Privacy Statement

 

The GDPR asks for specific consent to be given for data to be processed, and so I am asking you to read the following carefully to understand how I will treat and regard your personal data and sign to confirm your consent.

As Andrea Lucas I am committed to maintaining the trust and confidence of my clients and visitors to my website.

It is important that I adhere to the principles of the General Data Protection Regulations and understand best practice for managing information. To help ensure I am complying with the GDPR to protect your privacy and any sensitive data held on you.

I have thought carefully about your privacy, and designed systems which seek to support that ethos, and because I keep some personal data, I am registered with the Information Commissioners Office (ICO) (registration number CSN9903501).  For the General Data Protection Regulation (GDPR) the data controller is Andrea Lucas.

This notice outlines what information I keep, why I keep it and what I will do with it.

What information I keep

The contact records – I have the records of your name and contact details, and the other information which you gave at our initial contracting stage. These are kept in a locked drawer at my home office.

Why do I keep it?

Your full name and date of birth – These are used as an identifier if I need to speak to your GP or if you request a letter or report.

Address, email address and phone number(s) – These are kept so that I can contact you and again may be used as identifiers if I need to speak to your GP or if you request a letter or report.

GP details – These are kept for the unlikely event you had a medical emergency while attending therapy.  In the case of a psychological or emotional emergency, I would seek, wherever possible, your permission to contact your GP in the interests of your safety and/or wellbeing.

Emergency contact details – This is kept in the case of a medical emergency while you are attending therapy.  In the first instance, however, emergency services will be contacted.

When may your data be shared?

There are occasions when I may share your information with other professionals. These are:

  • If I receive a subpoena from a court of law.
  • If you disclose information that raises safeguarding concerns including serious risk of harm to yourself or others; or abuse or neglect of a child or vulnerable adult, I have a duty of care to disclose that information to the appropriate authorities.
  • If you disclose information that indicates that you are at substantial risk of suicide, I will release that information to your GP.  If there is an immediate risk I will contact the emergency services.
  • If you disclose anything to do with terrorism, drug trafficking or money laundering I am legally required to inform the police and it is a criminal offence for me to inform you that I have done so.
  • If you are claiming sessions through an Insurance company, your name, address, date of birth and insurance policy number will appear on any invoicing or reports required.
  • In the event of my death or incapacitation, there is a Plan B for all clients to be contacted. If Plan B needs to be used, your records will be released to one of my colleagues who will then contact you.
  • Regarding my professional supervision, my Supervisor is held by the same privacy, data protection and confidentiality clauses as described here and in my contract.  If discussing themes in your case and our work together with my Supervisor I will not disclose your name or anything else that would enable you to be identified.

If I do need to share information about you, I will always aim to discuss it with you first unless the situation requires an immediate response.  If I am required to release information before discussing it with you, I will inform you at the earliest opportunity except in the case of information relating to terrorism, drug trafficking or money laundering or any criminal offence.

How long will I store your data for and how will I dispose of it?

Contact details – are kept on my phone and on my computer which are both password protected and only accessed by me, and your details are stored with a unique client ID.

These contact details are shared between my apple devices using I-Cloud for which I maintain a secure password. I use this information only to contact you, and I will not pass this information on to anyone else. I do not use your contact details for general marketing purposes.

Brief notes – act as an aide memoire as our work together progresses. All handwritten notes are non-identifiable. These notes are kept separately from the contact sheet records and are identified only with your first name or initial.

Past notes – are kept in a locked drawer at my home office for 7 years from the date of our last session. This is the timeframe requested by my insurance company.  After this I will securely and confidentially dispose of all data.

Under the General Data Protection Regulation, you have the right to say what happens to the data that I keep.

You have:

  • The right to be informed – what is the purpose of this privacy information notice.
  • The right of access – you have the right to access your data.
  • The right to rectification – you have the right to request that I amend any personal data which is factually incorrect, misleading or incomplete.
  • The right of erasure – under certain circumstances, you have the right to request that I erase the data that I keep (also known as the right to be forgotten).
  • The right to restrict processing – under certain circumstances, you have the right to the restriction or suppression your personal data.
  • The right to data portability – this allows you to obtain and reuse your personal data for your own purposes across different services.
  • The right to object – you have the right to object to the processing of your personal data in certain circumstances.

If you would like to exercise any of your rights at any time, you can request it verbally or in writing.  I will respond to your request within 30 days.  If you are still not happy with the way I use your data, you can complain to ICO at www.ico.org.uk or phone them on 0303 123 1113.

I am registered with the Information Commissioner’s Office (ico.gov.uk) ref: ZB280514

 

If you wish to withdraw your consent to me using your data at any point please let me know by email to andrea.lucas1@btinternet.com or phone to 07919 155982.