Why I collect your data and what I do with it
When you supply your personal details to my practice I store and process them for three reasons (the terms in bold are those relevant terms used in the Data Protection Act 2018, which includes the General Data Protection Regulation):
- I need to collect personal information about you in order to provide you with the best possible counselling and psychotherapy (which I call therapy from here on). When you request therapy, and I agree to provide that, this constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that I would not be able to provide therapy. As part of our work I may occasionally send you some therapy information via email.
- I have a Legitimate Interest in collecting your personal information, because without it I couldn’t do my job effectively and safely. It is important that I am able to make contact with you in order to confirm your appointments with me or to update you on matters related to your therapy sessions.
- I have a legal obligation to retain your therapy records for six years after your most recent appointment; after this period you can ask me to delete your records if you wish.
I keep brief, hand-written notes. I securely store your contact details on paper; and your contact phone number and email address electronically, secured with a password. I give a colleague your contact details which is stored securely, should anything happen to me that would mean I couldn’t contact you myself.
- You have the right to see what personal data of yours I hold, and you can also ask me to correct any factual errors. You can email me about that at firstname.lastname@example.org
- Provided the legal minimum period of six years has elapsed you can also ask me to erase your records. Again, you can email me about that at email@example.com
- I want you to be absolutely confident that I am treating your personal data responsibly, and that I am doing everything I can to make sure that the only people who can access that data have a genuine need to do so
- If you feel that I am mishandling your personal data in some way, you can raise your concerns by writing to me as the Data Controller at firstname.lastname@example.org, as detailed here
- If you are dissatisfied with my response you can contact the ICO here