Privacy Policy

I am registered with the ICO (Information Commissioners Office).

If you have concerns about how I use your personal information, please contact me in the first instance at contact@the-therapyshed.co.uk. I will acknowledge your complaint within 30 days and investigate it without undue delay. If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).

Under the GDPR rules I am the Data Controller. Because we have a contract I will need to collect certain data to fulfil our contract. Therefore, I need to inform you of what data I collect and what I intend to do with it.

The paper documents I hold are:

  • Contact sheet including special category health data.
  • The counselling agreement we hold between us
  • Brief session notes
  • Session process notes
  • GDPR Agreement (this document)

The electronic details I may hold are:

  • Email address
  • Telephone number (SMS)
  • Any Facebook messages
  • Data included on WriteUpp (see below)
  • Bank details if paying via BACS

Lawful Basis

  • I collect all data under the lawful basis of legitimate interests.
  • The counselling contract and administration data is collected under the lawful basis of our contract.
  • Any notes and health information is collected under the provision of health/social care and counselling services (special category condition).
  • Accounting records are kept under the lawful basis of legal obligation.

What data do I keep and why do I need it?

  • Name and age: This basic information helps me get to know you. Your birthday is your NHS identifier should you become ill during session.
  • Address, email address, phone number: I use this as a way of contacting you regarding your sessions. We will discuss which method of communication suits you best in our initial session.
  • GP details: If I was worried that you were at risk of serious harm, then I may need to contact your GP. If I can, I will tell you that I am going to do this. If you were to become ill within our session, then I may also need to contact your GP or 111.
  • Counselling and brief family history: This information is gathered to help me gauge how to work with you effectively.
  • Current medical conditions/medication/disabilities/suicidal ideation (special category health data): Again this information helps me work ethically and safely with you.
  • Session notes: I keep very brief notes of our sessions, as required by my insurance company.

Will I share your data and if I do, who will I share it with and for what purpose?

It is extremely unlikely that I will share your data. I will never sell it on or use it for unethical reasons. If you pay via BACS your name will appear on my statements and this may be seen by financial services. I may have to share it if my notes are subpoenaed by court or if you tell me you are at serious risk of harm. Here I will do everything I can to gain your consent.

If I have become aware of your intent to cause harm to another person/organisation the law may require that I inform an authority without seeking your permission. In such a situation the law may require that I share your personal information without your knowledge. If you disclose that you are acting illegally, eg. Involved in money laundering the law requires me to inform an authority.

I also have regular supervision. This is where I take my client work to a qualified supervisor. It is an ethical obligation for me to do this to ensure that I am working safely with you. You are not identifiable.

How will I store your data?

The details I take from you in our initial session are locked away in a filing cabinet. In addition I use a cloud-based application, WriteUpp, for diary management and duplicates the manual notes I have in my filing cabinet. WriteUpp is extremely secure. I have a personal URL, which requires a username and password. The data is never stored on my computer, I do not have to install any software. WriteUpp uses Microsoft’s Azure cloud infrastructure, which is trusted by government agencies. The data that I send to WriteUpp is encrypted using 256-bit encryption and is fully GDPR compliant.

If we are conducting counselling online I will recommend that we use Zoom. Zoom app will only store my basic information such as my email address, user password, my name and phone number. Zoom will also require you to download the app to use. The Zoom room is where we will meet and for online video counselling communications are established using 256-bit TLS encryption. Clients are entered into the room via me and the client’s unique password.

Your phone number will be kept on my phone with your first name and surname initial and your email address on my computer and/or phone. Both the phone and computer are password protected and only I have access.

I do have cameras on the house, for protecting me and also you. No data is stored long term on these devices. You will find a notification sticker at the front door, as per legal requirements.

How long will I store your data and how will I dispose of it?

Your brief session notes, contact/assessment sheet, this privacy policy, contract agreement and unique code will be kept for 7 years, which is the time frame my insurance company requests. My process notes are shredded at the end of our time together. If I cannot keep your data in this way, unfortunately I will not be insured to work with you. I will delete your phone number and emails and any messages on social media 1 month after our work finishes.

Your Rights:

  • Right to be informed: To be informed about what information I hold (eg this document).
  • Right to rectify: Any inaccurate or incomplete personal information.
  • Right to withdraw consent: To me using your personal information – your personal information will never be passed on, it will only be used lawfully for your safety, with your permission (excluding immediate risk).
  • Right of access: At any time you can ask for a copy of the data I keep. This will be provided to you within one month of the date of asking.
  • Right to data portability: You have the right to take your data and share it with another party.
  • Right of erasure: To request your personal information to be erased (I can decline this whilst the information is needed for me to practice lawfully and competently).

A printed copy of this statement will be given to you when we first meet for counselling or with online therapy, it will be emailed to you.

By consenting to this document you agree for us to work in this way.