Who I am
Lincoln CBT is the private practice of Mark Kilby, a BABCP-accredited Cognitive Behavioural Psychotherapist based in Lincoln.
I am the data controller for personal information that I collect and use in connection with my practice.
If you have any questions about how your information is used, you can contact me at:
Email: mail@lincolncbt.com
Telephone: 07989 820383
I am registered with the Information Commissioner’s Office (ICO).
Information I may collect
Depending on your circumstances, I may collect and process information including:
- your name, address and contact details;
- date of birth and other identifying information;
- information about your physical and mental health;
- information you provide during assessment and therapy;
- clinical notes, questionnaires and symptom measures;
- appointment and attendance information;
- correspondence, including emails;
- referral information;
- information provided by, or shared with, an insurer, solicitor, GP, employer or other organisation involved in funding or arranging your treatment;
- reports or other clinical correspondence where these are required; and
- information required for invoicing, accounting and payment purposes.
Information concerning your physical or mental health is classed as special-category personal data and receives additional protection under data protection law.
Why I use your information
I use personal information where necessary to:
- respond to enquiries about therapy;
- assess whether I can appropriately provide treatment;
- arrange and manage appointments;
- provide psychological assessment and treatment;
- maintain appropriate clinical records;
- communicate with you about your treatment;
- liaise with referrers or organisations funding treatment where appropriate;
- provide agreed treatment reports or progress information;
- manage invoices, payments and business accounts;
- meet professional, legal and regulatory responsibilities; and
- protect the safety of clients or others where there is a serious safeguarding concern.
Lawful basis for processing
I process personal information only where there is an appropriate lawful basis under UK data protection legislation.
Depending on the circumstances, this may include processing that is necessary for the performance of a contract or in order to take steps at your request before entering into a contract, compliance with a legal obligation, or my legitimate interests in operating a safe and effective psychological therapy practice.
Because psychological therapy involves information about your health, I also process special-category health information. Where appropriate, this is processed for the provision and management of health care or treatment in accordance with Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018.
Other lawful conditions may apply in particular circumstances, for example where information is necessary for the establishment, exercise or defence of legal claims or to protect someone’s vital interests.
Clinical records
Clinical records are maintained using WriteUpp, my electronic practice management system.
Records may include assessment information, clinical notes, treatment plans, questionnaires, correspondence and other information relevant to your therapy.
Occasionally, paper copies of symptom measures may also be used. These are handled securely.
AI-assisted clinical notes
With your agreement, therapy sessions may be audio recorded using the AI Scribe facility associated with WriteUpp. This is used to assist in producing a draft clinical note.
I review the resulting note and, where necessary, edit it before it is saved as part of your clinical record.
The audio is processed for the purpose of generating the clinical note and is not intended to form part of the clinical record. WriteUpp’s handling and retention of recordings is governed by its current data-processing and privacy arrangements.
You do not have to agree to the use of AI Scribe. If you prefer not to have your session recorded, this will not affect your ability to receive therapy and I will make clinical notes in another way. You may also change your mind about its use at any time.
Where information is stored
Information may be held within WriteUpp, in secure email correspondence, in electronic documents and reports, within accounting records, and occasionally in paper form.
Only information necessary for the relevant purpose is retained, and reasonable technical and organisational measures are used to protect personal information from unauthorised access, loss or disclosure.
Sharing information
Therapy is confidential and I will not normally share information about you without an appropriate reason.
Information may, however, be shared where necessary with an insurer, solicitor, employer or other organisation funding or arranging your treatment; healthcare professionals involved in your care; organisations providing systems or professional services that enable me to operate my practice; professional advisers; or relevant authorities where disclosure is required by law or necessary because of a serious safeguarding or safety concern.
Where treatment is funded by another organisation, I will explain what information may be provided to that organisation. I will aim to share only information that is necessary for the agreed purpose.
Children and young people
I occasionally provide therapy to people under the age of 18.
Where this applies, decisions about consent, confidentiality and involvement of parents or carers will take account of the young person’s age, understanding and individual circumstances.
I will explain these arrangements at the beginning of therapy. There may be circumstances in which information needs to be shared in order to safeguard a child or young person.
How long I keep information
Clinical records are normally retained for 10 years after the end of therapy and are then securely deleted or destroyed, unless there is a legal, regulatory or other legitimate reason for retaining particular information for longer.
Other records, including financial and accounting information, may be retained for different periods where this is necessary to meet legal, tax or business requirements.
Information is not retained for longer than is reasonably necessary for the purpose for which it is held.
Your rights
Under UK data protection law, you have rights in relation to your personal information. Depending on the circumstances, these may include the right to:
- be informed about how your information is used;
- request access to personal information held about you;
- ask for inaccurate information to be corrected;
- ask for information to be erased in certain circumstances;
- ask for processing to be restricted in certain circumstances;
- object to certain types of processing; and
- request transfer of information in circumstances where the right to data portability applies.
Some of these rights are subject to legal exceptions, particularly where information forms part of a clinical record or must be retained for legal or professional reasons.
If you wish to exercise any of these rights, please contact me.
Complaints
If you have concerns about how I have handled your personal information, please contact me first so that I can try to resolve the issue.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Changes to this policy
I may update this privacy policy from time to time to reflect changes in my practice, the services I use or data protection requirements.
Last updated: August 2026