Garden Business Centre
Nature of Business: Counsellor, Therapist, Supervisor
‘therapeutic services’ will be used to include counselling, therapy and supervision.)
Privacy Notice (March 2019)
Your privacy is important to me. This privacy notice explains how I use your
information under the General Data Protection Regulation (EU/2016/679) (the
GDPR) and The Data Protection Act 2018.
Data Controller is the term used to describe the person or organisation
that collects and stores and has responsibility for people’s personal
data. The Data Controller for my business is Dorothy Davis.
I am registered with the Information Commissioner’s
Office (ZA 193725).
HOW INFORMATION IS PROVIDED TO ME
For those who enquire about
The initial data I process is information
given to me directly when a person makes an enquiry by telephone, e-mail, text,
or through an online directory for therapeutic services.
(I use the British Association for
Counselling and Psychotherapy (BACP) Therapist Directory; The Counselling
Directory; The Hypnotherapy Directory)
For those who attend at least one session:
The information I process is information given to me by the client.
I may also receive data
indirectly from a 3 party:
For example, when information is provided to me - by a GP or other
health professional when making a referral; through an Employee Assistance
Programme (EAP); from an insurance company; or when a parent or trusted
individual gives me details when making an enquiry on behalf of someone else.
WHAT TYPE OF INFORMATION DO I PROCESS?
o Contact details & basic
information: This may include your name,
address, telephone / mobile number, e-mail address and date-of-birth. You may choose to give me your emergency
Information will be recorded in the Contract and Contact Details.
For Information processed at payment:
o If an invoice is required, your
name & address will appear on a copy invoice & retained for accounting
o Your name, bank account details
will be on any cheque payment you make; a copy is retained for my accounts.
Special category data:
the information you give me may be sensitive personal information (termed ‘special category’ data under the
GDPR). It is information which relates
to any of the following: health; sex
life or sexual orientation; racial or ethnic origin, political opinions,
religious or philosophical beliefs, trade union membership, genetics or
o for example,
you may give me details
of your health or medical issues; your GP details.
Information may be recorded in the Contract, Client History Form, Health Questionnaires,
my notes / records.
WHAT DO I USE THE INFORMATION
The information will be processed in order to enter into a contract with you,
provide therapeutic services to you, and administer my business. For example, to: contact you; respond to your enquiries; make
appointments; inform therapeutic decision making; maintain my notes and
records; meet legal and professional obligations; safeguard.
WHEN MAY I SHARE INFORMATION?
recognise that the information you give to me is personal and may be
sensitive. I will not share your
information with any third parties unless it is for one of the following:
o you have consented to
(for example: by providing information to me
after I’ve told you that I will supply the information to a third party; you
have been referred to me by your GP, through an Employee Assistance Programme
(EAP), your workplace, an insurer, or other organisation and you have consented
that I share information, reports or attendance data; or you agree to a
referral to another professional; it is a term / condition of our Contract)
o I am required to do so by any court or law
o it is for the prevention and detection of a serious crime
o it is in order to protect a child, a vulnerable adult,
yourself or the public
o I consider that you are
in imminent risk of causing serious harm to yourself or others
o It is in supervision. As a requirement of my professional
organisation and in order to enhance the quality of therapy being offered, I
may discuss my work with you with my therapeutic supervisor or with my peer
support group / colleagues.
o it is for a legitimate business purpose, including:
the assessment of any tax or duty
by any relevant regulatory body
protect the rights, property or safety of Dorothy Davis or any third parties
If I am
unable to provide a therapeutic service, for whatever reason, my executor may
access your notes and records.
WITH WHOM MAY THE INFORMATION BE SHARED?
people I may need to share
information with, changes depending on circumstances. If I share information it will be with
relevant people, services, organisations or authorities. You may have already
given your consent for me to share. In
other instances, I will always try to speak to you about this first, unless circumstances,
the law or safeguarding issues prevent this.
not share your information with any third party for the purpose of direct
a general rule I do not transfer your personal information outside the European
Economic Area (EEA). If I do so, I will
ensure that suitable safeguards are in place.
Client records, handwritten notes and correspondence will be
kept in locked cabinets / cupboards.
texts messages sent between us are held on my password-protected smart-phone as
may be any voicemail messages you leave.
are accessed on a password protected lap-top & smart-phone.
I am not in control of
data (including e-mails, texts and messages which you send to me). Please be aware that these may not be
secure. It is preferable, therefore, to
limit their use to the arrangement of appointments.
The visitor book in the reception area is not part of my business. If you decide to write in the visitor book you may want to give only first name or initials.
HOW LONG IS INFORMATION KEPT FOR?
Information will be kept for as long as necessary in line with legal, regulatory,
insurance or ethical requirements / guidance.
For initial enquiries only: E-mails / texts / messages may be kept for up
to 3 months.
For those who attend at least one session:
o E-mails / text / messages may be
kept for as long as the therapeutic relationship is active, and deleted from
the laptop /smartphone thereafter. If
deemed important, these may be printed, and then kept as paper-based
information (see below).
o Paper-based information
relating to client notes and records will be kept for a minimum of 7 years
after the last session took place.
o Data relating to payment
transactions, accounts and taxation will be kept for a minimum of 7 years to
comply with HMRC requirements.
The need to keep your information will be re-assessed on a regular basis. When
no longer required, paper records will be shredded, text / voicemail messages and
computer records deleted.
THE LAWFUL BASES I USE FOR HOLDING AND USING YOUR
Personal data: I rely on a combination of contract and legitimate
interests as the lawful bases for processing your personal information, that
the performance of a contract to which you are party, or in order to take steps
at your request prior to entering into a contract. Article 6(1)(b)
the purpose of legitimate interests, Article 6(1)(f). This means that I may process personal data
for legitimate business purposes.
Special category data: The lawful basis I
rely on is:
processing is necessary
for the provision of health care or treatment or pursuant to a contract with a
health professional. Article 9(2)(h)
Under data protection law, you
have certain rights. You may be able to
use some of these rights in relation to information I hold about you. These rights, however, don’t apply in all
circumstances. You can read more about these rights on the
Information Commissioner’s Office website at www.ico.org.uk.
to be informed: You have the right to be
informed about how I process your information.
of access: You have the right to ask me
for copies of your personal information.
There are some exemptions to this right.
to rectification: You have the right to
ask me to rectify information if you believe it is inaccurate or incomplete.
to erasure: You have the right to ask me
to erase your personal data in certain circumstances.
to restrict processing: You have the
right to ask me to restrict the processing of your information in some
to data portability: This right only
applies when the processing is automated.
to object: You have the right to object
to the processing of your information in some circumstances.
Please ask if you have any
questions about this privacy notice. If you believe the information I hold
about you is incorrect or out of date, or if you have concerns about how I am
handling your personal information, please contact me, Dorothy Davis, and I
will try to resolve those concerns.
If you have any further concerns
about how I handle your data, you can contact the Information Commissioner’s office
at: Information Commissioner’s Office,
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Queens Garden Business Centre