Privacy policy.
As required by law, Benjamin Dryer and Assisi Therapy (Accredited Hypnotherapy, Psychotherapy and Counselling) in Salisbury is registered as a data controller with the Information Commissioner’s Office.
The basis on which I keep client data is that of “Legitimate Interests”. This means that the data is necessary for me to fulfil the contract that we have together (ie to provide therapy) and that it is data that you would reasonably expect me to hold and use. It may also be used for scientific research purposes and statistical purposes.
For those who enquire about therapy, the data I hold includes any information you have given me by email/text/or by phone.
For those who book and attend at least one session, the data I hold includes:
· Basic information such as name, email address, phone number.
· Information that you give me as part of the work we do together.
· Written records of what interventions that I use (or potentially do not use) in our sessions.
· Emails, texts and/or messages that are sent between us.
· Information sent from any third party, eg GP, insurance company, EA Programme.
Some of the information that you give me may fall under the definition of special category of data as defined by the General Data Protection Regulation. Under GDPR (General Data Protection Regulation) you (the client) have rights as an individual which you can exercise in relation to the information Benjamin Dryer holds about you. For details of these rights please visit: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
Other than this, data is not shared with anyone, except possibly your GP, and for any reasons covered by the Requirements for Disclosure which are detailed, discussed and for which I will gather your signed consent when we first meet. For example, Personal data will not be shared with third parties unless absolutely necessary within the bounds of the law and the professional code of ethics of the UKCP (UK Council of Psychotherapy).
Details of where data is held, consideration is made of what is accurate, necessary and within the bounds of the law and regulatory requirements and professional standards and ethics.
· Any emails sent between us are held in a password protected account and deleted as soon as appropriate. Where information relating to therapy is included these emails are transferred to a secure cloud hosted data vault hosted by a third party and are treated as computer records.
· Any texts sent between us are held in a password protected account and deleted as soon as appropriate. Where information relating to therapy is included these texts are transferred to a secure cloud hosted data vault hosted by a third party.
· Your notes and paperwork are held in a secure cabinet.
Your data is kept for 7 years. The length of time is based on the requirements of my insurance company. After this time any paper records are shredded and computer records permanently deleted.
I take the security of data seriously and as such:
· Store all data relating to your sessions with me in a two level encrypted cloud vault hosted by a third party.
If there is any breach of data security, I will give full details to the Information Commissioners Office and any person affected within 72 hours of the breach and do all possible to minimise any potential impact.
You have rights with regards to the data held:
· The right of access. I will provide you with all data I hold on you as soon as I can following a request (and definitely within 30 days, unless this is impossible due to holidays or illness).
· The right to rectification. If any data I hold is incorrect, just let me know and I will correct it as soon as I can following a request (and definitely within 30 days, unless this is impossible due to holidays or illness).
· The right to erasure. If you wish me to erase your data just let me know and I will delete any computer records and shred any paper records as soon as I can following a request (and definitely within 30 days, unless this is impossible due to holidays or illness). NB: data may be retained for scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing but this would never include case notes or data such as address/email/phone
· The right to restrict processing. This would usually be a stop-gap measure before correction of any errors or before erasure
· The right to data portability. This might apply if you want your notes sent to another therapist for example, but it is likely that the easiest solution would come under the right to access, ie I would send the data to you.
· The right to object to:
o processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling).
o direct marketing conducted by me in the future relating to my services as a Hypno-Psychotherapist.
o processing for purposes of scientific/historical research and statistics. For this, you must provide grounds for your objection.
o automated decision making and profiling. I do not engage in automated decision making or profiling.
This policy was adapted by Benjamin Dryer on the 20th of June 2021.