This notice describes what personal data I collect from you and how it is stored and processed as part of the counselling and psychotherapy services provided by Pauline Owen trading as Inner Tides Counselling. In the course of my practice I will collect, process and store personal data as a data controller. I adhere to General Data Protection Regulation (GDPR) (EU) 2016/679, Data Protection Act 2018 or other applicable data privacy legislation and will only use your personal data to provide you with the specific service(s) you explicitly agree to.
My lawful basis for holding and using your personal information
The GDPR states that I must have a lawful basis for processing your personal data. The lawful basis may vary depending on the stage at which I am processing your data:
- If you are currently having therapy or if you are in contact with me to consider therapy, I will process your personal data where it is necessary for the performance of our contract or for my valid interest in providing services to you as a potential client
- Under the GDPR I must look after any sensitive personal information (termed ‘special category personal information’) appropriately. The lawful basis for me processing any special categories of personal information is that it is for provision of health or social care treatment (in this case therapy sessions) and necessary for a contract with a health professional (in this case, a contract between me and you)
- If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information.
How I use your information
I will never use your personal data for any purposes other than the administration of the therapy service that I am providing to you (i.e. to arrange, cancel or rearrange appointments, or send you specific information as agreed during a session). In line with guidance from the Information Commissioner’s Office I will only retain your personal information for as long as is necessary.
- Initial contact: When you contact me to book your first appointment, I will collect some brief information to help me to process your enquiry. This will include your name and a contact method (e.g. email address or phone number) so that I can schedule your appointment into my diary or inform you if I need to change an appointment. If you do not want to be contacted under any circumstances you do not need to provide a contact method. Alternatively, an organisation such as your employer may send me your details when making a referral, or a relative may give me your details when making an enquiry on your behalf. If an enquiry is made and you decide not to proceed, I will ensure that all of your personal data is deleted within one month of the initial contact date.
- While you are accessing therapy: Your email address or phone number will be used to provide you with written confirmation of your appointment times if you have given consent for this. Your email address and telephone number will only be used to contact you regarding appointment times unless we have agreed that I will also use your email address to email you information that is relevant to your therapy sessions.
At your first appointment I will ask you to complete a personal details form containing your name, address, date of birth, contact information and also contact information for your GP. The form is stored in locked passcode protected filing that can only be accessed by me. Please be aware that I will not routinely contact your GP to inform your him/her that you are participating in counselling, as your attendance is confidential. To fulfil my duty of care towards you while also maintaining your confidentiality I will only contact your GP if it is necessary, and should these circumstances arise, I would endeavour to discuss this with you wherever possible before contacting your GP. I keep brief notes of our therapy sessions for the purpose of assisting our work together. The notes help me to keep track of the issues that we are working on and are for my use only. The notes do not include any personal details that could be used to identify you and they are stored securely in a locked filing cabinet to which only I have access. Your therapy notes are stored separately to your personal details form.
- After therapy has ended: There are various reasons why counsellors are required to keep records after therapy has ended. In the case of financial transactions, personal information must be retained for as long as legally required in respect of tax or accounting purposes. Retaining your therapy notes ensures that I can continue to offer you an efficient service if you make contact after therapy has ended. Your therapy notes do not include any personal details that could be used to identify you and continue to be stored securely in a locked filing cabinet that only I have access to for seven years after therapy has ended. This time frame adheres with current industry guidelines. Seven years after therapy has ended your therapy notes will be confidentially destroyed. Your personal details form is confidentially destroyed on ending your therapy sessions, unless otherwise agreed during your final session to facilitate a return to therapy within a specified timeframe. Please note that I need to keep a record of your name, date of birth and your client reference number for seven years after therapy ends. Your client reference number corresponds with a client reference number on your therapy notes therefore enabling me to identify your therapy notes if necessary.
Who has access to your personal data?
I will never pass on your contact details to any third party organisations for the purposes of sales, marketing or research. I do not disclose any information you provide to any third parties other than as follows:
- I may discuss our work in a general way with a clinical supervisor or supervision group in order to maintain high standards of practice. I will never use names or personally identifiable details.
- I may consult with other professionals involved in your treatment only with your explicit signed consent.
- If I believe you or another person is at risk of being harmed e.g. if I am concerned that you are in serious danger of attempting or completing suicide, in imminent danger or temporarily unable to take responsibility for your actions, I would advise the relevant emergency authorities and/or your doctor and/or your nominated emergency contact. Any decision to break confidentiality would not be taken lightly. I will usually consult with a clinical supervisor and where possible, advise you as well. I will make every effort to include you in the process except in circumstances where it would harm you or others to inform you (e.g. child protection situations, mental incapacity, terrorism)
- If your appointments are paid for or arranged via a third party (e.g. your employer) the only information shared with the third party is your dates of attendance and non-attendance for invoicing and payment purposes. Details about what is discussed in your appointments will remain confidential and can only be shared if you give me your written consent to do so
- Your name may be contained in financial records and my online and hardcopy diary. It is possible that third parties may have access to those records, for example, an accountant, tax adviser, legal adviser or administrative assistant
- If an accident, illness or my passing prevents me from being able to contact you, I have nominated a trusted colleague who will be able to access my client list and contact you if necessary. I have documented the procedure to follow in a clinical will and you will be provided with necessary referrals. They will destroy personal and sensitive data and archive clinical notes safely at the appropriate time in line with GDPR requirements.
- I may be required to disclose certain data to regulators or other lawful authorities, if I am under a duty to disclose or share your personal data in order to comply with any legal obligation (for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime); in order to enforce any terms and conditions or agreements for my services that may apply or as necessary in order to protect both my and your rights, property and safety (for instance in relation to fraud protection).
I take the security of the data that I hold about you very seriously. My email account is password protected and mobile phones, computers and tablets used to respond to your emails are password protected and have anti-virus protection. Any email correspondence will be deleted within one month if it is not necessary to keep it. If it is necessary to retain the information I will print the email and store it securely in a locked filing cabinet to which only I have access.
By accessing the Inner Tides Counselling website, you are consenting to the information collection and use practices described in this privacy notice. Should you choose to contact me using the Contact Form on the website none of the data that you supply will be stored by the website or passed to any third party data processors. Instead the data will be collated into an email and sent to me over the Simple Mail Transfer Protocol (SMTP). SMTP servers are protected by TLS (sometimes known as SSL) meaning that the email content is encrypted before being sent across the internet. The email content is then decrypted by local computers and devices.
Google Analytics is a service provided by Google that gathers anonymous data on how people are using websites and then provides visitor statistics, details of page views etc. This service is used by many website owners as the data helps website owners to improve their websites.
Your personal data may be transferred outside the United Kingdom or European Economic Area (“EEA”) where some of my service providers (e.g. video conferencing service provider) are based outside of the EEA and in this instance, I will ensure that such service providers stipulate adequate safeguards and a copy of information regarding these safeguards will be made available.
Third Party Services
The website may contain links to and from the websites of partner networks and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that I do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
Under GDPR 2018 guidelines you have the following rights:
- the right to access to personal information I store and process about you
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to object to processing
- the right to data portability
- the right to complain to a supervisory authority
- the right to withdraw consent
- the right to request information about the existence of automated decision-making, including profiling
- the right to be notified if your personal data is rectified or erased, or processing is restricted, in accordance with the above.
If you would like to make a request relating to any of the above rights, please send a request in writing by emailing Paulineowen@innertidescounselling.co.uk
Please be aware that in certain situations counsellors may be unable to comply with the above requests. For example, if compelled to retain the records by a court of law. Please also be aware that there may be a charge for complying with a request.
If you have a complaint about how I handle your personal data please do not hesitate to get in touch by email at firstname.lastname@example.org. If you want to make a formal complaint about the way I have processed your personal information you can contact the ICO which is the statutory body that oversees data protection law in the UK.
Changes to privacy notice
Details of any changes to this policy will be posted on the website to help ensure you are always aware of the information I collect, use, and in what circumstances, if any, I share it with other parties. Please check the Inner Tides Counselling website regularly for any updates.
Privacy Notice 2021/1