Privacy policy
Last updated: 12 July 2026
This policy explains how I handle the personal information you share through this website — what I collect, why, how long I keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. I have tried to write it the way I work: plainly and precisely.
Who I am
I am Dr Catherine Cheung, an HCPC-registered Clinical Psychologist (registration PYL32865) practising at 85 Wimpole Street, London W1G 9RJ. For the purposes of data protection law, I am the data controller for the information described in this policy. You can contact me about anything in it at hello@drcatherinecheung.com.
What this policy covers
This policy covers the website drcatherinecheung.com and the enquiries you send me through it, by email, or by WhatsApp. If you go on to become a client, the clinical records I keep about our work together are handled under a separate, fuller privacy notice that I give you before we begin, in line with HCPC standards and my professional obligations.
What I collect, and why
When you send an enquiry through the contact form, I receive what you choose to give me:
- your name (a first name is fine) and email address, so that I can reply;
- what brings you here, and anything you choose to write about it;
- how you found me, if you choose to tell me — this helps me understand how people reach the practice;
- a record of your consent to this policy.
The lawful basis for handling your enquiry is your consent, which you give by ticking the consent box before sending the form. You can withdraw it at any time by emailing me. Where you contact me directly by email or WhatsApp, I rely on my legitimate interest in responding to enquiries about the practice.
The form asks you not to include sensitive clinical detail. If you do share information about your health, I treat it with the same confidentiality as everything else in the enquiry, and the lawful basis for holding it is your explicit consent. Nothing you send through the website creates a clinical record or a therapeutic relationship — that begins only if we agree to work together.
Who processes it on my behalf
The contact form is handled by this website itself, on the practice’s own hosting with SiteGround — no third-party form service receives your enquiry. When you submit the form, your enquiry is emailed to me, and a backup copy is kept in a private log on the server for 30 days, then deleted automatically.
Form notifications are sent through SiteGround’s email service and delivered to my practice mailbox, hosted by Microsoft 365. This website is hosted by SiteGround, whose servers log visits (including IP addresses) for security and operational purposes, as almost all web hosting does.
If you message me on WhatsApp, that conversation is also handled by WhatsApp (Meta) under its own terms and privacy policy, which are outside my control. If you would rather not use WhatsApp, email works just as well.
I do not sell or share your information for marketing, and no one outside the practice and the processors above receives your enquiry. The only exceptions are the ones that apply to any clinician: where I am required to by law, or where there is a serious and immediate risk of harm to you or someone else.
Fonts
This site uses typefaces served by Google Fonts. When a page loads, your browser requests the font files from Google's servers, which means Google receives your IP address as part of that request. No other information from this site is shared with Google, and this site sets no Google cookies.
Cookies and analytics
This website sets no cookies and runs no analytics or tracking scripts.
How long I keep enquiries
The server’s backup log of your enquiry is deleted automatically after 30 days. The email copy in my inbox is kept for six months if we do not go on to work together, then deleted. If we do work together, your enquiry becomes part of your client record and is kept in line with the retention periods in the clinical privacy notice, which follows professional guidance on health records. Clinical records are kept for ten years after our last contact.
Your rights
Under UK GDPR you have the right to ask me for a copy of the personal information I hold about you, to have it corrected or deleted, to restrict or object to how I use it, to receive it in a portable form, and to withdraw consent at any time. Contact me at hello@drcatherinecheung.com and I will respond within one month.
If you are unhappy with how I have handled your information, I would ask you to raise it with me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes to this policy
If I change how this website handles personal information, I will update this page and the date at the top. Significant changes will be flagged clearly rather than made quietly.