Last updated: October 2025

1. Data Controller

Alliance Clinical Consulting Ltd (“we”, “us”, “our”) is the data controller responsible for your personal information.

Company Registration Number: 16802901
Registered Office: Suite 323, 51 Pinfold Street, Birmingham, B2 4AY, United Kingdom
Email: hello@allianceclinical.co.uk
Website: https://allianceclinical.co.uk

2. Information We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide

Contact details: Name, email address, telephone number, postal address
Booking information: Appointment details, service preferences, payment information
Clinical information: Health data provided during consultations, assessments, or therapy sessions (where applicable and with explicit consent)
Communication records: Correspondence via email, telephone, or contact forms
Professional information: Employment details, professional qualifications (for corporate or supervision clients)

2.2 Information Collected Automatically

Technical data: IP address, browser type, device information, operating system
Usage data: Pages visited, time spent on pages, navigation patterns
Cookie data: Information collected through cookies and similar technologies (see Section 8)

3. Legal Basis for Processing

We process your personal data under the following legal bases:

Consent: Where you have given explicit consent (particularly for processing health data)
Contract: To perform services you have requested or to take steps prior to entering into a contract
Legal obligation: To comply with legal and regulatory requirements
Legitimate interests: For business administration, fraud prevention, and improving our services (where not overridden by your rights)

Health data is processed only with your explicit consent or where necessary for healthcare provision under Article 9(2)(h) of the GDPR.

4. How We Use Your Information

We use your personal data for the following purposes:

Providing clinical psychology services, assessments, therapy, and consultations
Processing bookings and managing appointments
Processing payments and maintaining financial records
Communicating with you about services, appointments, or enquiries
Complying with professional regulatory requirements and legal obligations
Maintaining clinical records in accordance with professional standards
Conducting research or audits (anonymised data only, with separate consent where required)
Improving website functionality and user experience
Protecting against fraud, abuse, or security threats

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

Service providers: Third-party processors who assist with payment processing, appointment scheduling, email communications, or IT services (under strict data processing agreements)
Professional bodies: Where required for regulatory compliance or professional indemnity purposes
Legal authorities: Where required by law, court order, or to protect vital interests
Healthcare providers: With your explicit consent, for coordination of care or referral purposes

All third-party service providers are required to maintain appropriate security measures and process data only as instructed.

6. International Data Transfers

Your personal data is primarily processed within the United Kingdom and European Economic Area. Where data is transferred outside these regions, we ensure adequate safeguards are in place, including:

Standard Contractual Clauses approved by the European Commission
Transfers to countries with adequacy decisions
Your explicit consent where appropriate

7. Data Retention

We retain personal data for the following periods:

Clinical records: Minimum of 7 years from the date of last contact (in line with professional guidance from the Health and Care Professions Council)
Financial records: 6 years from the end of the accounting period (as required by HMRC)
Marketing communications: Until you withdraw consent or unsubscribe
Website analytics: 26 months (standard Google Analytics retention)
Correspondence: 3 years from last contact, unless part of clinical records

Data is securely destroyed or anonymised when no longer required.

8. Cookies and Tracking Technologies

8.1 Essential Cookies

Essential cookies are necessary for website functionality and security. These cannot be disabled.

8.2 Analytical Cookies

We use analytical cookies to understand how visitors use our website. This helps us improve user experience. You can opt out of these cookies through your browser settings.

8.3 Cookie Types Used

Session cookies: Temporary cookies deleted when you close your browser
Persistent cookies: Remain on your device for a set period or until manually deleted
First-party cookies: Set by our website
Third-party cookies: Set by external services (e.g., analytics providers)

8.4 Managing Cookies

You can control cookies through your browser settings. Blocking certain cookies may affect website functionality.

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your data (subject to legal and professional obligations)
Right to restrict processing: Request limitation of how we use your data
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests or for direct marketing
Right to withdraw consent: Withdraw consent at any time (where processing is based on consent)
Right to lodge a complaint: Contact the Information Commissioner’s Office (ICO) if you believe your rights have been violated

To exercise these rights, contact us using the details in Section 12. We will respond within one month of receiving your request.

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit and at rest
Secure password policies and multi-factor authentication
Regular security assessments and updates
Access controls limiting staff access to personal data
Secure disposal of physical and electronic records
Staff training on data protection and confidentiality

Despite our security measures, no system is completely secure. We cannot guarantee absolute security of transmitted data.

11. Third-Party Websites

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party sites. We recommend reviewing the privacy policies of any websites you visit.

12. Contact Information

For questions about this privacy policy or to exercise your rights, contact:

Data Protection Enquiries
Alliance Clinical Consulting Ltd
Suite 323, 51 Pinfold Street
Birmingham, B2 4AY
United Kingdom

Email: hello@allianceclinical.co.uk
Website: https://allianceclinical.co.uk

13. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: https://ico.org.uk

14. Changes to This Policy

We may update this privacy policy periodically to reflect changes in our practices, legal requirements, or service offerings. The “Last updated” date at the top of this page indicates when the policy was last revised. We encourage you to review this policy regularly. Material changes will be communicated through website notification or direct contact where appropriate.

15. Children’s Privacy

Our services are not directed at individuals under 18 years of age. Where services are provided to minors, we obtain appropriate parental or guardian consent and process data in accordance with additional safeguards required for children’s data.

This privacy policy is provided for information purposes and does not constitute legal advice. Alliance Clinical Consulting Ltd reserves the right to update this policy as necessary to ensure ongoing compliance with applicable data protection laws.