Data Protection Policy
The 2016 General Data Protection Regulations classify me as a data controller and require me to tell you how I protect your data. In the process of undertaking psychotherapy sessions, some of your personal data will be stored and processed. This document is provided in order to make as transparent as possible how I use it, where I keep it and what I do with it. For more information please refer to the EU GDPR website: https://www.eugdpr.org/
Personal Data Processed and Stored
• In my role as a psychotherapist in private practice I collect the following information which could identify you: your name, phone number, email address, and if appropriate your address and GP details. This is so that I have methods of contacting you. In case of my ill health this information can be accessed by an executor (named in my professional will) who would need this information in order to contact you. This contact information is stored electronically on a password protected file.
• I also keep professional notes of each psychotherapy session, identified by your initials and the date of the session. I use this to keep a record of our work as it progresses. This information is stored electronically and again is password protected. Only myself and my executor have access to this password.
• Your contract documents are stored on paper in a secure locked filing cabinet.
• Your phone number is stored by initials on my phone which has a lock-screen.
• You may make a Subject Access Request to access your personal data, which I would need to respond to within 30 days.
Data Retention / Deletion
• I delete ‘administrative’ type texts or emails that you send me once they have been acted upon, e.g. arranging sessions. If I receive a more in-depth email relating to session content then I will store this electronically and password protect the document.
• As advised by my professional insurance the professional session notes will be kept securely in case of them being required for legal claims.
Data Sharing
• As stated in my contract there are limited situations where I may share your information, such as if I believe you or someone else is at risk of significant harm. I would always inform you first that I need to share my concerns with another professional (e.g. GP or Care Coordinator).
• In rare cases I my be obliged by law to share the content of our sessions – this would be if you disclosed matters relating to terrorism or money laundering. In this unlikely event I would always inform you before doing so.
Updated May 2018
