TRINAYA LIMITED

Document Control

Contents

1. Introduction
2. About Trinaya Limited
3. Professional Standards
4. Scope of this Privacy Notice
5. Data Controller
6. Privacy Contact
7. Definitions
8. Data Protection Principles

1. Introduction

Trinaya Limited ("Trinaya", "we", "our" or "us") is committed to protecting your privacy and ensuring that your personal information is processed lawfully, fairly, transparently and securely.

We recognise that information relating to psychological health is particularly sensitive. We are committed to maintaining the highest standards of confidentiality, professional integrity and information security when collecting, using, storing and sharing personal information.

This Privacy Notice explains:

• What personal information we collect;
• Why we collect it;
• How we use it;
• The lawful basis for processing it;
• Who we may share it with;
• How we protect it;
• How long we keep it; and
• Your rights under UK data protection legislation.

This Privacy Notice applies whenever Trinaya Limited processes personal information in connection with the services we provide.

2. About Trinaya Limited

Trinaya Limited is a private limited company registered in England and Wales.

We provide independent psychological services to children, young people and adults together with independent psychological expert witness services.

Our services may include:

• Psychological assessments;
• Individual psychological therapy;
• Counselling;
• Cognitive Behavioural Therapy (CBT);
• Trauma-informed psychological interventions;
• Emotional wellbeing support;
• Psychological reports;
• Independent psychological expert witness assessments;
• Medico-legal psychological reports;
• Professional consultations.

Where appropriate, services may be delivered:

• In person;
• By telephone;
• Using secure video consultation platforms; or
• Through secure electronic communication systems.

3. Professional Standards

Trinaya Limited is committed to maintaining the highest standards of professional, ethical and legal practice.

Our services are delivered in accordance with applicable legislation and professional guidance, including:

• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• Common Law Duty of Confidentiality;
• Health and Care Professions Council (HCPC) Standards of Conduct, Performance and Ethics;
• HCPC Standards of Proficiency;
• British Psychological Society (BPS) Code of Ethics and Conduct (where applicable); and
• Civil Procedure Rules Part 35, where relevant to independent expert witness services.

Psychological services are provided by appropriately qualified and professionally registered practitioners who practise within their scope of competence and comply with applicable professional standards.

4. Scope of this Privacy Notice

This Privacy Notice applies to personal information processed by Trinaya Limited in connection with:

Clinical Services

• Psychological assessments;
• Psychological therapy;
• Counselling;
• Psychological consultations;
• Child, adolescent and adult psychological services;
• Remote consultations.

Medico-Legal Services

• Independent psychological assessments;
• Personal injury claims;
• Civil litigation;
• Expert witness reports;
• Court-related work;
• Medico-legal consultations.

Business Activities

• Appointment administration;
• Website enquiries;
• Payment processing;
• Secure electronic communications;
• Regulatory compliance;
• Business administration;
• Information governance.

This Privacy Notice applies whether information is obtained directly from you or from another lawful source.

This Privacy Notice does not apply to employees, contractors or job applicants, who are provided with separate privacy information where appropriate.

5. Data Controller

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Trinaya Limited is the Data Controller responsible for the personal information described within this Privacy Notice, unless otherwise stated.

Trinaya Limited
Company Number: 17149900
ICO Registration Number: ZC121538

Registered Office:
86 Twinnies Road
Wilmslow
SK9 4BP
United Kingdom

Email:
admin@trinaya.co.uk

Website:
www.trinaya.co.uk

6. Privacy Contact

If you have any questions regarding this Privacy Notice or how your personal information is processed, please contact our Privacy Officer.

Privacy Officer
Trinaya Limited
86 Twinnies Road
Wilmslow
SK9 4BP
United Kingdom

Email:
admin@trinaya.co.uk

We aim to respond to privacy-related enquiries promptly and in accordance with applicable legal requirements.

7. Definitions

For the purposes of this Privacy Notice:

Personal Data

Information relating to an identified or identifiable living individual.

Special Category Data

Personal information that requires additional protection under Article 9 UK GDPR, including information relating to physical or mental health.

Processing

Any operation performed on personal information including collecting, recording, organising, storing, using, sharing, retrieving, restricting, deleting or destroying information.

Data Controller

The organisation that determines the purposes and means of processing personal information.

For this Privacy Notice, the Data Controller is normally Trinaya Limited.

Data Processor

A third-party organisation or service provider that processes personal information on behalf of Trinaya Limited under a written contract.

Client

Any individual who receives, has received or has requested psychological services from Trinaya Limited.

Child

Any person under the age of eighteen years.

Parent or Person with Parental Responsibility

An individual with legal parental responsibility for a child under applicable legislation.

Medico-Legal Assessment

An independent psychological assessment undertaken for legal proceedings, insurance claims or other matters requiring an independent professional opinion.

Expert Witness Services

Independent psychological assessments and expert reports prepared by a psychologist in accordance with their professional obligations and, where applicable, the Civil Procedure Rules.

8. Data Protection Principles

Trinaya Limited processes personal information in accordance with the principles set out in Article 5 UK GDPR.

Personal information will be:

• Processed lawfully, fairly and transparently;
• Collected only for specified, explicit and legitimate purposes;
• Adequate, relevant and limited to what is necessary;
• Accurate and kept up to date where appropriate;
• Retained only for as long as necessary;
• Protected against unauthorised or unlawful processing, accidental loss, destruction or damage by appropriate technical and organisational measures; and
• Processed in a manner that enables Trinaya Limited to demonstrate compliance with UK GDPR.

We regularly review our information governance arrangements, security measures and data protection practices to ensure that personal information remains protected throughout its lifecycle.

9. Personal Information We Collect

The personal information that we collect depends upon the services you receive and the way you interact with Trinaya Limited.

We collect only the personal information that is necessary, relevant and proportionate for the purposes described within this Privacy Notice.

Where possible, we will explain why particular information is required and how it will be used.

9.1 Identity Information

We may collect information including:

• Full name
• Previous names (where relevant)
• Date of birth
• Gender
• Home address
• Telephone number(s)
• Email address
• NHS number (where relevant)
• Identification documents where required
• Claim reference numbers
• Parent or guardian details where applicable

9.2 Clinical and Psychological Information

Depending upon the service being provided, we may collect:

• Presenting concerns
• Psychological history
• Medical history relevant to psychological care
• Mental health history
• Medication history
• Previous therapy or counselling
• Previous psychological assessments
• Psychiatric history
• Hospital correspondence
• GP correspondence
• Referral letters
• Clinical observations
• Psychological formulation
• Risk assessments
• Outcome measures
• Session summaries
• Treatment plans
• Communications relevant to your care

As this information relates to health, it is generally classified as Special Category Personal Data under UK GDPR.

9.3 Medico-Legal Information

Where we provide independent psychological expert witness services, we may process:

• Accident circumstances
• Claim documentation
• GP records
• Hospital records
• Psychological records
• Psychiatric reports
• Previous expert reports
• Witness statements (where relevant)
• Medical Reporting Organisation (MRO) documentation
• Solicitor correspondence
• Rehabilitation records
• Court documentation
• Employment information relevant to the legal claim
• Other information reasonably required to provide an independent expert opinion

Only information that is relevant to the issues requiring expert assessment will be processed.

9.4 Children's Personal Information

Where services are provided to children or young people, we may collect information including:

• Parent or guardian details
• Educational information
• School reports
• Educational Psychology reports
• Social care information
• Safeguarding information
• Information from healthcare professionals involved in the child's care
• Information provided by parents, guardians or carers

We recognise that children require additional protection under UK data protection legislation and process their personal information with particular care.

9.5 Website and Technical Information

When you visit our website, we may automatically collect limited technical information including:

• IP address
• Browser type and version
• Device information
• Operating system
• Date and time of access
• Website usage information
• Cookie preferences
• Pages visited
• Online enquiry information

This information helps us maintain website security, improve website performance and understand how our website is used.

9.6 Financial Information

Where applicable, we may process:

• Billing information
• Payment references
• Invoice details
• Refund information
• Accounting records
• Stripe transaction references

Trinaya Limited does not store full payment card details. Online payments are processed securely by our payment service provider.

10. How We Collect Personal Information

We obtain personal information directly from you wherever possible. However, depending upon the services being provided, we may also receive information from authorised third parties.

10.1 Information You Provide

We may collect information when you:

• Contact us by telephone, email or through our website;
• Complete enquiry or referral forms;
• Book appointments;
• Attend consultations;
• Participate in therapy sessions;
• Complete questionnaires;
• Complete psychological assessments;
• Communicate with us during the course of your care;
• Make online payments.

10.2 Parents and Legal Guardians

Where services are provided to children or young people, information may also be obtained from:

• Parents;
• Legal guardians;
• Individuals with parental responsibility.

10.3 Healthcare Professionals

Information may be received from healthcare professionals involved in your care, including:

• General Practitioners (GPs);
• Consultant Psychiatrists;
• Clinical Psychologists;
• Hospitals;
• Community Mental Health Teams;
• Other healthcare providers involved in your care.

10.4 Medico-Legal Instructing Parties

Where Trinaya Limited provides independent psychological expert witness services, information may be received from:

• Solicitors;
• Medical Reporting Organisations (MROs);
• Insurers;
• Rehabilitation providers;
• The Courts;
• Other authorised organisations involved in legal proceedings.

10.5 Other Lawful Sources

Where appropriate, information may also be obtained from:

• Publicly available information;
• Regulatory bodies;
• Authorised third parties;
• Other lawful sources relevant to the services being provided.

11. How We Use Personal Information

Personal information is processed only where there is a lawful basis under UK GDPR.

Depending upon the services provided, we may use personal information to:

• Provide psychological assessments;
• Provide psychological therapy and counselling;
• Prepare treatment plans;
• Monitor clinical progress;
• Maintain accurate clinical records;
• Communicate with clients, parents or guardians where appropriate;
• Prepare independent psychological expert reports;
• Review medical and psychological records;
• Respond to Court directions and requests for clarification;
• Administer appointments;
• Process payments;
• Comply with legal and regulatory obligations;
• Safeguard children and adults at risk;
• Investigate complaints;
• Maintain information security;
• Improve the quality of our services.

We will process only the minimum amount of personal information necessary to achieve these purposes.

12. Lawful Basis for Processing

Under Article 6 UK GDPR, every processing activity must have a lawful basis. Where we process health or psychological information, an additional condition under Article 9 UK GDPR also applies.

Our lawful bases include:

Where consent is relied upon as the lawful basis, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

13. Special Category Personal Data

Psychological information is classified as Special Category Personal Data under Article 9 UK GDPR.

Trinaya Limited processes this information only where a lawful condition under Article 9 UK GDPR applies.

We implement additional safeguards to protect Special Category Personal Data, including restricted access, secure storage, encryption where appropriate, and confidentiality obligations for those handling such information.

14. Private Psychological Services

14.1 Our Services

Trinaya Limited provides independent psychological services for children, young people and adults.

Our services are designed to assess, support and improve psychological wellbeing using evidence-based practice that is tailored to the individual's needs.

Depending upon clinical need, our services may include:

• Psychological assessment
• Individual psychological therapy
• Counselling
• Cognitive Behavioural Therapy (CBT)
• Trauma-informed psychological interventions
• Emotional wellbeing support
• Psychological formulation
• Clinical reports
• Follow-up consultations
• Online consultations using secure video consultation platforms where appropriate

Services are provided only within the competence and professional scope of the treating psychologist.

14.2 Why We Process Your Information

We process personal information to:

• assess psychological needs;
• determine appropriate treatment options;
• provide psychological therapy;
• monitor progress;
• maintain accurate clinical records;
• communicate with clients or parents where appropriate;
• safeguard children and adults at risk;
• comply with legal and professional obligations;
• maintain continuity of care.

Only information relevant to these purposes will be processed.

14.3 Clinical Records

Accurate clinical records are maintained for every client.

Clinical records may include:

• referral information;
• assessment findings;
• consultation notes;
• therapy notes;
• clinical observations;
• psychological formulations;
• treatment plans;
• outcome measures;
• relevant correspondence;
• appointment history.

Clinical records are maintained securely and are accessible only to authorised individuals who require access to perform their professional duties.

14.4 Consent

Where consent is required for a particular aspect of psychological care, it will be obtained before processing begins.

Consent may be withdrawn at any time where it is the lawful basis for processing.

Withdrawal of consent does not affect processing already undertaken lawfully before consent was withdrawn.

15. Independent Psychological Expert Witness Services

15.1 Independent Role

Trinaya Limited provides independent psychological expert witness services for civil litigation and other matters within the psychologist's professional expertise.

Assessments are conducted independently, objectively and impartially.

Where reports are prepared for Court proceedings, the psychologist's overriding duty is to assist the Court by providing an independent professional opinion.

15.2 Types of Work

Expert witness services may include:

• Road Traffic Accident claims
• Employer Liability claims
• Public Liability claims
• Clinical Negligence claims (where appropriate)
• Psychological injury assessments
• Capacity assessments (where appropriate)
• Independent psychological reports
• Addendum reports
• Joint expert instructions

15.3 Information Reviewed

To prepare an independent opinion we may review:

• GP records;
• hospital records;
• psychiatric records;
• psychological records;
• previous expert reports;
• rehabilitation records;
• witness statements where relevant;
• radiology reports where relevant;
• Court documentation;
• documents supplied by solicitors or Medical Reporting Organisations.

Only information that is relevant to the issues requiring expert opinion will be reviewed.

15.4 Independence

Professional opinions are based upon:

• available documentary evidence;
• psychological assessment;
• clinical findings;
• professional expertise;
• accepted psychological practice.

Professional opinions are not influenced by the instructing party.

16. Sharing Your Personal Information

Trinaya Limited shares personal information only where it is lawful, necessary and proportionate.

We do not sell, rent or trade personal information.

16.1 Healthcare Professionals

Where appropriate, information may be shared with healthcare professionals involved in your care, including:

• General Practitioners (GPs)
• Consultant Psychiatrists
• Clinical Psychologists
• Hospitals
• Community Mental Health Teams
• Other healthcare professionals involved in your treatment

Information is shared only where there is a lawful basis for doing so.

16.2 Medico-Legal Services

Where an independent expert witness service is provided, information may be shared with:

• Solicitors
• Medical Reporting Organisations (MROs)
• Insurers
• Rehabilitation providers
• Barristers
• The Courts
• Joint Experts
• Other authorised parties directly involved in legal proceedings

16.3 Safeguarding

Information may be disclosed without consent where necessary:

• to protect a child;
• to protect an adult at risk;
• to prevent serious harm;
• where disclosure is required by law.

Such disclosures will always be proportionate and limited to the minimum information necessary.

16.4 Legal Requirements

Information may also be disclosed:

• where required by law;
• under a Court Order;
• to comply with regulatory obligations;
• to establish, exercise or defend legal claims.

17. Third-Party Service Providers

To operate safely and efficiently, Trinaya Limited uses carefully selected third-party service providers.

These organisations process personal information only under written contractual arrangements and only for authorised purposes.

Examples include providers of:

• secure cloud hosting;
• payment processing;
• business communications;
• clinical record management;
• appointment administration;
• secure video consultations;
• website hosting;
• cyber security services.

All providers are subject to appropriate due diligence and data protection requirements.

18. Technology Providers

Trinaya Limited currently uses secure technology providers that may include:

Technology providers may change over time. Where this occurs, Trinaya Limited will ensure that replacement providers offer appropriate security and data protection standards.

19. Artificial Intelligence (AI) and Digital Technologies

19.1 Responsible Use of AI

Trinaya Limited may use secure AI-assisted technologies to support administrative and operational activities, including assistance with document preparation, transcription, note drafting and workflow efficiency.

These technologies are used to support professional practice and are not used to replace clinical judgement or independent expert opinion.

19.2 Human Oversight

All:

• psychological assessments;
• therapy records;
• clinical decisions;
• treatment recommendations;
• medico-legal reports; and
• expert witness opinions

are prepared, reviewed and approved by a suitably qualified psychologist.

No clinical decision or expert opinion is made solely by automated means.

19.3 Data Protection

Where AI-assisted technologies are used, Trinaya Limited will take reasonable steps to ensure that:

• appropriate contractual safeguards are in place with technology providers;
• personal information is processed securely;
• confidentiality is maintained;
• only the minimum information necessary is processed; and
• processing complies with applicable UK data protection legislation.

20. Technology and Digital Services

To support the delivery of psychological services, Trinaya Limited uses secure digital systems and trusted technology providers.

These may include services for:

• appointment management;
• secure client records;
• document management;
• business communications;
• payment processing;
• website hosting;
• secure video consultations;
• cloud hosting and storage.

Technology providers are selected based upon security, reliability and compliance with applicable legal requirements.

21. International Transfers

Trinaya Limited primarily stores and processes personal information within the United Kingdom.

Where it is necessary for personal information to be transferred outside the United Kingdom, appropriate safeguards will be implemented in accordance with UK GDPR.

Such safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under UK GDPR.

22. Information Security

Trinaya Limited is committed to protecting personal information throughout its lifecycle.

Appropriate technical and organisational measures are implemented to reduce the risk of accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Examples of security measures may include:

• role-based access controls;
• strong authentication procedures;
• secure password policies;
• multi-factor authentication where appropriate;
• encryption of data in transit and at rest where supported;
• secure backup procedures;
• audit logging;
• cybersecurity monitoring;
• malware protection;
• software updates and security patching;
• confidentiality obligations for personnel;
• regular review of information governance practices.

Access to personal information is restricted to authorised individuals who require access to perform their professional responsibilities.

23. Data Retention

Trinaya Limited retains personal information only for as long as necessary to:

• provide psychological services;
• comply with legal and regulatory obligations;
• maintain accurate clinical records;
• establish, exercise or defend legal claims;
• comply with professional standards.

Retention periods are determined with reference to:

• UK GDPR;
• Data Protection Act 2018;
• applicable limitation periods;
• Health and Care Professions Council (HCPC) guidance;
• British Psychological Society (BPS) guidance;
• NHS Records Management Code of Practice (where appropriate);
• professional indemnity requirements.

23.1 Summary Retention Schedule

Retention periods may be extended where required by law, Court proceedings, regulatory investigations, safeguarding obligations or ongoing legal claims.

23.2 Secure Disposal

When personal information is no longer required, it will be securely deleted, confidentially destroyed or permanently anonymised, unless there is a lawful reason for continued retention.

24. Your Information Rights

Under UK data protection legislation, you may have the following rights, depending on the circumstances of the processing:

• the right to be informed about how your personal information is used;
• the right to request access to your personal information;
• the right to request correction of inaccurate or incomplete personal information;
• the right to request erasure of personal information in certain circumstances;
• the right to request restriction of processing;
• the right to object to certain types of processing;
• the right to request the transfer of your personal information where applicable;
• the right to withdraw consent where consent is the lawful basis for processing; and
• the right to lodge a complaint with the Information Commissioner's Office (ICO).

Some of these rights are subject to legal exemptions and may not apply in every circumstance.

25. Subject Access Requests

You may request a copy of the personal information that Trinaya Limited holds about you.

Requests should be submitted to our Privacy Officer using the contact details provided in this Privacy Notice.

Before releasing personal information, we may request reasonable evidence of identity to protect confidentiality and ensure that information is disclosed only to the correct individual.

We will normally respond within one calendar month, unless an extension is permitted under UK data protection legislation.

No fee is normally charged for a Subject Access Request unless the request is manifestly unfounded or excessive, or further copies of information are requested where a reasonable administrative charge may apply.

26. What Happens if You Do Not Provide Personal Information?

Some personal information is necessary for Trinaya Limited to:

• provide psychological services;
• undertake psychological assessments;
• prepare independent expert witness reports;
• verify identity where appropriate;
• comply with legal and professional obligations.

If the required information is not provided, we may be unable to provide some or all of our services.

Where this applies, we will explain the implications to you.

27. Cookies and Website Technologies

Our website may use cookies and similar technologies to:

• maintain website functionality;
• improve website performance;
• remember user preferences;
• analyse website usage;
• support website security.

Where required by law, you will be given the opportunity to manage your cookie preferences.

Further information is available in our separate Cookie Policy.

28. Safeguarding

Trinaya Limited recognises its safeguarding responsibilities towards children, young people and adults at risk.

Where we believe that there is a serious risk of harm to an individual or another person, personal information may be shared without consent where permitted or required by law.

Any disclosure will be proportionate, limited to the minimum information necessary and made only where there is a lawful basis.

29. Complaints

If you have any concerns regarding how your personal information has been processed, we encourage you to contact Trinaya Limited in the first instance so that we have an opportunity to investigate your concerns and respond appropriately.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

30. Contact Details

31. Changes to this Privacy Notice

Trinaya Limited may update this Privacy Notice from time to time to reflect changes in legislation, regulatory guidance, professional standards, technology or business operations.

The most recent version will always be available on our website.

Where changes are significant, we will take reasonable steps to bring them to the attention of individuals where appropriate.

Document Approval

Appendix A – Summary Retention Schedule

Appendix B – Categories of Recipients

Personal information may be shared, where lawful and necessary, with:

• General Practitioners (GPs)
• Consultant Psychiatrists
• Clinical Psychologists
• Hospitals
• Community Mental Health Teams
• Solicitors
• Medical Reporting Organisations (MROs)
• Insurers
• Rehabilitation providers
• Courts and Tribunals
• Barristers
• Regulatory authorities
• Approved technology providers acting as Data Processors

Appendix C – Technology Providers

Trinaya Limited currently uses or may use appropriately selected technology providers including:

Technology providers may change over time. Trinaya Limited will ensure that any replacement providers offer appropriate security and data protection standards.