Privacy statement

Contact details: Georgina Taylor, therapy@georginataylor.co.uk

It is a legal requirement for therapists to have a privacy statement, as we handle personal data. This privacy statement has been drawn up using the framework provided by the ICO. If you would like to discuss any aspect of this statement or talk through what it means to you in practical terms and everyday language then please do ask me. The shorter statement on your working agreement is a summary of this document.

Privacy Notice

You can read more about data protection law on the ICO website: https://ico.org.uk/for-the-public/

This privacy notice tells you what I do with your personal information.

 

What information I collect, use, and why

I collect or use the following information to provide patient care, services:

  • Name, address and contact details
  • Gender
  • Pronoun preferences
  • Date of birth
  • Next of Kin details including any support networks
  • Emergency contact details
  • Health information (including medical conditions, allergies, medical requirements and medical history)
  • Information about care needs where applicable (including disabilities, home conditions, medication and dietary requirements and general care provisions)
  • Test results (when you give me the results of tests or assessments that you have had elsewhere, such as for ASD or ADHD)
  • Records of meetings and decisions when applicable, e.g. if you provide me with minutes from a meeting you have attended or your authorise someone else to give me this information

I collect or use the following information for safeguarding or public protection reasons:

  • Name, address and contact details
  • Emergency contact details
  • Health information (including medical conditions, allergies, medical requirements and medical history)
  • Information about care needs (where relevant to your safety in therapy)
  • Test results (such as results of an ADHD or ASD assessment)
  • Records of meetings and decisions (when provided by you or by someone else with your permission)

I also collect the following information for safeguarding or public protection reasons:

  • Health information

I collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Safeguarding information
  • Health information

I operate a Ring doorbell (video images): this is due to previous vandalism of cars on the street outside the house.  If you wish this to be turned off for the duration of your appointment please let me know at any time.  Ring stores recordings for 30 days.

 

Lawful bases and data protection rights

Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis I rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

  • Your right of access – You have the right to ask me for copies of your personal information. You can request other information such as details about where I get personal information from and who I share personal information with. There are some exemptions which means you may not receive all the information you ask for.
  • Your right to rectification – You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete.
  • Your right to erasure – You have the right to ask me to delete your personal information.
  • Your right to restriction of processing – You have the right to ask me to limit how I can use your personal information.
  • Your right to object to processing – You have the right to object to the processing of your personal data.
  • Your right to data portability – You have the right to ask that I transfer the personal information you gave me to another organisation, or to you.
  • Your right to withdraw consent – When I use consent as my lawful basis you have the right to withdraw your consent at any time.

If you make a request, I must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

My lawful bases for the collection and use of your data

My lawful bases for collecting or using personal information to provide patient care, services, pharmaceutical products and other goods are:

  • Consent – I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interest:
    • Brief notes of psychotherapy sessions are kept in order to provide the highest possible standard of care; these may include personal or sensitive information that has been discussed with me. Notes and reports from other professionals are kept in so far as they help me to provide the highest standard of care, i.e. they are of direct relevance to my understanding of you / your child and to the work I am doing in therapy. They are stored on a password protected device, and any paper copies you provide are kept in a locked cupboard.

My lawful bases for collecting or using personal information for safeguarding or public protection reasons are:

  • Consent – I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • If a complaint has been made against me then any relevant client information may be shared with the Association of Child Psychotherapists and with my professional liability insurer (Towergate Insurance).  This is because the Association of Child Psychotherapists ensure high professional standards, and a professional liability insurer provides the legal protection that I am required to have.

My lawful bases for collecting or using personal information to comply with legal requirements are:

  • Legal obligation – I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Where I get personal information from

  • Directly from you
  • Family members or carers
  • Other health and care providers (with your permission)
  • Schools, colleges, universities or other education organisations (with your permission)
  • Other professionals with your permission

How long I keep information

Information is kept for three full years from the end point of your / your child’s therapy. So, for someone ending therapy at any point in 2025 information will be deleted in January 2029. Financial records are kept for six full financial years. 

Who I share information with

Others I may share personal information with.  This is with your consent other than when there is a serious safeguarding concern.

  • Other health providers (eg GPs and consultants)
  • Charities and voluntary organisations
  • Care providers
  • Emergency services
  • Organisations we’re legally obliged to share personal information with
  • Other relevant third parties:
    • As required by the Association of Child Psychotherapists, I have two clinical trustees who hold a record of current clients.
    • As a member of the Association of Child Psychotherapists I am required to have regular supervision of my clinical work
    • The Association of Child Psychotherapists: in certain situations such as a complaint against me or where I require their advice / guidance

Duty of confidentiality

I am subject to a common law duty of confidentiality. However, there are circumstances where I will share relevant health and care information. These are where:

  • you’ve provided me with your consent (I have taken it as implied to provide you with care, or you have given it explicitly for other uses);
  • I have a legal requirement (including court orders) to collect, share or use the data;
  • on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
  • The requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied

How to complain

If you have any concerns about my use of your personal data, you can make a complaint to me using the contact details at the top of this privacy notice.

If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Your child’s right to confidentiality

Your child has a right to know that their sessions are confidential, with the exception of information that is shared with parents / guarding in order to keep the child safe, or information that they have agreed that I can share.  If a parent requests a child’s therapy notes I would need to speak with the child first to ascertain that they fully consent to this and that they understand what this means.  A summary report of the course of therapy can be a helpful compromise so that a child’s confidentiality is not unnecessarily breeched.   Where there is a dispute regarding a request by a parent / guardian and this cannot be resolved either by speaking with the child or by issuing a summary report of the therapy, then I would seek advice from the Association of Child Psychotherapists.

Information for children:

How I Use Your Information

Your child has a right to know how their data is used.  Here is a summary:

When you come for therapy, I need to collect some information about you. This includes your name, contact details, and things that help me understand how to support you, like your health needs or any special care you require. I also keep short notes about my sessions so I can provide you with the best care. Sometimes, I may need to get information from other people, like your doctor or school, but I will always ask for permission first.

I keep your information safe and only share it when absolutely necessary, like if I am worried about your safety or if the law requires me to. You have rights over your information—you can ask to see it, correct it, or even ask me to delete it in some cases. If you have any questions or worries about how I use your information, you can ask me, or you can talk to a group called the ICO, which helps keep personal information safe.