Karen Stevenson . HCPC accredited Integrative Art Psychotherapist (HCPC Registration No. AS017530)
VARNA COUNSELLING AND PSYCHOTHERAPY
Email: email@example.com . Tel: 07919 653481
Data protection law states that individuals have the right to be informed as to how their personal data is held and used. I adhere to the current data protection legislation (General Data Protection Regulation: EU/2016/679) and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose that it was given to me. This privacy notice explains the personal information I collect from you as my client, as well as how I store, process and delete it.
As a private practitioner I act as both Data Controller – which means that I plan procedures regarding how data is held according to the new GDPR regulations (I am registered with the Information Commissioner’s Office - Registration No. ZB193744) – and Data Processor – which means that I collect and store the data required within my therapy practice.
At your initial consultation I will collect the following personal details from you:
· Your name, date of birth, address, contact number and email address
· The name, address and telephone number of an emergency contact
· Contact details of your GP (and psychiatrist, if applicable)
· Details of past or present relevant mental or physical health issues and medication
Electronic records are kept securely in password-protected devices, accessed only by me, and paper-based records are kept in a secure, locked filing cabinet.
Our working contract sets out what to expect from therapy, my commitment to client confidentiality and the circumstances where I would be ethically bound to break confidentiality (also listed below), and you will need to sign this agreement before we commence therapy. If you decide not to proceed with therapy, I will ensure your personal data is deleted within four weeks (if you would like the information deleted sooner, please let me know).
Factual notes about our sessions and artwork are also kept securely, as detailed above, but are kept separately from your personal details and in session notes you are referred to by initials only so that your anonymity is preserved.
In line with the requirements of my professional body, the HCPC, my work is regularly supervised and therefore notes and artwork may be shared with my clinical supervisor. However, you will be referred to by your first name only and, as stated in the client contract, my supervisor is bound by the same GDPR and confidentiality rules.
I use a mobile phone to receive client phone calls and text messages, which is password protected and your number is anonymised. Your email address is stored in my protonmail account, which is a more secure email provider.
Your emergency contact details are also stored anonymously on my password protected phone, for me to access in the case of an emergency during a session or if I were to have serious concerns about your wellbeing.
The client agreement and all contact details will be kept for six months after our final session together and then permanently deleted unless you request otherwise. Session notes are kept for 8 years, in line with HCPC recommendations, after which time they will be destroyed.
As detailed in the client contract, the only exceptions to confidentiality would be if I have reason to believe that you or someone else is at risk of serious harm, and I would always endeavour to discuss this with you first. I would inform you as soon as possible if there was ever a breach in the protection of your information. Additionally, where a threat of terrorism or drug trafficking is disclosed I am required by law to inform the authorities.
Lastly, you have the right to be informed about and ask to see any of the information that I hold about you and I am legally required to respond to any request in writing from a client to see their personal data within 30 days. You may also ask me to correct or complete any inaccurate or incomplete personal data held about you or delete any data where it is no longer necessary for me to use it (exceptions would be if I was required to retain this information for legal reasons). You can read more about your rights at ico.org.uk/your-data-matters.