Privacy

Insula Wellbeing | Privacy Notice

Last updated: 19^th October 2026 Next review: 19th October 2027

1. Who we are

Insula Wellbeing Ltd is a private mental health and therapy practice. We are the data controller for the information described here, which means we decide how and why it is used. We follow the UK GDPR, the Data Protection Act 2018, ICO guidance and the confidentiality standards of our professional bodies.

• Address: 4 Balloo Drive Bangor | 43-45 Frances Street, Newtownards
• ICO registration number: 00014190976
• Data protection contact: Sharon Rutherford, info@insulawellbeing.co.uk 028 91898182

2. What we collect

• Contact and background details: name, address, email, phone, date of birth, GP and emergency contact details and demographic information
• Health information: relevant personal, medical and mental health history, medication and details of other professionals involved in your care
• Criminal history: where relevant to your care and safety
• Our records: correspondence, session records and clinical notes
• Website information: details you enter in our contact form and any cookie data [see Section 11]

Much of this is special category data (health information) which we protect with extra care.

3. Why we use it

We use your information to assess your needs, provide therapy, keep clinical records and contact you about appointments. We do this because it is necessary to provide the service you have asked for and to deliver health care. We also use it to keep you and others safe, to meet our legal and professional obligations, and to handle complaints, insurance matters or legal claims. We do this because we have a legitimate interest in protecting people and running a safe, accountable practice, or because the law requires it. If we want to use your information for anything else, such as case studies or research, we will ask for your explicit consent first.

4. Confidentiality and its limits

What you tell us is confidential. In limited situations we may need to share information without your consent:

• Where there is a serious risk to your life or someone else's safety
• Where there are safeguarding concerns about a child or an adult at risk
• Where the law requires it, such as a court order

Wherever it is safe, we will tell you before sharing and explain why, and we will share only what is necessary.

5. Who we share it with

• Your GP or other healthcare professionals where needed for your care or safety, with your knowledge wherever possible
• Your emergency contact, if we are seriously concerned about your welfare
• Our supervisors and managers, for supervision and quality assurance (anonymised)
• Service providers such as secure cloud storage and case-management software, who act only on our instructions under contract
• Advisers, insurers, regulators, courts or emergency services, only where needed for the reasons in Sections 3 and 4

6. Keeping it safe and how long we keep it

How we protect your information

• Electronic records are password protected, access-controlled and securely hosted, and our devices are encrypted
• Paper records are kept in locked cabinets accessible only to authorised staff
• Staff are trained in data protection and confidentiality and only see what they need
• We aim to keep data within the UK. If any provider uses data outside the UK, appropriate safeguards will be in place
• If a breach puts your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high

How long we keep it

We keep your records for 7 years after your therapy ends. For children and young people, we keep records until at least their 25th birthday, or for 7 years after therapy ends if that is longer. If a referral does not lead to therapy, we keep the information for 3 months and then securely destroy it.

Once the retention period is over, paper records are shredded and electronic records are permanently deleted.

7. Your rights

You have the right to:

• Access a copy of your information
• Correct anything inaccurate or incomplete
• Erase your information, in certain circumstances
• Restrict or object to how we use it, in certain circumstances
• Receive your data in a portable format, where we hold it by consent or contract
• Withdraw consent at any time (see Section 8)

We do not use automated decision-making or profiling.

Making a request. You can ask by emailing info@insulawellbeing.co.uk. You don't need to use a form or give a reason. We may ask for proof of identity if we are not confident who is asking, but only what is reasonably needed. We will respond within one month (extendable by up to two months for complex requests, and we will tell you why).

Limits. Some rights are not absolute. We may need to keep records for legal, safeguarding or professional reasons, and in rare cases we may withhold information that could seriously harm your health or reveal information about someone else. If we can't fully meet a request, we will explain why.

8. Withdrawing your consent

Where we rely on your consent, you can withdraw it at any time by telling your therapist or contacting the Insula office by phone, email or in writing. You don't need a form or a reason, and it won't affect the care you have already received.

We will confirm what action we have taken within one month and via an agreed channel i.e. email or phone. Withdrawal does not affect anything we did lawfully before you withdrew. If you are still in therapy, your therapist or manager will talk with you about what this means for your support and whether we can continue working together safely.

Where we are required to keep certain records, for example for safeguarding, legal or professional reasons, we will explain what we must retain and why and limit its use to those purposes. Anything we don't have to keep will be securely destroyed.

9. Starting with us

At assessment, we will explain how we use your information, give you a copy of this notice and ask you to verbally agree to our terms of terms. If you don't agree, the assessor will discuss this with their manager or supervisor and, in line with our safeguarding guidelines, decide whether we can safely offer a service. Where we can't, we will do our best to point you to other support.

10. Children and young people

We may work with young people. Where a young person can understand how their information is used, we will involve them directly. Where parental or guardian involvement is appropriate, we will explain what will and won't be shared. The safeguarding limits in Section 4 apply.

11. Our website

Our contact form collects only what you enter so we can respond and any cookie data.

12. Complaints and changes

If you are unhappy with how we have handled your information, please contact us first at info@insulawellbeing.co.uk. You can also complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

We review this notice annually and will tell current clients about significant changes.