General Data Protection Regulation Privacy Notice - Claire Earl Counselling
(v1 May 2018)
This privacy notice explains how I process data to comply with the General Data Protection Regulation (GDPR) 2018. I am a Data Controller registered with the Information Commissioners Office under reference ZA301765. I am committed to protecting your personal data and collecting only necessary data, processing it in a fair, transparent and lawful manner, keeping it no longer than necessary and thereafter securely destroying it. I have implemented appropriate physical, technical and procedural measures to protect your personal data from improper access, use, alteration, destruction and loss. You are entering into an agreement with me for the supply of a service - counselling - and I am processing your data in order to either provide that service or to determine if the service is appropriate. Some of the information you may disclose to me is considered ‘special category’ data. This is sensitive information that might include details for example about your health, mental health, sexual orientation, religious, cultural and political beliefs etc. The lawful basis under which I process special category data is that I am providing a health and/or social care service. I will never sell or share your personal data with other organisations for marketing or promotional, sales or other purposes. I do not use any form of automated profiling or decision-making.
What information do you collect?
In addition to contact details, I keep brief, factual notes about our counselling sessions which may include sensitive information that you have disclosed to me. I also keep creative work, writings, drawings or diagrams that we have used during our work.
Where do you keep this information?
All client session notes are stored in paper form in my office in a secure, locked file. I do not routinely bring notes to the clinic/sessions. I keep contact details and text messages/emails on my private practice confidential mobile phone and iPad which are password protected and stored securely when not in use.
Who is this information shared with?
Information is not shared with anyone. My professional code of conduct requires me to have regular supervision, which is bound by the same terms of confidentiality; clients are referred to by initials or case ID number only. In the event of me becoming incapacitated in some way, only a nominated trusted colleague would have access to the contact details of my clients. Please see Counselling Practice Living Will or ask me for further details. The only other occasion when I am obliged to break confidentiality would be for reasons which are explained in Our Contract which we discuss and I ask you to sign to confirm you are aware of and understand this at the beginning of your counselling.
How long do you keep records for?
Generally, I keep personal data for up to 7 years as it could be useful and relevant for a client returning to counselling. I have chosen 7 years as a reasonable time between retaining potentially useful data and keeping data for no longer than is necessary. Your contact details are deleted from devices and paper records are shredded. You would be notified within 72 hours should I become aware of any breaches in data confidentiality.
What are my rights?
You can:
- request access to a copy of the personal data I hold about you.
- ask me to change or complete any inaccurate or incomplete personal data held about you.
- ask me to delete your personal data where it is no longer necessary for me to use it.
- ask me to provide you or a third party with some of the personal data that I hold about you in a commonly used form, so it can be easily transferred.
- ask me to restrict the personal data I use about you where you have asked for it to be erased or where you have objected to my use of it.
Note that some of these rights only apply in certain circumstances and I may not be able to fulfil every request. Please contact me if you wish to exercise any of these rights, or if you want to discuss with me any aspect of my privacy practices.
