What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?

The GDPR replaces the 1998 Data Protection Act to ensure your personal, sensitive and confidential data is kept private, held securely and is processed in the ways that you have agreed to. Your privacy is very important to me and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The regulations are in place to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange.

How long will I hold your information for?

I am regulated by the BACP and insured by Oxygen. Their requirements are that I must hold your data for 7 years after your final session. Therefore, all records will be deleted in the January after the above retention scales.

What if I don’t want my records to be held for that long?

Under the GDPR you can make a request in writing to me, for all your records to be deleted and I would refer this request to my Insurer for their approval. Once this is given, all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance companies legal team may want to verify information I send out.

Why do you need to record this information?

I collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent, for details of exceptions to confidentiality please see below.

What lengths are made to ensure your information is held securely?

Hardcopy documents – Are all stored in a locked cabinet in a locked room/building

Text messages – My phone is secured with a pin code.

Emails – My email account requires a user name and password.

Is what we discuss kept confidential?

Everything we talk about during our sessions remains strictly confidential between you and I. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR.

Exceptions:

In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities or your GP. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.

If I were issued with a court order, by law I would be required to provide them with the requested information.

ICO Registered

I am registered with the Information Commissioner’s Office [Registration Reference ZB565209].