PRIVACY NOTICE

Dr Helena Liska Tucker, HCPC Registered Clinical Psychologist

Version 1.1. Issued 24 September 2026. Effective 24 September 2026.

This notice explains how we use your information when you visit this website, make an enquiry, come to us for therapy, join our mailing list, or work with us as an organisation or supplier.

1. Who we are

Dr Helena Liska Tucker is a Clinical Psychologist registered with the Health and Care Professions Council (registration number PYL32525). She is the controller of your personal data and the person to contact about anything in this notice.

Email: [email protected]

Clinical enquiries: [email protected]

Post: Dr Helena Liska Tucker, Dr Helena Tucker Clinic, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF

ICO registration number: ZA802348

UK representative under Article 27 of the UK GDPR: we are appointing one and will add their details here. Until then, please contact us directly.

The CYCLES Training Institute has its own privacy policy, at drhelenatucker.com/privacy-policy-cycles-certification. It applies if you have joined the practitioner waitlist, applied for or enrolled on the training, or are listed in the CYCLES Directory.

Both the EU GDPR and the UK GDPR apply to our work. Where they differ, we apply whichever gives you the stronger protection.

2. The information we hold

To provide our services, whether therapy, consultancy, speaking or updates about our work, we need some information from you. This usually includes your name, email address and telephone number, and where relevant your postal address and invoicing details.

If you make an enquiry or come to us for therapy, we will also hold information about your health and wellbeing, your personal history and relationships, and anything else you choose to tell us. For therapy clients this includes assessment and session notes, your GP's details, any referral information and, if you use private medical insurance, your policy and authorisation details.

When you visit our website, we also collect technical information through cookies (see section 9).

3. Where it comes from

Almost everything we hold comes directly from you. We receive information from someone else only with your knowledge, for example from a GP or other professional who refers you, or from your insurer when it authorises your sessions.

You do not have to give us any information. If you choose not to, we may not be able to provide the service you are asking for.

4. How we use it, and our lawful basis

Enquiries. We use what you tell us to answer you and to decide whether we can help. Our lawful basis is taking steps at your request before entering into a contract. Where your enquiry includes information about your health, we rely on the explicit consent you give on our enquiry form.

Therapy. We use your information to assess, provide and record your care, to arrange appointments and to be paid. Our lawful basis is our contract with you. For information about your health, our condition is the provision of health care by a registered professional under a duty of confidentiality (Article 9(2)(h) of the UK GDPR and the EU GDPR, and in the UK, paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018).

Mailing list. If you ask to hear about our work, we use your name and email address to send it to you. Our lawful basis is your consent, and you can unsubscribe from any email at any time.

Organisations, events and suppliers. We use the contact and business details of the people we work with to agree, deliver and invoice the work. Our lawful basis is our contract and our legitimate interest in running our practice.

Accounts and tax. We keep records of invoices and payments to meet our tax and accounting obligations, which is our lawful basis. We do not hold your card details. Card payments are handled directly by our payment provider.

5. If we are unable to work with you

Where we are not the right fit, we may tell you about other services, including My Triage Network, and you can contact them yourself.

Our enquiry form also asks whether you are happy for us to pass your details to My Triage Network if we are unable to work with you. If you answer Yes and we decide we cannot work with you, we may pass on your name, your contact details and what you told us in your enquiry, so that Dr Patapia Tzotzoli can contact you. We do this only with your explicit consent (Article 6(1)(a) and Article 9(2)(a)). If you answer No, we pass nothing on. We never pass on clinical records or anything from sessions.

You can withdraw your consent at any time by emailing [email protected]. If we have already passed your details on, we will tell My Triage Network and they will not contact you further. My Triage Network is a separate controller, and once it has your details it is responsible for them under its own privacy notice.

6. Confidentiality in therapy

What you tell us in therapy stays between us. It is protected by data protection law and by our professional duties as a registered Clinical Psychologist. There are three exceptions: we may share the minimum necessary, without your agreement, where there is a serious risk to your life or someone else's, where a child or an adult at risk may need protecting, or where a court orders us to. Wherever it is safe to do so, we will tell you first.

We write to your GP only with your agreement, except in those circumstances. We discuss our clinical work in supervision without using your identifying details. If you use private medical insurance, we give your insurer what it needs to authorise and pay for your sessions, normally your appointment dates and a diagnosis or treatment code, and never your session notes.

7. Who we share it with

We do not sell your information, and we do not share it for anyone else's marketing.

We use trusted service providers to run our practice: for our website and forms, email and document storage, clinical records and appointments, online sessions, booking and card payments, and our administrative team. They use your information only on our instructions, under written terms that protect it.

Beyond them, we share information only as sections 5 and 6 describe, with our accountant, insurers and legal advisers where necessary, or where the law requires it.

8. Where your information is held

Your information is processed in the Czech Republic, where we are based. Transfers between the United Kingdom and the European Union are covered by adequacy decisions in both directions.

Some of our service providers are based in, or process information in, the United States. Where that happens, the transfer is protected by the EU Standard Contractual Clauses (with the UK Addendum for UK data), by the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or by another appropriate safeguard. You can ask us which safeguard applies to a particular provider.

9. Cookies

Our website sets some cookies that it and its forms need in order to work, and some for analytics and for fraud prevention on payment pages. We are introducing a consent banner so that anything not strictly necessary is set only once you have agreed. Until then, you can block or delete cookies in your browser settings, although some parts of the site may not work.

10. Artificial intelligence

We do not allow your personal data to be used to train any artificial intelligence model. We use AI tools for our own administrative work, under terms that prohibit the provider from training on the material, and we never put clinical records, session notes or recordings of sessions into them.

11. How long we keep it

We keep information only as long as we need it:

Enquiries that do not become appointments: twelve months.

Clinical records: seven years after your last appointment, as our professional standards require.

Payment and accounting records: as long as UK and Czech tax and accounting law requires.

Mailing list: until you unsubscribe, or after two years with no engagement.

Organisation, speaking and supplier records: six years after the work ends.

Other correspondence: three years, or six years where it relates to a contract or a complaint.

Where the law requires us to keep something for longer, or we need it for a live claim or complaint, we keep it for that period and then delete it.

12. How we keep it safe

Clinical records are held in a dedicated clinical system, not on personal devices. Our accounts are protected by strong passwords and two-factor authentication, access is limited to what each task requires, and our providers encrypt your information in transit and at rest.

If a breach occurs that is likely to put your rights at risk, we will report it to the supervisory authority within 72 hours where feasible, and tell you where the law requires us to.

13. Automated decisions and children

We do not make decisions about you by automated means, and we do not profile you. Our services are for adults, and we do not knowingly collect information about anyone under 18.

14. Your rights

You have the right to ask for a copy of the information we hold about you, and to ask us to correct it, delete it or restrict how we use it. You can object to how we use it, ask us to transfer information you gave us to you or someone else, and withdraw your consent at any time where consent is our basis. You can object to direct marketing at any time.

To use any of these rights, email [email protected]. We will respond within one month, free of charge. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why.

Some rights work differently for clinical records. We cannot delete a record we are professionally required to keep, and where releasing part of a record would identify someone else or cause serious harm, we may withhold that part. We will always tell you if that applies.

15. Complaints

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right.

You can also complain to a supervisory authority. In the United Kingdom, that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the European Union, it is the Czech authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority where you live or work.

If your concern is about our professional conduct rather than your information, you can contact the Health and Care Professions Council at hcpc-uk.org.

16. Changes to this notice

We will update this notice when what we do changes. The version and date at the top show when it was last revised. Where a change affects you materially, we will tell you directly.