Why we hold your data and what we do with it.
Introduction
Under the new GDPR regulations, as a client of Deep Connexions Therapy Practice, there are a few things we need to let you know about the information we will hold about you and the reasons for this. Everything we do follows normal good practice for holding data generally as well as for a therapeutic practice, but it is important and your legal right to understand the information before you come for treatment with us.
What information do we collect?
We record contact details which usually include:
· Names and address
· Telephone Numbers
· Email addresses
· School/institute your child is attending.
· Background Information – Parental & Children’s Questionnaire / Auditory Processing Questionnaire / ‘Get to Know You’ Form / Birth History Form (ante natal experience, postnatal experiences early childhood and schooling experiences, diagnosis of any medical conditions and learning/behavioural conditions, parental history) that you fill in and any comments you make when in consultation.
· Any reports you wish to share with us
· Assessment Record/Therapeutic Session Notes
o completed at the initial assessment and then updated at every consultation as ongoing handwritten clinical notes, during session time when you talk more about your circumstances or the issues you are seeking help with. I may not record every detail of our verbal conversations but just what is needed to keep a clear record of how you/ your child are doing.
· I will also note my impression from our sessions including what I perceive through the therapeutic treatment.
· Drawing and writing activities completed by your child
· Written report and success criteria
· Any correspondence you request
· Emails
· Appointment times and dates
Reasons for holding personal information
As the work we do together is to support your health, whether physical, mental, or emotional, it is important to hear some of your history to work with you responsibly and carefully.
The case history information is important in helping us to understand your situation, to get to know you and to give you the best treatment possible, as well as to be able to track your progress over time. You can choose how much you would wish to share, and you should never feel obliged to talk about anything that you do not want to.
You can refuse to give the above information, but we may not be able to deliver our service.
How is this information used?
We have a legitimate interest in collecting the above information;
· For the purposes of communication;
· For the purpose of supporting you / and your child in order to
o assess you or your child;
o give them a bespoke exercise programme/ treatment plan;
o provide written reports as required;
o measure and communicate progress to you / and your child;
Your contact information is used only in order to arrange appointments or to follow up with you and never for any other reason.
The Legal Basis for holding your information
In legal terms, the main reason for holding information about clients is in order to fulfil a ‘contract’ with you to give Craniosacral Therapy/ /Neuro Developmental / Reflex Integration Therapy, Integrative Baby Therapy or Birth Mask Reveal Therapy.
In addition, because the information that is talked about in any kind of therapy can be very personal including information about physical or mental health, this is called ‘special categories’, and there is a separate legal basis for this with strict conditions such as confidentiality which must be met.
Sharing your data with a third party
Protecting your privacy is extremely important to us and we will endeavour to ensure that no one has access to your information without your prior knowledge or consent. Storing your data in a safe and secure way is also important to us.
· Your data would not be shared with a third party without your express permission or if requested by you.
· In exceptional circumstances we may be required by law to share your information and data with other organisations such as courts of law and the police. Normally we would take professional advice before sharing such data without your consent.
· We may for the purpose of research, training others or as publicity use your information as a case study. Examples of case studies are given on our website. In these circumstances, all information would be anonymised. The client/child’s name would be anonymised, there would be no geographical reference and in the case of children, you would be referred to as ‘the parent’ and your child given a false name. You may refuse consent to this.
· We may incorporate your data along with other clients for the purpose of research and dissemination. All personal references etc. will be anonymised. You may refuse consent to this.
- As part of our code of practice we are required to carry out continuing professional development, and to engage in regular on-going clinical supervision. This is to ensure an ethical and professional service to our clients. We may discuss your case in supervision but would not use any identifying details.
- If we wish to record a session or part of a session, we will ask you first. In the event the session is recorded you may have a copy. If you wish to record the sessions or part of yourself, for instance a specific exercise, you may do so without cost, but any recording is for your own private use and must not be shared in any public domain without our express permission.
How long do we keep your personal data for?
We are not allowed to hold on to your personal data for longer than needed, and only related to the original reason for holding the information in the first place. After that we may retain your records for a limited time where needed for business/accounting or legal purposes. This is called the retention period.
· Data for those individuals aged 21 years and above will be stored in accordance with the guidance of the aforementioned professional bodies and kept for a period of at least seven years post the last session/review date.
· Data for children will be stored up to the age of 21 years plus seven years thereafter.
· In order to be able to provide follow-up if clients return after a break, as well as to allow time for disposal of notes, the maximum time we will keep your notes is 15 years after which information stored on the computer is deleted and paper documentation is torn up/ shredded, mixed up with other documents and either composted or sent for recycling.
· Upon reaching the age of 21 your child can request that all personal data pertaining to them is destroyed.
· Your contact details may be kept for longer but will not be shared with anyone without your consent.
Security
We are very aware of the sensitive nature of the information we receive as practitioners, and we take steps to protect your personal information against loss or theft, as well as unauthorised access, disclosure, copying, use of modification.
Given that emails can never be fully guaranteed to be fully secure, and that they may count as ‘data processing’ under GDPR, if you want to discuss something personal about your situation or treatment, we ask that you contact us to arrange a chat rather than sending personal information by email.
As a small business we do not have access to sophisticated data protection facilities and fireproof archival storage but will undertake to take precautions so that your data is protected, including:
· Use of a password protected computer/laptop;
· Use of anti-virus and anti-malware software;
· Storing documentation in a locked filing box;
· Storing Archived documents in a locked box.
Will your information remain in the UK?
You have the right to know if I expect to remove or send your information outside of the UK or the European Economic Area (EEA), and if so, the safeguards that have been put in place to protect your information and your rights. This is important because not all countries are governed by the same strict regulations as the UK, and some ways of holding information(such as on a ‘cloud’) can mean information is stored on computers which may be outside the area governed by the GDPR.
As I travel including outside Europe, I may access your information from a country outside the European Economic Area. Not all countries outside the EEA may comply with the GDPR but I have checked the level of security of the cloud on which I access information – Microsoft OneDrive. I also have extra protection on my laptop and mobile phone to ensure security.
Data Protection and your rights
Data regulations say that anyone who has information held about them has various rights, including the right to know what information is held and to correct anything that is not right in their records.
Your rights to refuse to give information
Under GDPR, you are not required to give your personal information and you have a right to be informed of any consequences of refusing to give it.
A case history is needed in order to ‘fulfil our contract’, to give you /your child the best treatment possible, including understanding your situation and any difficulties you are seeking help for, as well as to comply with our Code of Ethics. So if you do not wish to give any information at all, I may be unable to give you therapeutic support, but we are always happy to have a chat about what may or may not feel comfortable for you.
Your right to see what information we hold about you
All data we hold upon you and your family is either supplied by you or generated by us in the form of either assessment notes, or written reports.
· Beyond this you have the right to access your and your child’s data providing you cover any extra costs we may accrue by giving you access (postage, photocopying etc.).
Your right to object to us holding your information
If you object to us holding your information, you can ask us to stop.
Due to our Code of Ethics requiring us to keep notes for a minimum time as described above, we will need to retain your records in order to comply with this.
Your right to ‘rectify’ any information we hold which is not correct
If you feel that any of the information, we hold about you is inaccurate or incorrect, you have the right to tell us about this and request that the information is corrected.
Please do let us know if any of your details change so we can keep your records up to date.
Your right to make a complaint
You have the right to complain if you are unhappy about the way we are looking after your information, using your data or are storing your data – in the first instance to us at Deep Connexions, and also to our relevant professional bodies;
- The Institute of Neuro Physiological Psychology 1 Stanley St, Chester CH1 2LR mail@inpp.org.uk
- The Craniosacral Therapy Association, (CSTA), Monomark House
27 Old Gloucester Street, London, WC1N 3AX admin@craniosacral.co.uk - The Complimentary & Natural Healthcare Council, (CNHC), 46-48 East Smithfield
London, E1W 1AW info@cnhc.org.uk
If you are not satisfied with the outcome you should the lodge a complaint with the Information Commissioner’s Office (ICO) https://ico.org.uk/concerns/ or 0303 1231113
Understanding and agreeing to this information
You should make sure you understand and agree to us keeping this information about you – if you have any questions at all please ask and we will be happy to answer them.
How to contact us?
If you have any queries, concerns or complaints you may contact us,
· during consultations
· email – info@deepconnexions.co.uk
· tel – 07790 783280
Changes to this notice
We may make changes to this notice and information from time to time, for example if there are changes in the laws about data protection. While you are a client, we will always let you know of changes and updates by posting them on our website.