handled in accordance with applicable data-protection and safeguarding requirements.
If CLAIREN provides a service to a person under 18 in exceptional circumstances, the applicable consent, capacity, confidentiality, safeguarding and record-keeping requirements will be considered separately.
16. Your data-protection rights
Depending on the circumstances and the lawful basis for processing, you may have the following rights.
The right to be informed
You have the right to receive clear information about how your personal information is used. This Privacy Notice is intended to provide that information.
The right of access
You may request confirmation of whether CLAIREN processes your personal information and request a copy of information to which you are entitled.
The right to rectification
You may ask CLAIREN to correct inaccurate personal information or complete information that is incomplete.
Clinical records may sometimes record professional observations, clinical impressions or information provided at a particular point in time. A disagreement with such a record does not necessarily make it factually inaccurate, but your concerns can be considered and, where appropriate, recorded.
The right to erasure
You may ask for personal information to be erased in circumstances where this right applies.
The right to erasure is not absolute. CLAIREN may be entitled or required to retain information for legal, clinical, safeguarding, professional-accountability or legal-claims purposes.
The right to restrict processing
In certain circumstances, you may ask CLAIREN to restrict the processing of your personal information.
The right to data portability
Where the statutory conditions apply, you may be entitled to receive certain information you have provided in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller where technically feasible.
The right to object
You may have the right to object to processing based on legitimate interests in particular circumstances.
You have an absolute right to object to processing of your personal information for direct marketing. CLAIREN does not use clinical information for direct marketing.
The right to withdraw consent
Where a particular processing activity relies on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
17. Exercising your rights
To exercise a data-protection right, contact:
Privacy and data-protection contact: Sander Tubbergen
Email: sander@clairentreatment.co.uk
Post:
CLAIREN
3F1 Third floor
3 Hill Street
New Town
Edinburgh
EH2 3JP
CLAIREN may request information reasonably necessary to confirm your identity before releasing personal information.
Requests will be handled without undue delay and normally within one calendar month, subject to any extension permitted by data-protection law.
There is normally no charge for exercising your data-protection rights. A reasonable fee may be charged, or a request may be refused, where the law permits this, including in certain circumstances involving manifestly unfounded or excessive requests.
Some rights are qualified rather than absolute. CLAIREN will explain the reason if a request cannot be fulfilled in whole or in part.
18. Data-protection complaints
You have the right to complain to CLAIREN if you believe your personal information has not been handled in accordance with data-protection law.
You can make a data-protection complaint by contacting:
Sander Tubbergen
CLAIREN Psychotherapy & Addiction Treatment
Email: sander@clairentreatment.co.uk
Post:
CLAIREN
3F1 Third floor
3 Hill Street
New Town
Edinburgh
EH2 3JP
CLAIREN will acknowledge a data-protection complaint within the period required by applicable law, investigate it appropriately, keep you informed where necessary and provide an outcome without unjustifiable or excessive delay.
You also have the right to complain to the UK's data-protection supervisory authority:
Information Commission (Information Commission's Office, ICO)
4th Floor, No. 3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL
Telephone: 0303 123 1113
Website: ico.org.uk
You do not have to complete CLAIREN's complaints process before contacting the ICO, although giving CLAIREN an opportunity to address the matter may allow it to be resolved more directly.
A data-protection complaint is distinct from a complaint concerning psychotherapy or professional practice. Information about CLAIREN's clinical/professional complaints procedure is available separately.
19. Changes to this Privacy Notice
CLAIREN may update this Privacy Notice where the practice's services, technology, service providers or legal obligations change.
The current version and its effective date will always be displayed on this page.
Where a change materially affects the way existing client information is processed, CLAIREN will take reasonable steps to bring the change to the attention of affected individuals where required.
Previous versions may be retained for accountability and can be made available where appropriate.
20. Professional and ethical framework
CLAIREN's handling of clinical information forms part of its wider professional duty of confidentiality and ethical practice.
The practice is informed by the principles contained in the COSCA Statement of Ethics and Code of Practice, including respect for clients, integrity, professional responsibility, appropriate boundaries, confidentiality, competence and accountability.
Data protection and therapeutic confidentiality overlap, but they are not identical. This Privacy Notice explains CLAIREN's responsibilities as a data controller; the therapeutic agreement explains the confidentiality framework governing the clinical relationship in greater detail.
Privacy by design
CLAIREN is intentionally structured as a small, private clinical practice.
Personal information is collected and retained only where there is a legitimate clinical, professional, administrative or legal reason to do so. Access is kept limited, unnecessary disclosure is avoided, and clinical information is not used for advertising or behavioural profiling.
Privacy is therefore treated not simply as a website requirement, but as part of the way CLAIREN's clinical service is designed and delivered.
Questions about your privacy?
Contact Sander Tubbergen, Founder and Data Controller.
Email the privacy contact →