Privacy Policy

Dr. Claire Cox, Senior Educational Psychologist

Welcome to my privacy policy. I take your privacy seriously. This notice explains how I collect, use, store, and protect your personal data. It applies to all data collected through my services, whether via email, phone, assessments, meetings, online forms, or through this website.

By using my services or visiting this site, you agree to the terms of this policy.

1. Who I Am

Role: Senior Educational Psychologist

Business: Dr. Cox Psychology Consultancy

HCPC Registration

My Roles

I am a Senior Educational Psychologist providing services both independently and through a private company contracted by education authorities in the UK.

In some cases, I act as the data controller — for example, when working privately with families or schools. In other cases, I act as a consultant to another data controller, such as when delivering services under a contract held by a private provider or local authority.

When working through such contracts, the private company or education authority is responsible for the handling of your data, and their privacy policy will apply. However, I remain committed to the same high standards of data protection and confidentiality.

2. What Information I Collect

Depending on the service, I may collect:

  • Your name and contact details

  • A child or young person’s name, date of birth, school, and educational background

  • Information shared by parents, carers, schools or professionals

  • Psychological observations, assessments, and reports

  • Sensitive data related to emotional, behavioural, health, or neurodevelopmental needs (only where relevant)

3. Why I Use Your Data

I use personal data to:

  • Provide psychological assessments and consultations

  • Give advice to families, schools, and professionals

  • Support inclusion, learning, and emotional wellbeing

  • Maintain records, manage appointments, and comply with safeguarding or legal requirements

4. Legal Grounds for Processing

Under the UK GDPR, I must have a lawful basis to process personal data. Depending on the context in which I am working, different legal bases may apply:

  • Consent – For private work with families or schools where I act independently, I may request your explicit consent to collect and use personal or sensitive data.

  • Public task – When I am working with or on behalf of a local authority or school, data may be processed as part of delivering a service in the public interest (e.g. identifying special educational needs).

  • Legal obligation – I may need to process data to comply with safeguarding, child protection, or regulatory duties.

  • Health or social care provision – When processing special category data (such as psychological, emotional or health-related information), this is done under Article 9(2)(h) of the GDPR, where it is necessary to provide health or social care services.

In some cases, such as when I am acting as a consultant to a private provider contracted by an education authority, the legal basis for processing is determined by that organisation, and your data may also be subject to their privacy policy.

You can withdraw consent at any time.

5. Confidentiality and Team Access

I work with a trusted employee within my consultancy who may access confidential information strictly for professional and administrative purposes (e.g. typing reports, preparing resources, or organising casework). They are:

  • Bound by strict confidentiality agreements

  • Trained in GDPR, information handling and safeguarding

  • Supervised by me and do not make decisions about your data

Only the minimum necessary data is shared internally, and access is carefully controlled.

6. How I Store and Protect Your Data

  • Data is stored on encrypted, password-protected systems (e.g. Google Workspace)

  • Physical records (if used) are kept in locked storage

  • Access is restricted to authorised individuals

  • Data is retained for up to 7 years, or until the child turns 25, whichever is longer

7. Who I Share Your Information With

Depending on the nature of the work, I may share relevant information with:

  • Parents, carers, and school staff involved in the case (using encrypted tools i.e., Egress Protect)

  • Other professionals involved in supporting the child or young person (e.g. CAMHS, paediatricians)

  • A private psychology company or education authority where I am acting under contract (your data will be processed according to their instructions and legal responsibilities)

  • Supervisory bodies or safeguarding authorities, if legally required

I will always explain who your data is being shared with, and why, before doing so unless there is a legal reason not to.

8. Your Rights

You have the right to:

  • Request access to your data

  • Ask for corrections

  • Request deletion (in some cases)

  • Object to or restrict processing

  • Withdraw consent (where relevant)

  • Complain to the Information Commissioner’s Office (ICO) at ico.org.uk

9. Data Transfers

Some data may be processed outside the UK using secure cloud services (e.g. Google Workspace). I ensure appropriate protections are in place, including Standard Contractual Clauses.

10. Contact Me

To ask questions or exercise your data rights, please contact me.

This policy is reviewed regularly.