Clinical Data Processing & Privacy Notice
1. Data Controller
Totality Psychology is the "Data Controller" for all personal and clinical information processed. HCPC-registered Clinical Psychologists are responsible for ensuring your data is handled securely and in accordance with UK law.
2. Types of Information Collected
In addition to basic contact details, we collect sensitive Special Category Data necessary for your care, including:
- Full clinical and psychological history.
- Detailed session notes and therapeutic formulations.
- Relevant medical information, including prescribed medications and GP details.
- Standardized psychometric test results and assessment data.
3. Lawful Basis for Processing
Under UK GDPR, we process your data using the following legal frameworks:
For Clinical Care: We rely on Article 6(1)(f) (Legitimate Interests) and Article 9(2)(h) (Processing necessary for the provision of health or social care or treatment). This ensures we can maintain the accurate clinical records required by the HCPC.
For Enquiries: We rely on Article 6(1)(a) (Consent) when you use our website contact form.
4. Data Storage and Security
We utilize specialized, encrypted platforms to ensure the highest level of security for your clinical records:
- Clinical Records: Clinical records are securely managed using Jane, a Canadian-based and GDPR-compliant practice management platform that acts as one of the service providers that processes personal information on my behalf.
- Telehealth appointments are conducted using Zoom. Zoom processes limited personal information necessary to facilitate secure video consultations.
- Financial Data: Invoicing and payments are processed through Wise Business, ensuring secure financial transactions.
- Encryption: All digital data is encrypted both "at rest" and "in transit".
- Where AI-assisted tools are used for limited administrative purposes (such as proofreading or improving document clarity), identifiable personal information is not entered into publicly accessible generative AI systems. AI is not used to make clinical decisions or replace professional judgement.
5. Retention Periods
In accordance with UK professional standards, relevant clinical guidance, and my obligations as an HCPC-registered Clinical Psychologist, clinical records are retained for a minimum of twenty (20) years following the conclusion of psychological services. For clients who were under 18 years of age at the commencement of services, records are retained until the client's 25th birthday (or 26th birthday if the client was 17 when services ended). Records may be retained for longer where required due to legal, professional, or clinical considerations. Records are securely deleted or destroyed when they are no longer required to be retained.
Â
Records may be retained for longer where this is necessary due to legal, professional, or clinical considerations. When records are no longer required to be retained, they are securely deleted or destroyed in accordance with appropriate data protection and confidentiality standards.
6. Your Rights
Under UK GDPR, you have the right to request access to your records (Subject Access Request), the right to rectification of inaccurate data, the right to object to certain types of processing, request erasure where applicable, object to certain proessing activities, and lodge a complaint with the Information Commissioner's Office (ICO).
7. Legal Notice & Regulatory Notice
Totality Psychology Inc. is a corporation registered in British Columbia, Canada. Psychological services are provided exclusively to residents of the United Kingdom via secure telehealth by a Practitioner Psychologist registered with the UK Health and Care Professions Council (HCPC # PYL044369).
Â
The practitioner does not provide services to individuals physically located within Canada. All personal data is handled in compliance with UK GDPR standards. As a Canadian entity, data is processed and stored on secure servers in Canada; the UK government recognizes Canada as a jurisdiction providing an adequate level of protection for personal data, allowing for the continued free flow of information between the UK and Canada.
8. UK GDPR Representative
As I am established in Canada and provide psychological services to individuals in the United Kingdom, I have appointed a UK GDPR Representative in accordance with Article 27 of the UK General Data Protection Regulation (UK GDPR).
​
DataRep
​
Website:Â https://www.datarep.com
Email:Â datarequest@datarep.com
Data Request Form:Â https://www.datarep.com/data-request/
Postal Address: 107–111 Fleet Street, London, EC4A 2AB, United Kingdom.
​
When contacting DataRep, please identify Totality Psychology Inc. and/or Hoda Samadi so that your enquiry can be directed appropriately.
9. Third-Party Recipients
Your personal information will only be shared where necessary to provide psychological services, meet professional obligations, or comply with legal requirements. Depending on the circumstances, information may be shared with:
​
• secure practice management providers (such as Jane);
• secure telehealth providers (such as Zoom);
• payment processing providers (such as Wise);
• professional advisers (such as accountants or bookkeepers) where necessary for accounting, taxation, or business administration;
• clinical supervisors or professional consultants who assist in maintaining safe and ethical practice. Wherever reasonably possible, identifying information is minimised;
• my professional indemnity insurer where necessary in connection with the management of legal or professional matters;
• regulatory bodies, courts, law enforcement agencies, or other public authorities where disclosure is required or authorised by law.
​
​As Totality Psychology Inc. is based in British Columbia, Canada, your personal information may be transferred from the United Kingdom to Canada for the purpose of providing psychological services. Canada is recognised by the United Kingdom as providing an adequate level of protection for personal information under UK data protection law, and appropriate safeguards are in place to protect your information.
10. Cookie Policy Summary
We use cookies to enhance your navigating experience and ensure our clinical platforms function correctly.
- Essential Cookies: Required for secure login and practice management through our partner applications.
- Performance Cookies: Allow us to monitor site health and user interactions anonymously.
- Third-Party Cookies: Set by external booking and financial services to coordinate your sessions.
Your Choices: You can manage, block, or delete cookies via your browser settings at any time.