This policy sets out the basis on which any personal data I collect from you, or that you provide to me, will be processed by me.
Please read the following carefully to understand my views and practices regarding your personal data and how I will treat it.
For the purpose of the Data Protection Act 1998 (the Act) and General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the data controller is Rachael Hough (address available on request).
Secure Storage
Your details will be stored and kept securely and confidentially in an electronic filing system. All your personal details are password protected and deleted once our therapeutic relationship has ended.
Any paper documents will be kept in a locked filing system.
Counselling session notes
As part of my practice I keep brief session notes. These notes are annonymised and are stored securely and confidentially in a password protected electronic filing system. For legal reasons I will keep the session notes for a period of 7 years, from the date our therapeutic relationship ends, after which they will be deleted.
Information I may collect from you
I may collect and process the following data about you:
- You may provide information about yourself by corresponding with me by phone or email, and other.
- This includes information you provide when you send a message through any online contact forms, and when you respond to me directly via email.
- The information you provide may include but not limited to your name, address, email address and phone number
How the information is used
I use information held about you in the following ways:
- Information you provide, and information I collect about you.
- I will use this information to carry out my professional and contractual obligations during our therapeutic relationship. This includes:
- Contracting and ensuring the terms found in the contract are upheld by both parties.
- In case of emergencies or where disclosure might be necessary – I will contact your GP or next of kin in these cases, with your knowledge and consent UNLESS it is a case of terrorism or money laundering, which by law I must report without the need for consent.
- I will use this information to carry out my professional and contractual obligations during our therapeutic relationship. This includes:
- Contracting and ensuring the terms found in the contract are upheld by both parties.
- In case of emergencies or where disclosure might be necessary – I will contact your GP or next of kin in these cases, with your knowledge and consent UNLESS it is a case of terrorism or money laundering, which by law I must report without the need for consent.
- I will use this information to carry out my professional and contractual obligations during our therapeutic relationship. This includes:
- Information I receive from other sources.
- This might only be the case when referred by EAPs or other third parties. The data will be handled safely as above.
Disclosure of your information
I will not share your personal information with anyone else, unless there is a duty to disclose in order to comply with any legal obligation (terrorism alerts, money laundering).
The only other person involved in your case – you will be anonymised by a numerical alias – will be my Supervisor, who is held by the same privacy, data protection and confidentiality clauses as described here and in my contract.
Where I store your personal data
The data collected will be kept in a password protected electronic system, in a password protected Document and discarded after a period of 7 years
Access to information
The current Act gives you the right to access information held about you. Your right of access can be exercised in accordance with the Act.
Your rights
Right to Access
You have the right to ask for a copy of your personal information, free of charge, in an electronic or paper format. You also have the right to ask me to amend or change any incorrect information about you.
Right to be forgotten
You have the right to ask me to delete any information that I hold about you, including personal information that is no longer relevant to original purposes – for example when our therapeutic relationship has ended or if you wish to withdraw consent. In all cases and when considering such requests, these rights are obligatory unless it’s information that I have a legal obligation to retain.
Data Portability
You have the right to receive your personal information as previously provided, and to transfer this information to another party
Third Party Privacy
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.
The legal basis for the processing of personal data in this context are Art. 6 (1) lit. c GDPR and Art. 6 (1) lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.