Privacy Policy

Last Updated: 08/02/2026

1) Who I am (Data Controller)

Cerebra Clinic and Advisory Services (“I”, “me”, “my”) is the data controller for personal information collected through this website and in connection with enquiries and services.

Controller name: Dr Spiridon Gaitatzis
Business name: Cerebra Clinic and Advisory Services
Contact email: info@cerebra.uk
Location: London, United Kingdom

ICO Registration Number: ZC089471

If you have questions about this notice or how your information is used, contact me using the details above.

2) What information I collect

Depending on how you use the website or contact me, I may collect:

Information you provide

• Name and contact details (email, phone if provided)
• Your message/enquiry and any information you choose to include
• Appointment preferences (times/days)

Information collected automatically

• Basic technical information (IP address, device/browser information)
• Website usage information via cookies/similar technologies (see Cookies Policy)

Important: Please do not include sensitive medical or detailed clinical information in website forms. If we work together, we will discuss sensitive details in a more appropriate and secure context.

3) Why I use your information (purposes) and lawful bases

I use personal information for the following purposes:

A) Responding to enquiries and arranging an initial consultation

• Purpose: reply to messages, arrange appointments, provide information you request
• UK GDPR lawful basis (Article 6): Legitimate interests (responding to enquiries) and/or Contract (taking steps at your request prior to entering into a contract) 

B) Providing professional services (if you become a client)

• Purpose: provide clinical psychological services, keep appropriate records, manage      appointments and billing
• UK GDPR lawful basis (Article 6): Contract and/or Legitimate interests
• Special category data (health information) (Article 9): where health data is processed in the context of delivering services, this will be handled under an appropriate UK GDPR Article 9 condition, consistent with providing health/psychological services.

C) Website security and preventing spam

• Purpose: protect the site, detect abuse (e.g., bot protection)
• UK GDPR lawful basis (Article 6): Legitimate interests

D) Improving the website (analytics — only if you consent)

• Purpose: understand website performance and improve content
• Cookie consent: non-essential cookies (including analytics) require consent under PECR

4) Who I share your information with

I may share personal data with trusted service providers (“processors”) that help me run the website and communications. This may include:

• Website hosting / website platform provider (e.g., GoDaddy)
• Email and productivity providers (e.g., email hosting)
• Spam prevention / security tools (e.g., CAPTCHA tools)
• Scheduling/booking tools (if used)
• Payment providers (if used)

These providers are required to protect your data and only process it on my instructions.

I do not sell your personal information.

5) International transfers

Some service providers may process data outside the UK. Where this occurs, I will take appropriate safeguards to protect your information in line with UK data protection requirements.

6) How long I keep information

• Enquiry data: kept only as long as necessary to respond and manage follow-up, then deleted/archived securely.
• Client records (if you become a client): retained in line with professional, legal, indemnity, and regulatory obligations, then securely deleted. Please enquire for more information.

7) Your rights

You have rights under UK data protection law, including:

• Access to your personal data
• Correction of inaccurate data
• Deletion (in some circumstances)
• Restriction of processing (in some circumstances)
• Objection to processing (in some circumstances)
• Data portability (in some circumstances)

You also have the right to complain to the Information Commissioner’s Office (ICO). Your privacy notice should tell people how to complain. 

8) How to make a request

To exercise your rights, contact me using the details above. I may need to verify your identity before responding.

9) Updates to this notice

I may update this notice from time to time. The “Last updated” date will show the current version.