Privacy Policy

Last Updated: 28/09/2026

1) Who I am (Data Controller)

Dr Spiridon Gaitatzis is the data controller for personal information collected through this website and in connection with private enquiries and clinical services.

Business name: Cerebra Clinic and Advisory Service
Contact email: info@cerebra.uk
Location: London, United Kingdom

ICO Registration Number: ZC089471

If you have questions about this notice or how your information is used, contact me using the details above.

2) What information I collect

Depending on your contact with me, I may collect:

• Enquiry information: your name, email address, telephone number if provided, appointment preferences, and anything you include in your message.
• Clinical information if you become a client: information relevant to assessment and therapy, which may include your health history, presenting difficulties, questionnaires, clinical notes, correspondence, and information you choose to share during sessions.
• Administrative information: appointments, agreements, invoices, and payment records.
• Website information: technical details such as IP address, browser or device information, and information collected through the technologies described in my Cookie Policy.

Please avoid including detailed clinical or medical information in the website contact form. I recognise that an enquiry may nevertheless reveal something about your health, and I will handle it accordingly.

3) Why I use your information (purposes) and lawful bases

A) Responding to enquiries and arranging an initial consultation

I use your contact details and message to respond, discuss whether my services may be suitable, and arrange a consultation. Where you ask me to take steps towards providing a service, my UK GDPR Article 6 basis is contract (Article 6(1)(b)). For general enquiries, it is my legitimate interest in responding to you (Article 6(1)(f)).

Where an enquiry contains health information that I need to consider in assessing a clinical enquiry, my proposed special-category condition is health or social care (Article 9(2)(h)), together with the relevant condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

B) Providing professional services if you become a client

I use relevant information to provide psychological assessment or therapy, maintain clinical records, arrange sessions, and administer our work together. My Article 6 basis for information needed to provide the agreed service is contract (Article 6(1)(b)). Where I must retain financial records to meet a legal requirement, the basis is legal obligation (Article 6(1)(c)).

For health information needed to provide clinical care, I rely on the health or social care condition (Article 9(2)(h)), together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Clinical information may be discussed in confidential professional supervision where necessary to maintain safe, effective care, with identifying details minimised where practicable.

C) Website security and preventing spam

I use technical information and security tools to protect the website and contact form against misuse. My Article 6 basis, where personal information is involved, is my legitimate interest in maintaining a secure service (Article 6(1)(f)).

D) Improving the website

Where I use optional analytics requiring consent, I use them to understand how visitors use the website and improve it. I request consent before activating those technologies. Where the resulting information is personal data, my Article 6 basis is consent (Article 6(1)(a)). The Cookie Policy identifies the technologies used and explains how to change your choice.

4) Who I share your information with

I use service providers where needed to run the website and private practice. These include:

• GoDaddy for website hosting and the contact form;
• Google reCAPTCHA for form security;
• Microsoft, for correspondence;
• Microsoft Onedrive, for clinical records;
• Microsoft Teams and, where agreed, Zoom or Google Meet for online sessions; and
• Stripe.

I may also share relevant information with a confidential clinical supervisor, or with another professional or service when you have agreed to this or when disclosure is necessary for safeguarding, serious risk, or a legal requirement. I limit disclosures to what is needed for the purpose. I do not sell your personal information.

Different providers may have different roles and privacy terms; they do not all necessarily process information solely on my instructions.

5) International transfers

Some service providers may process data outside the UK. Where this occurs, I will take appropriate safeguards to protect your information in line with UK data protection requirements.

6) How long I keep information

• Enquiries that do not lead to clinical work: 48 hours, unless the information is needed for an unresolved complaint or legal matter.
• Clinical records: One calendar year. At the end of that period, I securely delete them unless a particular legal or professional reason requires longer retention.
• Website information: retention for cookies and similar technologies is described in the Cookie Policy.

I review information when the applicable period ends and retain it longer only where there is a documented reason to do so.

7) Your rights

Depending on the circumstances and the lawful basis used, you may have rights to access your information, correct inaccurate information, request deletion or restriction, object to certain uses, and receive information in a portable format.

You can object to processing based on legitimate interests. Where I rely on your consent, you can withdraw it at any time; this will not affect processing carried out before withdrawal.

You can contact me about these rights using the address in section 1. You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.

8) How to make a request

Email info@cerebra.uk to exercise a data-protection right or to complain about how I have handled your information. Please describe your concern or request so that I can respond appropriately. I may need to confirm your identity before disclosing personal information.

I will acknowledge a data-protection complaint within 30 days, make appropriate enquiries without undue delay, keep you informed where necessary, and tell you the outcome without undue delay.

9) Updates to this notice

I may update this notice when my services, providers, or use of information changes. The date at the top shows when this version was published. I will draw material changes to the attention of affected people where appropriate.