My Privacy Policy and Data Retention Statement for Clients (commencing 25th May 2018)
I aim to be fully compliant with current General Data Protection Regulation (GDPR) legislation and to let you know how I use and protect the data you have given me. GDPR replaces the previous Data Protection Act. Identifiable information shared with me will only be used in accordance with this privacy statement. I follow guidance from my professional bodies (BACP, BABCP and COSRT) and my insurers, Howdens.
As a private practitioner and supervisor, I am responsible for the personal data held for my practice. As a counsellor/psychotherapist, my work involves a degree of processing sensitive personal information. I also collect some personal data such as your name and contact details for administration purposes.
I maintain records of your personal data (contact details) for administration which are kept separately from other data. I also may keep sensitive personal data during the course of my work which consists of my notes from our assessment and very brief session notes which are kept separately from administration data. All data is securely stored manually and no one else can access this information.
I will keep this process under review and refresh it if anything changes. I hold responsibility in the unlikely situation that there should be a breach of any data.
Consent.
This is separate to other terms and conditions relating to our work and you can withdraw consent at any time. I will not use any of your data for writing, publishing, research or training purposes without your written consent.
I have regular ongoing supervision of my work to support me and ensure my practice is safe. When I share client material in supervision this is always done confidentially, protecting your identity.
I do not pass any data to third parties unless I have a statutary or professional obligation e.g. a safeguarding or child protection issue. Under these rare circumstances I would discuss what data I would need to share with you.
Note keeping.
I keep minimal notes of the topics of our sessions which I hold for seven years. These are labelled using a code rather than your name. After this time frame, they are disposed of securely. You have a right to request in writing to see the information I hold about you should you wish to (subject to the consent of any third parties e.g. in couples therapy) and to change any information which you consider to be incorrect.
You can also ask me to delete all/any of the information that I hold. There are, however, some details I need to keep due to legal and professional obligations.
Data Storage.
I keep all data safely. This involves anonymisingand keeping all sensitive data in a locked cabinet. I dispose of data by shredding it safely.
While we work together I will store your name and phone number on my work mobile phone and your email address on my work email account. I will only contact you in response to your contact or concerning business matters e.g. appointments. When we discontinue working I will delete your telephone number. I do not engage with clients through any social media.
Online Therapy
I use an online platform which is recommended by my professional body for online therapy sessions. I follow BACP good practice guidance to safeguard access to data relating to online platforms including password protection, encryption of services being provided, regularly updating firewalls and use of virus protection.
In the event of a complaint.
In the event of a complaint, please contact me directly. If we cannot resolve this you could then contact the Information Commissioner Office ( ICO). I am registered with them and my reference is A8293661. See https://ico.org.uk/concerns/handling/ for further guidance for GDPR Compliance.
Clinical will
In the event of a sudden cessation of practice e.g. through an accident or death, I have appointed a professional executor who will manage things on my behalf. This is arranged for your welfare as my client and every step is taken to ensure GDPR standards are met.
Agreement:
Having read, understood and discussed the above, both parties are satisfied with regard to consent and the data and privacy policies. We agree on why I have collected and kept specific data and what I do with it. You may withdraw consent at any time without detriment. I will review consent with you at regular intervals to check that the relationship, the processing and the purposes have not changed.
