This privacy policy sets out how TheMentalFitnessDr. (a trading name of Ashton Shaw Specialist Psychology Services Ltd, Company Number 13170159) uses and protects any information you give us, whether you are browsing this website or are a client receiving one of our clinical services (the Founder Performance Review, the Founder Reset, the Founder Reset 1:1, the 1:1 Retainer, or the Founder Reset Alumni).
TheMentalFitnessDr. is committed to ensuring that your privacy is protected. Should we ask you to provide information by which you can be identified, whether through this website or as part of a clinical service, you can be assured it will only be used in accordance with this privacy statement.
We are registered with the Information Commissioner's Office (ICO), registration number ZB048537.
Where clinical services are involved, they are delivered personally by Dr Kerry Ashton, BSc MSc DClinPsy, Consultant and Chartered Clinical Psychologist, registered with the Health and Care Professions Council as Kerry Shaw, registration number PYL28586 (verifiable at hcpc-uk.org).
TheMentalFitnessDr. may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes. This policy is effective from 7th August 2026 and was last updated on the 1st October 2026.
Information we collect
General website use
We may collect personal information that you voluntarily provide to us, such as your name, email address, and contact details when you fill out a form, subscribe to a newsletter, or otherwise contact us. We may also automatically collect certain information when you visit, use, or navigate the website, such as your IP address, browser type, operating system, and access times.
Clinical services
If you become a client of one of our clinical services, we collect the personal and health information you provide through your assessment, sessions, written correspondence and any related forms. Under UK GDPR this is special category health data, which receives extra legal protection. We collect and use it on the lawful basis of your explicit consent, given when you accept your Client Agreement and begin your service, and, where relevant to safeguarding, on the basis of vital interests or legal obligation (see "Sharing your information" below). Written questions and answers exchanged with you by email during your service, such as clarification questions after your assessment and the questions you send during your question channel, are handled through GoHighLevel, and a copy is kept in your clinical record in Cliniko.
Applying for a service
When you apply for one of our clinical services, the application form asks about you, your business and your timing, and includes one safety question: whether you are currently having thoughts of harming yourself or feeling unsafe. We ask it so that anyone who answers yes is pointed straight to the right immediate support rather than offered an assessment. Your answer to that question is health information, so we treat it as special category data. Your application answers are held in GoHighLevel. We collect them on the basis of your explicit consent, given when you submit your application, and, where relevant to safeguarding, on the basis of vital interests.
How we use your information
We may use the information we collect to:
-
Provide, operate, and maintain our website.
-
Improve, personalise, and expand our website.
-
Understand and analyse how you use our website.
-
Respond to your inquiries and provide customer support.
-
Send you periodic emails, such as newsletters, promotional materials, and other information that may be of interest to you.
-
Find and prevent fraud.
-
Deliver your clinical assessment, formulation, and any programme of clinical work you have consented to.
-
Meet our safeguarding and legal obligations as a regulated clinical practice.
Consent for clinical services, and how it's layered
Consent to assessment is required to receive a clinical service: without it, we cannot begin. Separately, and entirely optionally, we ask whether you are willing for your data to be used in aggregate research and service improvement, with your name and contact details removed. Because we can still link each research record back to you, which is what allows us to remove it if you change your mind, the law treats it as pseudonymised rather than anonymous, and we protect it in the same way as the rest of your data. Published findings are only ever in aggregate and never identify anyone. This second consent is asked separately from the first, is never required to access any service, and can be withdrawn at any time without affecting your service in any way.
How long we keep your information
Clinical records are retained for 20 years after our last contact with you, in line with professional guidance for psychological records, and are then securely destroyed. Other website data (such as newsletter or enquiry contact details) is kept only for as long as necessary for the purpose it was collected for. If you apply for a service, answer yes to the safety question and do not go on to become a client, your application is deleted 12 months after you apply.
Sharing your information
Beyond what is set out below, we do not share your data with anyone, including the fact that you are a client, except in the limited circumstances set out in your Client Agreement: where we believe you or someone else is at serious risk of harm, where a child or vulnerable adult is at risk, or where the law or a court requires it.
We use the following data processors to help deliver our services. Each is bound by a data processing agreement and UK GDPR obligations:
Cliniko - our clinical practice management system, used to hold and manage clinical records, assessment data, and formulations.
GoHighLevel - our client relationship and email platform, used to hold contact details and application answers, manage applications, send emails, and handle written correspondence with clients.
ScoreApp - the platform behind the Founder Edge Scorecard, which holds the name and email address you give when you complete it.
Make - an automation service that passes assessment results securely between systems. It processes data in transit on servers in the European Union and does not store it.
Where your information is held.
Cliniko stores clinical records on servers located in Australia. Australia is not covered by UK adequacy regulations, so this transfer is made under our data processing agreement with Cliniko, which incorporates the safeguards required by UK data protection law for international transfers. You can ask us for details of these safeguards at any time. GoHighLevel stores information on servers in the United States. Its provider, HighLevel Inc, is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as providing an adequate level of protection, and our data processing agreement with GoHighLevel also includes the UK's standard contractual safeguards for international transfers. GoHighLevel may use service providers in other countries, including India, under the same protections.
Your rights
Under UK GDPR you have the right to: access the personal data we hold about you; ask us to correct inaccurate data; ask us to restrict or object to certain processing; withdraw optional consent (such as the research consent above) at any time; and complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled. Because clinical records are subject to a professional retention requirement, the right to erasure does not apply to clinical records during the 20-year retention period described above.
Security
We are committed to ensuring that your information is secure. We use appropriate technical, physical, electronic and managerial procedures to safeguard and secure the information we collect, both online and in our clinical record systems, to prevent unauthorised access, loss or disclosure.
How we use cookies
Cookies are small files that a website stores on your device. Some similar technologies, such as your browser's local storage, do the same job, and this section covers them too.
Cookies we always use
These are needed for the website to work, so they cannot be switched off. They do not identify you.
XSRF-TOKEN (Wix) - security. Protects the site and its forms against misuse. Deleted when you close your browser.
ssr-caching (Wix) - helps pages load quickly. Lasts a few minutes.
consent-policy (Wix) and Usercentrics (stored in your browser) - remember your cookie choice, so we do not ask you again on every visit. Kept for up to 12 months, or until you clear them.
Cookies we use only if you agree
bSession (Wix) - measures how the website is used, such as which pages are visited, so we can improve it. Lasts 30 minutes.
We do not use advertising cookies, Google Analytics or social media tracking pixels.
Our forms and programme pages
Our sign-up, waitlist and application forms, and the pages at programs.thementalfitnessdr.com, are provided by GoHighLevel, the system we use to manage enquiries. When one of these loads, it stores a visitor identifier (msgsndr_id) and a short record of the pages you visited in your browser. If you then submit a form, this tells us how you found us. The forms also run a Cloudflare security check to block automated spam, and our programme pages use Cloudflare Web Analytics, which counts visits without using cookies.
How to control cookies
When you first visit, our cookie banner lets you accept all cookies, deny the optional ones, or choose by type in Settings. To change your choice later, use the Privacy Settings button at the bottom of any page.
You can also block or delete cookies in your browser settings. The ICO explains how at ico.org.uk/for-the-public/online/cookies. If you block the cookies we always use, parts of the site, including our forms, may not work.
If you have any questions about cookies, contact us using the details below.
Contact us
If you have any question about how your data is handled, or wish to exercise any of the rights above, contact us at Ashton Shaw Specialist Psychology Services Ltd, 54 St. James Street, Liverpool, England, L1 0AB, or, if you are already a client, through your members area or written channel.