North Cardiff
Therapy
I know this is very wordy, so please do feel free to ask me anything about this privacy policy. You always have the right to read the brief notes I make in our sessions. I will always do my very best to protect your privacy and I do not share your details with anyone else without your written consent, unless it's an emergency (please ask me for further details).
Introduction 2
Aim and Purpose 2
Information Governance Framework Principles for North Cardiff Hypnotherapy 3
Section B 5
Privacy Notice: Use of information 5
Retention Schedule 6
Data Processing 10
Section C 13
Data Breach 13
Subject Access Request 14
Right to Erasure 14
Complaints 14
Safeguarding your privacy 15
Introduction
My name is Dorothea Read, I am a Clinical Hypnotherapist and Solution Focused Brief Therapist at North Cardiff Hypnotherapy. I am the named data controller and I am registered on the ICO website in accordance with the rules of the General Date Protection Act May 2018. https://ico.org.uk and in accordance with the Code of Conduct and Ethics of The CNHC, my professional association https://www.cnhc.org.uk/sites/default/files/Downloads/CodeofConductEthicsandPerformance.pdf
Data held by North Cardiff Hypnotherapy will be held lawfully and for the retention periods set out in section B of this policy document.
This document refers to:
Written Documents - I keep brief notes of our sessions together. I am the only person who has access to them.
Spreadsheets - I keep my accounts on spreadsheets, your initials are used but not your full name.
Hardcopy case notes and files -My session notes are all hard copies, hand written, and are stored in a locked filing cabinet in a locked building.
Emails - I delete emails from clients every three months.
Text messages - I do not store your number with a name attached on my phone. If you message me, the first line of the message does not appear on my locked screen.
Supervision notes - In accordance with my professional association’s code of conduct I have regular supervision sessions, these are for my professional development and I do not identify my clients.
Visits to the organisations website - my website www.hypnotherapy-wales.com also has a privacy policy.
Social media communication - I occasionally use twitter but never talk about clients. The posts are about hypnotherapy or SFBT in general.
Aim and Purpose
The purpose of this document is to ensure that North Cardiff Hypnotherapy has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.
Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
is the right information - you have the right to see any information I have on you, and the right to make any corrections.
is in the right place - I make sure your data is secure.
at the right time - I will keep your data in accordance with the CNHC code of conduct
with the right people - My therapy room is in CCR and the reception team will ask for details such as your contact details, they also take payments for me. They do not have access you my therapy session notes.
for the right reasons - I will only ask you details that I think may be useful for our therapy sessions together.
This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. North Cardiff Hypnotherapy is fully committed to ensuring clients privacy and data protection rights.
For the purpose of this policy Dorothea Read is the named Data Protection Officer/Controller and Head of Organisation.
Information Governance Framework Principles for North Cardiff Hypnotherapy
I have undertaken training in GDPR regulations.
1. Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75 minute GDPR CPD Course provided by the Clinical Hypnotherapy School (www.clinicalhypnotherapyschool.com) completed. Refresher training is completed every two years.
2. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.
3. Any data collected is solely for the purpose of providing a person-centred service to an individual client.
4. The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. (https://www.igt.hscic.gov.uk/Caldicott2Principles.aspx)
5. All technology [Microsoft Office products including Outlook] used to store or facilitate information and communication is maintained according to the Data Retention Policy for North Cardiff Hypnotherapy.
6. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
7. It is the responsibility of the Data Controller (Dorothea Read ) to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
9. Any electronic devices where personal or sensitive, confidential information is held will be password protected. Individual documents stored electronically will also contain individual passwords.
10. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.
Section B
Privacy Notice: Use of information
In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisations website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
Any document containing personal data will state “Official-sensitive, private and confidential” clearly.
All emails will contain a privacy statement.
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
the right to be informed;
the right of access; - to see your data, this is called a “subject access request’ and there are more details about this below. Essentially it means you have the right to see information I may have about you.
the right to rectification; - to make corrections to your data if you need to.
the right to erasure; to be forgotten. Please make this request in writing to me, Dorothea Read CCR 277 Cyncoed Road, Cyncoed Cardiff CF23 6PA, or email me at northcardiffhypnotherapy.com. I may not be able to comply with your request, depending on the rules of my insurance company (Holistic Insurance http://www.holisticinsurance.co.uk) and CNHC regulations on client records, 8 years after final treatment session has ended. Child records should be held until after 25th birthday, or 26th birthday if aged 17 when treatment ends.
the right to restrict processing; There is a full description on this below, a very brief explanation is that I would need your explicit consent to email you for anything other than something directly related to our therapy sessions. For example I could email you about an appointment change but not about another service unless you had agreed to that first.
the right to data portability;
the right to object; and
the right not to be subject to automated decision-making including profiling.
Please note that North Cardiff Hypnotherapy does not use automated decision-making tools, including profiling.
Website visitors
When an individual visits www.hypnotherapy-wales.com I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. North Cardiff Hypnotherapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.
Wix
Wix is a third-party service that hosts North Cardiff Hypnotherapy’s website. Wix also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website. Wix privacy notice can be found here for further information: https://www.wix.com/about/privacy
Social Media
I occasionally use Twitter in connection with North Cardiff Hypnotherapy. Twitter’s privacy notice can be found here: https://twitter.com/en/privacy
Retention Schedule
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
Data Processing
What are the lawful basis for processing data at North Cardiff Hypnotherapy?
Consent in relation to communication: the individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
This means that North Cardiff Hypnotherapy does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
North Cardiff Hypnotherapy processes personal information to enable the provision of Psychotherapy, Solution Focused Brief Therapy and Hypnotherapy, to advertise services and to maintain accounts and records.
Type/classes of information processed
North Cardiff Hypnotherapy processes information relevant to the above reasons/purposes. This information may include:
personal details
family, lifestyle and social circumstances
goods and services
financial details
employment and education details
North Cardiff Hypnotherapy also processes sensitive classes of information that may include:
physical or mental health details
racial or ethnic origin
religious or other beliefs of a similar nature
offences and alleged offences
North Cardiff Hypnotherapy processes personal information about:
clients
suppliers
business contacts
professional advisers
supervisorsSection C
Data Breach
All personal and sensitive data held by North Cardiff Hypnotherapy is held securely. Electronic data stored on a computer is stored on a password protected computer on the local hard drive of the computer, which is itself encrypted. This supports the ability to retrieve data in the event of faults. Data is backed up to an encrypted external hard disk stored in a lockable box. Hardcopy data is held securely in a locked cabinet behind a locked door.
In the case of a data breach North Cardiff Hypnotherapy shall comply with the regulations set out under Article 33 of the GDPR;
1. In the case of a personal data breach, the data controller (Dorothea Read) shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
6. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
7. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.
Subject Access Request
A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, North Cardiff Hypnotherapy will:
• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.
SAR requests should be put in writing to North Cardiff Hypnotherapy. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. This should be made in writing to North Cardiff Hypnotherapy.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made.
Complaints
North Cardiff Hypnotherapy hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore North Cardiff Hypnotherapy would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact North Cardiff Hypnotherapy.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by North Cardiff Hypnotherapy you can contact North Cardiff Hypnotherapy directly. In the event that North Cardiff Hypnotherapy cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.
Safeguarding your privacy
In the event of my death or sudden illness, my supervisor or my receptionist at CCR will contact existing clients and archive any client files in accordance with General Data Protection Regulations.
Please do feel free to ask me any questions about this or any other aspect of your care.
Best wishes,
Dorothea Read Ba Hons DPH HPD Hypnotherapy Supervisor and Lecturer
Clinical Hypnotherapist and Solution Focused Brief Therapist
CCR at CMC
​