Why I collect your data and what I do with it
When you supply your personal details to my practice I store and process them for three reasons (the terms in bold are those relevant terms used in the Data Protection Act 2018, which includes the General Data Protection Regulation):
1. I need to collect personal information about you in order to provide you with the best possible counselling and psychotherapy (which I call therapy from here on). When you request therapy, and I agree to provide that, this constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that I would not be able to provide therapy. As part of our work I may occasionally send you some therapy information via email.
2. I have a Legitimate Interest in collecting your personal information, because without it I couldn’t do my job effectively and safely. It is important that I am able to make contact with you in order to confirm your appointments with me or to update you on matters related to your therapy sessions.
3. I have a legal obligation to retain your therapy records for six years after your most recent appointment; after this period you can ask me to delete your records if you wish.
I store brief client notes electronically on my computer and access to these is password-protected. Likewise, I store your contact details electronically on a password-protected spreadsheet on my computer, which I regularly back-up on a separate, password-protected hard drive; and your contact phone number and email address on my passcode-protected practice mobile phone on which I also access my practice email. I share your contact details with one of my supervisors via the password-protected spreadsheet, who would use that information to contact you, in case something happens to me and I’m not able to contact you myself.
• You have the right to see what personal data of yours I hold, and you can also ask me to correct any factual errors. You can email me about that at firstname.lastname@example.org
• Provided the legal minimum period of six years has elapsed you can also ask me to erase your records. Again, you can email me about that at email@example.com
• I want you to be absolutely confident that I am treating your personal data responsibly, and that I am doing everything I can to make sure that the only people who can access that data have a genuine need to do so
• If you feel that I am mishandling your personal data in some way, you can raise your concerns by writing to me as the Data Controller at firstname.lastname@example.org, as detailed here
• If you are dissatisfied with my response you can contact the ICO here