Version: 3 Date: 13.08.20
This Privacy Statement is an integral part of our therapy contract and tells you what data I am collecting and what I intend to do with it in line with my Data Policy. Christine Bonsmann is the Data Controller and is registered with the Information Commissioner’s Office (ICO), reference ZA012068. The GDPR provides you with a number of rights: to be informed, of access, of rectification, to erasure, to restrict processing, to data portability, to object, and not to be subject to automated decision-making including profiling.
What data do I keep and why do I need it?
I need to collect and record personal information about you for the purposes of our contract for therapy. This includes special category data which is necessary to provide a therapy service to you and is collected throughout therapy. The information I keep includes this Privacy Statement, a Therapy Contract for private clients, and brief, factual notes about sessions. The lawful basis for keeping this data is contract. I collect the following data:
Name: I need in order to identify you.
Confirmation you are over 18 years old: I work with clients over 18 years old.
Address: I need this to identify you and to send invoices to private clients. I also need this if I need to break confidentiality.
Email address: I need this to contact you about sessions or to send you therapy resources. Telephone number: I need this if I need to break confidentiality.
GP’s details: If I was worried that you were at risk then I may need to contact your doctor. If I could, I would tell you I was going to do this.
Brief handwritten notes about sessions: I keep anonymised notes after each session for the purposes of clinical supervision and for legal reasons.
Signed Counselling Contract for private clients: I keep this for legal reasons.
Will I share your data and, if I do, who would I share it with and for what purpose?
- If you tell me you are going to harm yourself or someone else I would inform your GP and/or the emergency services.
- If you disclose information about a child who is being harmed or is at significant risk of being harmed I would inform the police and/or social services.
- If requested to do so by a court of law or for legal purposes.
- If you disclose information about a serious crime (drug trafficking, money laundering, terrorism) I have to inform the police.
- I have appointed a Clinical Executor who is my Clinical Supervisor. If I can no longer work with you, they will have access to your first name and telephone number and will contact you.
- As an accredited therapist, I am required to attend clinical supervision. I do not disclose your name or contact details in supervision.
You have the right to see any data held about you and to correct this data. For private clients, please make any request in writing and provide evidence of your identity, for example passport copy and proof of address, and confirm your email address. For couples counselling clients, consent to release information and proof of identity must be provided by all parties. On receipt of the written request and evidence of identity, the request will be responded to within 30 days. If you believe the data are inaccurate, you can ask for it to be corrected. For clients referred by third parties, please contact the referring organisation.
How will I store your data?
All your data are stored securely in locked cabinets and a coded system is in place with client reference numbers. My laptop and iPhone are passcode protected. I do not store your telephone number in my iPhone contacts.
How we communicate
I am unable to guarantee the complete security of data exchanged over the Internet or telephone, so please do not send any sensitive information to me by email, text message or voicemail. I use a paid-for G Suite email account and Google have informed me that this is secure and encrypted. Google uses data centers outside of Europe, please see https://support.google.com/a/answer/2888485?hl=en. I need to make you aware that I am not responsible for any data breach arising from Internet or iPhone hacking and any contact is at your own risk.
How long will I store your data for and how will I dispose of it?
At the end of therapy, I will delete your email address, telephone number and GP details from this Privacy Statement. I will keep this document, your Therapy Contract if relevant, your session notes and any data requests you make for six years after therapy ends. This is to comply with legal requirements (Jenkins, 2018). I will then shred your data safely. I need to keep financial records for seven years for tax purposes so I will delete your code from my logbook after seven years. I delete any texts and voicemails I receive from you as soon as I have responded to them. I delete all emails I have received after responding to them. I may record the content of any texts, voicemails or emails on your session notes. If you are not happy with the way I use your data, you can complain to the Information Commissioner’s Office www.ico.org.uk or telephone them on 0303 123 1113.
Do you understand and agree to the above information: _______ (yes/no)
You can remove your agreement to processing of your data by emailing me at firstname.lastname@example.org. You have the right to ask me to erase any information I hold about you if it is no longer necessary in relation to the purpose for which it was collected. You have the right to transfer your information. Please make any request in writing and provide evidence of your identity, for example passport copy and proof of address. For couples counselling clients, this needs to be provided by all parties.
Personal Data – Please Complete (please advise me of any changes to these)
Full Name: Over 18 years old? _____ (yes/no)
Telephone number: Can I leave voicemail? _____ (yes/no)
Reference: Jenkins, P. (2018). ‘An upgrade for data privacy?’ Counselling at Work, 95.Christine Bonsmann 2018 Copyright