One to One Sessions – Your Privacy
Rest assured, if you decide to book an appointment with me, your personal information is confidential.
What are the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?
The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange.
How long will you hold my information for?
I will hold your data for 6 years after your final session to comply with my insurance policy. Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. All records will be deleted in the January after the above retention scales.
What if I don’t want my records to be held for that long?
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be securely destroyed and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance company’s legal team may want to verify the information I process.
Why do you need to record this information?
I collect information on your name, address, why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent.
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions is strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my peers. During these discussions I do not disclose any details that may identify you.
What if I see you outside of the session?
If we see each other outside of a session I may smile but will not engage in any further conversation to ensure your confidentiality. You are most welcome to chat to me though if you wish!
You are of course welcome to share with other people about our sessions together, but I am obligated by GDPR law to ensure your confidentiality is protected.
I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.
What about other Health and Social Care Professionals?
As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I thought it were important to get consent from your GP before starting your session with me, I would only do this if you were to sign with your specific consent for this.
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for your information, by law I would also have to provide them with your information.
You have the following rights:
- To be informed what information I hold.
- To access the information I hold about you (free of charge for the initial request).
- To rectify any inaccurate or incomplete personal information.
- To data portability
- The right to object
- The right to not be subjected to automated decision making including profiling
- To withdraw consent to me using your personal information.
- To request your personal information be erased (though I can decline whilst the information is needed for me to practice lawfully & competently).
If you have any queries about your privacy and data protection, or would like a copy of my full Information Governance Policy, please do not hesitate to be in contact with me. Email firstname.lastname@example.org