Privacy Notice
This privacy policy gives you information about how I look after the sensitive personal data that you share with me as part of our counselling and/or coaching relationship. It’s important to me that you know how I do this so that you can trust me as an ethical professional practitioner.
It’s also a legal requirement under the General Data Protection Regulation (GDPR) and Data Protection Bill, (replacing the Data Protection Act 1998 on 25th May 2018) that I explain to you how I process your personal data.
As a sole practitioner, I am the ‘data controller’ for my business. This means I determine the purposes for which any personal data is processed and how it will be done. I collect and process your data for the sole purpose of providing you with effective counselling and coaching services. This includes obtaining, collecting, and holding your personal data (e.g. name, email, phone number) or sensitive personal data (e.g. health information).
What personal data do I collect, and how do I store it?
As part of our counselling relationship, I will collect and store your personal data. This is in several forms:
· Client record – This includes personal data such as your name, contact details, emergency contact, G.P name and address. This information is stored digitally on Microsoft OneDrive, with the individual files password protected. This information is deleted when our contractual relationship ends.
· Brief factual clinical notes about our sessions – this may include sensitive personal data relating to your health and well-being. This information is securely stored electronically in a password-protected file. Your clinical notes are stored separately from your client record, under your client code, and contain no personally identifying information, ensuring your privacy is respected. These notes are kept for seven years (see data retention section below).
To contact you to make arrangements for sessions, I also keep a:
· Client basic contact record - My phone is password-protected, and my email account is GDPR-compliant. I delete emails when the content is irrelevant to the sessions and/or transfer the data to your client ‘clinical notes’ if relevant. I delete the contact record from my phone/email account once our counselling relationship ends.
What legal basis do I have for processing your data?
The law states I need to have a legal basis for processing your data. This would be:
(a) Consent: I hope that you will give me explicit consent to collect, store, and process your data after reading this privacy notice.
(b) Contract: the processing is necessary for the contract I have with the you (to provide counselling/therapy/coaching), or because you have asked me to take specific steps before entering into a contract (contacted me about providing counselling/therapy).
In some cases, I also have a lawful basis due to:
(c) Legal obligation: the processing is necessary for me to comply with the law, e.g. sharing information in the event of you disclosing there is a risk of you doing serious harm to another person.
(d) Vital interests: the processing is necessary for me to protect someone’s life, e.g. sharing information in the event of you disclosing there is an immediate risk of you taking your own life and/or the life of another.
Will I ever share your personal data?
Generally, the contents of our sessions are strictly confidential between you and me.
The exceptions to this are:
· In circumstances where you have expressly given me permission to share information – e.g. some clients have asked me to write a letter to a GP or employer.
· In situations where I would be ethically or legally obliged to break confidentiality and share your data, e.g.
- if information is requested by a court of law, police or solicitors to assist them in a case.
- if I believe there is a genuine risk of you doing serious harm to another person, for example, a serious crime being committed such as terrorism, money laundering, or a child protection concern, in which case information would be shared with the police, child protection services or other appropriate services,
- if I believe there is genuine immediate risk of you doing serious harm to yourself, e.g. a plan to take your own life; in which case the information would be shared with GP or emergency services,
Where possible and appropriate, I would consult with you before any such breach of confidentiality takes place, but this may not always be possible.
I have a supervisor who I discuss my work with, but I do not personally identify you through that process, and my supervisor is bound by similar ethical and legal codes to me.
How long do I keep your data for?
Your client record will be securely destroyed when you end counselling, and your client's basic contact record will be deleted.
Your clinical notes and brief client records are kept for seven years and then securely destroyed.
What rights do you have as a client?
· The right to access your personal data - You have the right to see the records I keep about you. Please ask me in writing and I will provide you with a copy of their records within 1 month of the request. There is no charge for this.
· The right of rectification - If you feel your data is inaccurate or incomplete then please let me know and I will discuss this with you and do my best to correct this as soon as possible.
· The right to restrict processing - you can ask me to restrict the processing of your data, e.g. ask that I do not delete it after 5 years if you require the data to be retained to allow you to establish, exercise or defend a legal claim. When processing is restricted, I would continue to store the personal data, but not further process it.
· The right of erasure – If you want to withdraw your consent to process your data, then you can ask me to erase it. I will do my best to erase data; however, it may not be possible to erase clinical notes for legal reasons, e.g. in the event of legal claims.
· The right to portability – You have the right to have your data returned to you electronically – e.g. clinical notes to take to another counselling provider.
· The right to make a complaint – You have a right to make a complaint about the way I process your data. You can do this to me directly, or if you prefer, or if you are unhappy with my response, you can contact the Information Commissioner's Office.
Copyright © 2024 Talk and Shift - All Rights Reserved.