GDPR

Frequently asked questions regarding GDPR and your privacy

In 2018 The GDPR ( the General Data Protection Regulations) replaced the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. You can view our full data policy details on request.

How long will you hold my information for?

We are obliged by our insurers that we must hold your data for 7 years after your final session. Unless you are a child, in which case we must hold your data until your 25th birthday, unless you are 17 when treatment ends and then we must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.

What if I don’t want my records to be held for that long?

You can make a request in writing to us under the GDPR, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. We would have to save the request for deletion you made but would not save any other data. This may not happen immediately if our insurance insist that we have a legal basis in which to hold your data. In some circumstances our insurance companies legal team may want to verify information we send out.

Why do you need to record this information?

We collect information about why you are using our service and a small amount of medical information. We also request a small amount of information about your important others, alongside brief session notes. This information enables us to monitor our data protection policies, and to provide a high quality service to you. It further ensures we are equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent.

What lengths are made to ensure my information is held securely?

Hard copy documents – Are all stored in a locked cabinet in a locked room.
Text messages – Our mobile phones are secured with a pin code.
Emails – Our email accounts require a user name and password.

Is what we discuss kept confidential?

Everything we talk about during our sessions are strictly confidential between client and therapist. On occasions, we may discuss elements of our sessions with a supervisor. During these discussions we do not disclose any details that may identify you and supervisors also adhere to the GDPR.

What if I see you outside of the session?

If we see each other outside of a session we will smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving. We however are obligated by GDPR law to ensure your confidentiality is protected.

What about data protection with other Health and Social Care Professionals?

As we adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If we were to write to your GP to notify them of your treatment with us, and then notify them of the treatment ending, we would only do this if you were to sign our specific letter of consent.

Exceptions regarding Data Protection:

In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under our “Duty of Care” we are obligated by law to inform the relevant authorities. This is to support you to live well. We would always aim to discuss this with you prior to contacting anyone.
If we were issued with a police warrant or court order for your information, by law we would also have to provide them with your information.