How I look after your information.

Last updated: September 2026

Who I am

I am Nga Yan (Trista) Chan, an HCPC registered Clinical Psychologist (registration PYL040302). I am the data controller for the personal information described in this policy, and I am registered with the Information Commissioner's Office (ICO) under registration number ZC053461.

If you have any questions about this policy or your information, please email contact@tristachan.com.

What information I collect

Contact details, such as your name and email address, when you get in touch.
Anything you choose to tell me in your email, which may include information about your health.
Clinical records, if we work together. These include dates of attendance, summary notes of sessions relevant to your care, any decisions about risk, copies of letters or reports, and your consent forms.
Payment records, such as the details of bank transfers you make for sessions.

Information about your mental and physical health is "special category" data under UK data protection law, and I treat it with particular care.

How I get it, and why I use it

Almost all of the information I hold comes directly from you. With your consent, I may also receive information from other professionals involved in your care, such as your GP.

I use your information to reply to your enquiry, to provide therapy, to keep the clinical records my profession requires, and to manage payments. The lawful bases I rely on are:

taking steps to enter into, and then carry out, our agreement to work together (UK GDPR Article 6(1)(b));
complying with my legal and professional obligations (Article 6(1)(c));
for health information, the provision of health care by a regulated health professional bound by a duty of confidentiality (Article 9(2)(h)).

I do not use your information for marketing, and I never sell it.

How I store it, and how long I keep it

Your information is stored securely. Electronic clinical notes and contact details are held on a password-protected, encrypted, GDPR-compliant electronic health records system. Any paper files are kept in a locked filing cabinet in a secure location.

I only keep your personal information for as long as necessary. In line with professional guidelines from the British Psychological Society (BPS) and the Health and Care Professions Council (HCPC), I keep therapy records and clinical notes for seven years after the end of your treatment. For children and young people, records are kept for seven years after they turn 18.

Once that period has passed, I securely destroy your information by permanently deleting electronic records and cross-cut shredding any paper documents.

Who I share it with

Your information is strictly confidential. I will not share it with anyone else without your explicit consent, for example if you ask me to write to your GP. The only exceptions are:

Risk of serious harm. If I believe there is an imminent risk of serious harm to you or someone else, I may have a legal or safeguarding duty to share information to keep people safe.
Safeguarding. If I have concerns that a child or vulnerable adult is being harmed or neglected, I have a duty to tell the appropriate authorities.
Legal requirements. If a court orders it, or the law otherwise requires me to disclose information.
Clinical supervision. As the HCPC requires, I discuss my work regularly with a clinical supervisor. These conversations never include your name or any identifying details, and my supervisor is bound by the same duty of confidentiality.

Where it is safe and appropriate, I will always talk with you first before sharing anything.

This website

This website does not use cookies, analytics, or contact forms. Fonts are loaded from Google Fonts, which means your browser's IP address is shared with Google when the page loads.

Your rights

Under UK data protection law, you have the right to:

ask for a copy of the information I hold about you;
ask me to correct anything that is inaccurate;
ask me to delete your information, unless I have a legal obligation to keep it;
object to, or ask me to restrict, how I use your information;
withdraw your consent, where I rely on it.

To make a request, please email contact@tristachan.com. There is no charge, and I will respond within one month.

How to complain

If you are unhappy with how I have handled your information, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.