Privacy Notice: Use of information
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisations website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
- Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
- Any document containing personal data will state “Official-sensitive, private and confidential” clearly.
- All emails will contain a privacy statement.
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability;
- the right to object; and
- the right not to be subject to automated decision-making including profiling.
Please note that Craig Coventry Counselling and Psychotherapy does not use automated decision-making tools, including profiling.
When an individual visits www.craigcoventrycounselling.co.uk, Google analytics who are considered a third party service, collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Craig Coventry Counselling and Psychotherapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.
The cookies used on www.craigcoventrycounselling.co.uk are either necessary to enable basic website functions; statistical- to monitor the website’s usage, including location and type of browser of the website user; or for marketing purposes- targeting ads, social media impressions and for google-analytics to track device behaviour online.
The ‘statistic’ and ‘preferences’ tick boxes on the cookie consent pop-up are pre-ticked; they do not fall under GDPR as they do not collect personal data. You can opt-out on the pop-up cookie consent banner on your first visit to the website, Alternatively, you can change or withdraw consent in the cookie declaration below.
bOnline is a third-party service that hosts Craig Coventry Counselling and Psychotherapy’s website. bOnline also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website.
Craig Coventry Counselling and Psychotherapy uses Linkedin, Twitter, Pintrest and Facebook business page. These third-party providers have their own privacy policies in which you would have already agreed to when creating an account. Any messages sent to the inbox of social media accounts are stored by the provider and I will regularly delete (or archive where deletion is not provided) after a maximum of three months.
Therapeutic Will- Provided by Claire Black Counselling
A ‘Therapeutic Will’ is a requirement of the British Association of Counselling and Psychotherapy (BACP). If something unfortunate were to happen to me, a therapist who has been nominated to carry out my ‘Therapeutic Will’ will have the passwords to my stored data. The nominated person will then contact my clients to inform them of any misfortune, help them find alternative support if required and will delete and shred the information stored.
Claire Black Counselling is nominated as to carry out my Therapeutic Will: https://www.claireblackcounselling.co.uk/
I use iZettle to receive card payments. Making payment is optional. Information on how iZettle use data can be found here: https://www.izettle.com/gb
Supervision- Provided by Click Counselling
As a counsellor and psychotherapist, I am required to have regular supervision. During supervision, the content of the sessions may be shared along with your first name, age and location of practice in which you come for sessions. Please note Click Counselling is GDPR compliant and prioritises safety and confidentiality.
Healthcare on Demand Clinic
All sessions held in my Guildford practice are located within the Healthcare on Demand Clinic. Healthcare on Demand us Booking Bug as their electronic room booking system. This means that your name and appointment times will be entered onto Booking Bug and that your name and appointment time will also be visible to Management and administrative staff at the Healthcare on Demand Clinic.
Online video sessions are held on Vsee. Vsee are chosen due to their level of security and ownership of data. For more information on Vsee’s privacy, look here: https://vsee.com/privacy
|Information Asset||Information Owner Asset||Retention||Trigger for Disposal|
|Email (including sent items)||Craig Coventry||Annual review period every January, any remaining live data untouched until following review period.||End of retention period|
|Contact details held on mobile devices||Craig Coventry||All entries to be deleted prior to decommissioning of mobile device or reissue of device||Deleted within 1 week of the end of contract|
|Call history and text messages stored on mobile device||Craig Coventry||Automatic deletion from 1 Month of contact.||End of retention period|
|Paper Diaries||Craig Coventry||3 months from the period in which its use ends.||End of retention period|
|Policies||Craig Coventry||Until new policy has been put into place||End of retention period|
|Client records including session notes, initial consultation notes and client contact form||Craig Coventry||All records of session notes, consultation and contact form are deleted within a week of the termination of the therapy contract.||End of the therapy contract|
|Waiting lists||Craig Coventry||Annual review period every January, old waiting list destroyed and new waiting list developed with any remaining live data transferred to new live document.||End of retention period|
|Website contact form enquires||Craig Coventry||1 month after first session, or one month after no contact being made if a session has not been made.||End of retention period|
|6 years from the end of the financial period to which they pertain to.||End of retention period|
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
What are the lawful basis for processing data at Craig Coventry Counselling and Psychotherapy?
Consent in relation to communication: the individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
This means that Craig Coventry Counselling and Psychotherapy does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
Craig Coventry Counselling and Psychotherapy processes personal information to enable the provision of Counselling and Psychotherapy, to advertise services and to maintain accounts and records.
Type/classes of information processed
Craig Coventry Counselling and Psychotherapy processes information relevant to the above reasons/purposes. This information may include:
- personal details
- family, lifestyle and social circumstances
- goods and services
- financial details
- employment and education details
Craig Coventry Counselling and Psychotherapy also processes sensitive classes of information that may include:
- physical or mental health details
- racial or ethnic origin
- religious or other beliefs of a similar nature
- offences and alleged offences
Craig Coventry Counselling and Psychotherapy processes personal information about:
- business contacts
- professional advisers
How Can I Help?
Contact Craig today for any enquiries.