West Town Counselling Services Privacy Policy

West Town Counselling Services
21 West Town Lane
Bristol
BS4 5DA
Phone: 07746 162 739
Website: www.westtowncounselling.co.uk

Information Commissioner's Office (ICO) Registration No.: ZB287623
Policy Established: 13th January 2021
Policy Last Amended: 17th June 2023

I reserve the right to amend this policy without notice.

Definitions

"Business Day" is any working day, Monday to Friday, which does not include public holidays.

"Client", "You", "Your" or "Yourself" refers to the individual seeking therapy.

"Counsellor", "I", "Me", "Myself" or "Therapist" refers to West Town Counselling
Services.

"Data Controller" is the term used to describe the individual or organisation responsible for collecting and storing information, and bears responsibility for the data. For the avoidance of doubt, in this policy, the Data Controller is Andrew Hughes of West Town Counselling Services.

"Third party" or "Third parties" refers to any individual or organisation that is not "You" or "I".

§1 - Introduction
Your privacy is important to me and I will make every effort to ensure that your personal information is recorded and stored safely and securely, in accordance with the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

This policy is written to inform you of how I will collect and store information about you from initial contact, during therapy, and after therapy ends, including:

• Why I collect this information and the purposes I store it for • How long I store personal information
• Details of any third party recipients
• Your data protection rights

Any information collected about you will only be used for the purposes for which it was given to me. This will not be passed on to any third parties without your express permission, such as when making referrals to other services or your GP. Limitations and exemptions to this policy can be found in §6 - 'Sharing of information, and limitations to this policy/confidentiality' further on in this document.

In the event of a data breach, I will attempt to contact you within 72 hours to inform you of the nature of the breach and what data may have been accessed.

If you have any questions regarding this policy, please do not hesitate to contact me.

§2 - The information I collect and how this is collected
The information I collect and process about you, and how this information is collected differs depending on the nature of our contact. These differences are detailed as follows:

§2.1 Contact via website
When contact is made via my website (www.westtowncounselling.co.uk) the following information is collected:

- Your name (mandatory)
- Your email address (mandatory)
- Your phone number (optional)
- Information detailing whether or not I may leave a voicemail message when contacting you
- Any other additional information that you chose to share via the 'message' box (mandatory*)

*Please note that, while this field may not be left blank, the information you choose to share is at your own discretion. The reason I request this field not be left blank is so that I can determine whether or not the form has been sent in error.

If we are unable to work together, this information is typically destroyed within 48 hours.

§2.2 Contact via phone or voicemail
If contact is made via voicemail then I request the following information:

- Your name
- Your contact telephone number
- Information detailing whether or not I may leave a voicemail message when contacting you
- A suitable time to contact you to discuss the reason you are seeking therapy

If we are unable to work together, this information is typically destroyed within 49 hours.

§2.3 Information collected during assessments
If after our initial contact we agree to have an initial session, the following additional information will be collected:

- Your name
- Your contact details (address, email, telephone)
- Your date of birth
- Details of an emergency contact (such as next-of-kin)
- Your GP details
- Details of any medical conditions for which you take medication and details of any medication you take which may help inform my practice or which might be useful for the emergency services should there ever be a situation that necessitates contact between myself and these services
- Details of why you are seeking therapy

In addition to the above I may also retain information obtained from the use of assessment tools (GAD7 or PHQ9). These tools are sometimes helpful in determining an individual's state-of-mind, but are not used as a matter of course in each assessment.

Even if we do not go on to work together, we will have had a contracted session at this point and so brief notes about the session will be recorded, as will the details mentioned above, in a secure, encrypted, web-based healthcare system known as Therapy Lock. As this system is a healthcare system (similar to the way in which data is processed and retained by the NHS), it is exempt from GDPR regulations regarding data retention, and these details will be stored indefinitely. However, nobody else will be able to gain access to your information except for myself. The only exemption to this would be in the event a Clinical Will (also known as a Therapeutic Will) is enacted [See §4], in which case a trusted individual will be able to temporarily access limited contact information for my clients (Name, email, phone number) in order that they may enact the terms of the will.

§2.4 Note taking and creative work
After each session, brief, factual notes will be recorded in a secure, encrypted, web-based healthcare system known as Therapy Lock. As this system is a healthcare system (similar to the way in which data is processed and retained by the NHS), it is exempt from GDPR regulations regarding data retention, and these details will be stored indefinitely. However, nobody else will be able to gain access to your information except for myself. The only exemption to this would be in the event a Clinical Will (also known as a Therapeutic Will) is enacted [See §4] is enacted, in which case a trusted individual will be able to temporarily access limited contact information for my clients (Name, email, phone number) in order that they may enact the terms of the will.

There are certain instances in which notes may be requested by third parties, please see §6.4 - 'Third party release of notes' for details.

§2.5 Contact by phone or email
I use both a mobile phone and email account to communicate with clients from time to time. My company phone is password protected and, generally, remains in my therapy room which remains locked unless it is in use. My company email account is also synced to this phone. I do not save clients' numbers in this phone, and I delete communications promptly (usually within 24 hours) once they have been responded to and the same is true with emails.

There may be exceptions to this when I am taking annual leave and will not have access to this phone and these accounts. In the event the mobile phone is lost or stolen, I have the ability to regain access to the email accounts via my personal computer or personal mobile phone should this be necessary. My personal computer and my phone are also password protected and only accessible by myself. Contact details and emails are not synced to a cloud system.

§2.6 Cookies
I use Google Analytics to monitor the number of visitors to this site. Google use cookies in order to track visitors to this site. They anonymise this data before it is made available and I do not have access to any personal information. To see the full cookies policy, click here.

§3 - Why this information is collected, how it is used, and length of storage
Information gathered in accordance with §2.1 and §2.2 of this policy is collected so that I may make initial contact with you in order to discuss your reasons for seeking therapy and to determine whether or not we feel that we might be able to work together in a professional capacity. If it is decided that we are not the right match for each other, I will ask if you would like me to retain the information in order that I might offer signposting to another agency or counsellor. This information is retained until:

1. We agree that we cannot work together and no additional signposting/referrals are requested. In this instance, the information is destroyed promptly, typically within 48 hours, and is not recoverable by myself or any third party/parties;

2. We agree that we cannot work together and additional signposting or a referral is requested. In this instance, the information is retained for the duration of the time needed in order to provide signposting or to make a referral. This will typically be done within 5 business days. Your personal information will not be passed on to any third party or parties without your express permission. Once this process has been completed, your personal information is destroyed promptly, typically within 48 hours, and is not recoverable by myself. Any personal information passed on to a third party or parties becomes the responsibility of yourself and the party/parties concerned. I no longer bear responsibility for this information, or how it is collected, used, stored, or destroyed;

3. We agree that we can work together. In this instance, the information already gathered will be retained until such time we organise an initial session, and this information will be added to any additional information gathered in accordance with section §2.3 of this policy;

4. In accordance with section §2.4 of this policy, notes are taken after each session.

These notes are used in order to help the therapist remember a client's story or individual circumstances and for the purposes of reviewing progress.

§4 - Clinical Will and third party disposal of records

In the event the therapist becomes permanently incapacitated or passes away unexpectedly, a clinical will has been put in place. This document sets forth instructions for a trusted third party to enact this will. In this instance, the trusted party will temporarily have access to data for all clients for whom I currently have records (assessments, questionnaires, notes etc.), which may include clients who are not currently in therapy but for whom I continue to store data in accordance with my insurer and to comply with UK laws.

In this instance, attempts will be made to contact all relevant parties to inform them of the situation, and to establish what each party would like doing with their data. Generally speaking, you will be offered the option of having your data sent to you securely.

§5 - How information is stored
Information that I gather about clients is generally stored electronically in a web-based, encrypted healthcare system known as Therasee, as are the notes taken after each session.

Sometimes when we do creative work together, I will offer to store copies of artworks or pieces of creative writing or similar, so that we can continue to work on these periodically across multiple sessions. These are stored in a locked cabinet in a separate room. The key for this cabinet is stored in a coded lockbox separately to the cabinet itself and is, in turn, locked away for safekeeping.

When therapy comes to an end, I will ask individuals if they would like to take these physical pieces of work with them or if they would like them destroyed. If you would like these destroyed, this will be done promptly after our final session.

In the event that the therapist is permanently incapacitated or deceased, then a trusted third party will instigate the instructions found in a Clinical Will and will temporarily gain access to limited amounts of data to enact the will. See §4 - 'Clinical will and third party disposal of records' for more information.

§6 - Sharing of information, and limitations to this policy/confidentiality
The information I collect and store about you is, generally, only accessible by myself or yourself by written request. I will not share any information collected about you with any third party or parties unless compelled to do so in accordance with the law.

Additional limitations to client-counsellor confidentiality are detailed as follows:

§6.1 Supervision and training
As part of our ongoing professional development as therapists, we are required to undergo supervision and training in accordance with the policies of our membership bodies. During supervision we may disclose our client's name and talk briefly about the material that they bring to therapy; however, the focus is on me and how I work, rather than on the client themselves. This is to ensure that I am working safely, ethically, and within my competency. Supervisors are also bound by confidentiality. Similarly, during training sessions, we may offer brief examples of our client work, but this is typically anonymised with no reference made to any specific client.

§6.2 Emergency medical situations
If an emergency medical situation arises during therapy, obtaining a client's permission to contact emergency services will likely not be possible. In this instance, I reserve the right to contact the emergency services on your behalf and provide them with any appropriate information they may require, such as your name, date of birth, address and any medical information that may be pertinent to the situation, such as providing the names of any known medications.

§6.3 Safeguarding clients and others
Although client-counsellor confidentiality is paramount to the work that we do together, I have a duty of care to both my client and the general public. In certain instances I am required, by law, to break confidentiality and notify the authorities of what has been disclosed and by whom. The instances in which I am required, by law, to breach confidentiality are when disclosures are made of involvement in/knowledge of:

i) acts of terrorism;
ii) money laundering;
iii) drug trafficking.

There are other instances whereby I am not required by law to break confidentiality but may choose to do so if I believe my client or another member of the public is at risk, such as if I believe a client is at risk of suicide or harming a vulnerable person, or it is disclosed to me that a child is being physically or sexually abused. I may also choose to break confidentiality if I become aware that serious crimes, other than those stated above, are being committed.

In these instances I may be asked to disclose pertinent personal information such as name(s), date of birth, physical description, contact details, address(es) and so on.

§6.4 Third party release of notes
As a general rule, only a client may request a copy of their notes; however, notes may also be requested for release by a coroner or a judge. In exceptional circumstances, a judge can issue a court order which compels me, legally, to turn over my notes to the authorities.

§7 - Lawful basis
Under General Data Protection Regulations (GDPR), the lawful bases under which I retain information for processing are:

I have a legitimate interest in retaining this information in order to guide the work we do together, for safeguarding purposes, for insurance and legal purposes, and in the event that they are requested by a court or coroner.

§8 - Your rights
Under data protection law, you have the following rights:

a. Right of Access
You have the right to access any personal information that I retain about you. If you would like to see a copy of your notes, then I request that you do so either during our sessions, by email, or in writing if our sessions have finished. These will be processed within 7 days, unless I am unavailable due to annual leave. Once this data has been handed over to you, you become the responsible person for this data and I no longer assume responsibility.

b. Right to Rectification
If you feel any personal information that I retain about you is incorrect, you have the right to ask me to change this on your behalf. You also have the right to ask me to complete and update any information you think may be incomplete.

c. Right to Erasure
In certain circumstances, you will have the right to ask me to destroy data that I retain about you. If you would like me to destroy data I hold about you, then I request that you make a request in writing. Provided there is no legal obligation for me to retain the data, I will do so promptly upon receipt of this request. Please note that the data storage system I use to retain contact details and notes is exempt from this regulation.

d. Right to Restriction
You have the right to ask me to restrict the processing of your personal information in certain circumstances.

e. Right to Object
You have the right to object to the processing of your personal information in certain circumstances.
Right to Data Portability

You have the right to ask that I transfer any information that I hold about you to either yourself or another organisation in certain instances. You do not have to pay for this service, but I ask for confirmation of this in writing. I aim to do this within 30 days of this request. Once the data is with yourself or the third party, it is no longer my responsibility. This information can be sent electronically or in hardcopy by tracked and signed post.

§9 - Complaints
If you have any concerns regarding my use of your data and you wish to make a complaint, please do so in writing, explaining the concerns that you have. You can address this letter to:

West Town Counselling Services
21 West Town Lane
Bristol
BS4 5DA

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy. Their address is:

Information Commissioner's Office Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Phone: 0303 123 1113
Website: ww.ico.org.uk