Call 07521 995724 or Email montrose.counselling@gmail.com
GDPR FAIR PROCESSING NOTICE 22nd May 2018
Data Controller: Lynsey McMillan at Montrose Psychotherapy and Counselling Service.
As from 25th May 2018, under the General Data Protection Regulations (GDPR) I (Lynsey McMillan) am required by law to inform you (as my current therapy client, or potential therapy client) about how I process and keep safe the data I hold that relates to you. I am also required to gain your explicit consent to my holding and processing your data in certain ways and to explain clearly my reasons for collecting any data about you.
As a counsellor/psychotherapist, I take confidentiality and privacy very seriously and am bound by the BACP code of ethics (https://www.bacp.co.uk/events-and-resources/ethics-and-standards/ethical-framework-for-the-counselling-professions/)
I collect and process personal data of people who agree to attend counselling in order to carry out certain professional and legal requirements and obligations. This Privacy Notice details my commitment to being transparent about how I collect and use data, what kind of data I collect and why I collect it. This notice also explains how I store your information, how long information is kept and how it is destroyed. This notice also contains advice on how to keep your data secure if communicating with me online.
If you are my current therapy client, or are about to become my therapy client, here’s what you need to do
Please carefully read this document then complete and sign the consent and information form on the last page to indicate your consent. You may print a paper copy, or copy and paste digitally.
If you do not wish to give your consent, you have the option to discuss with me, and it may be possible to negotiate an agreement between us.
If you agree to give your consent for me to hold and process your data as stated, please sign the last page of this document, date and return to me by hand, by post, or email to montrose.counselling@gmail.com
1. What information is collected
I will ask for your name and contact details which are considered ‘personal data’ I will also ask for an emergency contact (such as next of kin) and your GP's details. During our work together I make a note of what we have talked about during our sessions (session notes). These notes help me to remember our sessions and stay 'on track' of any goals, tasks and methods we are working on in your therapy as well as helping me to remember details which may be important to your therapy for example significant events in the past. These notes may contain other ‘personal data’ you share such as age, marital status, children, date of birth, gender or occupation and what is considered by ICO as ‘special category data’ such as race, ethnic origin, politics, religion, health, sex life or sexual orientation.
Why I collect personal data
-
So that I can contact you if necessary
-
So that I can uphold a duty of care for example in the event of an emergency
-
To comply with the recommendations of my professional body BACP and my insurance company PPS
-
To perform my role to the highest standard possible.
The lawful basis on which I use this information
I collect and store your information on the legal basis of 'Contract'*. In order to deliver my services as a therapist in an ethical and competent manner it is important I maintain records and take various kinds of information. I would not be able to agree to work effectively and ethically as a counsellor without doing so and as such keeping records constitutes an important part of our agreement to work together.
What Data I store and Why
The types of data I store may include;
-
Your name and address
-
Your phone number and email address
-
An emergency contact’s name and phone number
-
Your GP name and contact details
-
Relevant medical information
-
Artworks/diagrams we may create in sessions if you ask me to hold them.
-
Session notes
-
Payment information
-
My emails to you, and yours to me
-
Invoices
Your name and address; I require this information should I need to send you any information, invoices, letters (if we agree on this mode of communication) I also require a record of your address in the event of an emergency for example if I believed there was a risk of serious harm to yourself and needed to alert the police (see section below, How Your Information May be shared)
Your phone number and email address; I require a way of communicating with you to arrange appointments, inform you of any change to appointments (eg if I am ill) and occasionally share other information (for example if you have asked me to send you information about resources). I ordinarily communicate this information via text or email and I will ask you on your first session what form of communication you prefer to use.
An emergency contact’s name and phone number; On your first session I will ask for the name and contact number of an emergency contact, this may be your next of kin or another person. This information is to safeguard you, for example if you were ill in a session.
Your GP name and contact details; this information is also taken as a means of safeguarding you and only used in the event of an emergency if I needed to get medical help for you.
Relevant medical information; In the initial session and during the course of therapy I may take a note of any relevant medical information for example any medications or long term health conditions. This is to help me better understand your issues from a holistic perspective and tailor my counselling accordingly.
Session notes; brief notes may remind me of important points I want to be sure to remember to discuss in our next session, and/or in supervision and to track progress of the therapy and ensure we are working towards your goals. I may also hold any drawings or diagrams created in sessions if you choose to leave them with me rather than take them home. I am also required by my insurance provider PPS to take notes and it is recommended by my professional body as forming part of good practice policy.
Invoices; If we agree to a system of payment that requires me to send you invoices then I will retain copies of these invoices for the duration of our work together as a record of your payments and for accounting purposes. Once they are no longer required they will be deleted.
My emails to you, and yours to me; any email correspondence does not form part of my notes. I will retain emails only for as long as needed to complete any tasks between us such as arranging appointment times.
How I store your data
Written session notes will be stored in a fireproof lockable cabinet. These notes do not contain your name or any full names of any third parties. Your notes are coded with your initials and a date of first session. For example LM1505.
It is recommended that if you pay for sessions by bank transfer that you may wish to use this code instead of your full name, I can give you this code if you request it. If you use your name in making bank transfers this will be visible on any of my printed or electronic bank statements. However I will 'blank out' your name on any printed copies should I employ the use of a third party (book keeper or accountant). Information of transactions fall under my bank (Clydesdale Bank's) own Data Protection Policy.
Encrypted copies of any your contact details, D.O.B, GP details and emergency contact numbers are kept on a password protected laptop for the duration of our work together, as are any letters written on your behalf. My laptop is solely for my use.
I have a separate work mobile phone (passcode protected). where your email and/or phone details may be temporarily stored for the duration of our work together (first name only unless you have a distinctive first name, in which case I will use initials) if we agree this method of communication (eg for arranging or cancelling appointments)
Copies of any invoices are kept in an encrypted folder on my password protected laptop. These are kept for accounting purposes and deleted when they are no longer needed for this purpose.
If you choose to communicate via email (to arrange appointments, if it is agreed I send you any information etc) our email communications fall under the Data Protection Policies of my email provider (Google) and your own email provider. When our work together has ended I will delete any remaining email communications in both my sent and received folders. If it is agreed that sensitive information is to be emailed between us during therapy then we can discuss ways to encrypt and protect this data.
Social Media
Montrose Psychotherapy and Counselling Service has Facebook and Instagram accounts. These are for publically sharing information about topics such as mental health and wellbeing with the public, clients and potential clients. Please note that anyone who 'likes' or engages with these accounts can be identified by others visiting my accounts. If you wish to remain anonymous you can browse the pages without 'liking' or commenting on posts. Any public communications via my social media accounts fall under Instagram and Facebook Data Protection Policies. I do not use my social media accounts to message clients/respond to enquiries from clients.
Skype/Video Conferencing
I offer online counselling via Skype to those clients who are unable to attend sessions in person. Skype's privacy policy can be found via this link https://privacy.microsoft.com/en-gb/privacystatement and you will need to read their terms and agree to them before we can work together online. I delete any Skype contact details from my profile once our work is completed. It is recommended that you do not use the 'chat' function in Skype to send any sensitive information.
How long will I keep your data
Your data will be kept for no longer than the duration of our work together with the exception of session notes. When our work together has finished, all data and contact information will be deleted or securely disposed of, with the exception of session notes (which will be stored maximum 7 years)
According to the ICO You have the 'right to be forgotten' and as such I will not contact you after our work has been completed however I will respond if you contact me. My door is always open to clients returning in the future should they choose.
How your information may be shared
I would only share data in line with professional, ethical and legal obligations. These are;
-
During our supervision sessions when I may talk about our work together. However only your first name would be used. I am required by my professional body the BACP to have monthly supervision.
-
If I receive a Court Order for the release of my notes.
-
If you disclose you are at risk of serious harm to yourself or another.
-
If there was a child protection issue.
-
If you share information about a proposed act of terrorism/money laundering/drug trafficking.
-
If there is a request by the Police for information regarding a serious incident or crime.
Your rights
You have the right:
-
To be informed about what information I hold – this document will either be emailed to you during our initial communications or I will provide you with a copy at your first session.
-
To access copies of the information I hold – you can request this verbally or in writing at any time. I will provide you with the information within one month.
-
To have any incorrect information rectified – you can request this verbally or in writing.
-
To request to have your records erased (in the defence of any legal claims, I may decline to do this citing the lawful basis of Contract)
-
To restrict processing (I may decline to do this citing the lawful basis of Contract)
-
To data portability – e.g. you can request your notes be transferred to another counsellor.
-
To object to processing of your data (we may decline to do this citing the lawful basis of Contract)
-
You have the right to withdraw your consent at any time. We would need to discuss what this might mean in practice, with the primary aim being to keep you safe and to offer counselling legally and ethically. However there may be certain situations that require certain information to be retained, and I may need to seek legal advice in this case.
If you are happy to give your consent please complete the form on the next page. This form will be stored electronically, encrypted and on a password protected computer.
If you have any concerns about how I have used your data please contact the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF – Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate).
If you would like to discuss anything in this privacy statement, please contact montrose.counselling@gmail.com