May 2022
I am the Data Controller for purposes of the Data Protection Act 2018 (“the Act”) and registered with the Information Commissioners Office (number Z1634614). This policy outlines the data held by me on you. Such data is collected from you voluntarily and retained for the purposes of our supervision or counselling arrangement. I endeavour to hold and process data in accordance with the provisions of and principles set out in the Act and the General Data Protection Regulation 2018 (“GDPR”).
I keep:
Handwritten records of your details on a sheet to be completed at the start of our work together.
Background notes of our sessions and content, copies of emails or text exchanges, including preliminary contact inquiring about the possibility of counselling or supervision with me, copies of any questionnaires completed by you, and a note of the content of telephone conversations.
A note of attendance at appointments and payment for these
These data records are subject to the provisions of the Act and the principles of GDPR. They are kept secure, private and confidential, except as indicated in paragraph 3 of our agreement made when counselling or supervision begins.
Any electronic records that are kept on a portable device (including my mobile telephone) are password protected and encrypted. I request that you only use electronic communication such as email or text messaging for short messages asking me to contact you or alter an appointment. If longer communication emails or texts should be required from or by you, please use encryption to preserve confidentiality and ensure that the encryption code and the communication to which it refers are sent to separate devices. As my telephone connects to my email, please do not send the encryption code to my telephone as it will connect with my email address leading to both being on the same device. Please telephone and give me the code or give it to me in person.
In order to work effectively and safely, neither you nor I will attempt to record a session or part of a session without prior agreement.
The records are kept as long as is reasonable for the purpose for which they were prepared, in most case for six years, and then securely destroyed. If contact is made which does not lead to a client or supervision agreement, any record of such contact prepared by me is usually securely destroyed after the lapse of one month from such contact.
Rarely, supervisees, clients, their solicitors, the police and the courts ask permission to access counselling or supervision records. I will require specific written consent from you. As these records are not suitable for use in legal proceedings, I reserve the right to resist legal requests to produce these in court. Any request to provide a written report made by the aforementioned will be considered on a case by case basis on receipt of written consent by you. Any report so provided will not refer to specialist diagnosis or other matters outside my training and will be restricted to brief details of attendance dates and numbers of sessions attended.
On rare occasions, you may wish to exercise your rights under the Act and make a subject access request in respect of your personal information held by me. To exercise such a request, it should be put in writing to me, and provide evidence of your identity and proof that your address is the address to which the information is requested to be sent. Within one calendar month of receipt by me of the request, and other required proofs, I will respond, usually in the form of a schedule listing and describing the personal data held by me on you. By signing our agreement, you acknowledge that you understand and agree to this subject access policy for counselling or supervision notes and to the other parts of this policy.
Under the Act, you have the right to access a copy of your personal data held by me, to request correction or erasure in certain circumstances, and to request the limiting or ceasing of data processing, where applicable (although this may mean that our work together may have to cease). You also have a right to compensation in the event of substantial damage or distress caused by data processing outside the terms of our agreement.