Privacy Policy

Who I am

Dr Diane Dansey runs a clinical psychology practice under the trading name of Goals and Wishes. I work in accordance with professional guidelines from the British Psychological Society and The Health and Care Professionals Council. I abide by the laws of The Data Protection Acts 1998 and 2003 and the General Data Protection Regulations (GDPR) 2018 and am committed to protecting the privacy of information provided by clients.

The lawful basis for processing and storing personal data

As it is both a necessity for service delivery and of benefit to yourself or your child, I have a legitimate interest to process and store personal data. Data relating to an individual’s health is classified as ‘Special Category Data’. Section 9 of the GDPR outlines the lawful basis for which personal information may be processed. Clinical Psychologists are legally bound to keep client information confidential and it is under this condition that we collect, process and store personal information.

The Information Commissioner’s Office (ICO) is the body responsible for overseeing data protection law and gives individuals certain rights in relation to personal data held about them by others. Dr Dansey is registered with the Information Commissioner’s Office (ICO) as a Data Controller. Dr Dansey’s registration number is ZA032464. You can view the ICO registration by visiting: https://ico.org.uk/ESDWebPages/Entry/ZA032464.

Meeting professional obligations

It is a legal requirement for all Clinical Psychologists to be registered with the Health and Care Professions Council (HCPC). The HCPC has clear standards of conduct, performance and ethics that all registrants must adhere to.

These standards affect the way in which we process and share information. Specifically:

• Standard 2: Communicate appropriately and effectively “You must share relevant information, where appropriate, with colleagues involved in the care, treatment or other services provided to a service user.”
• Standard 10: Keep records of your work.
• “You must keep full, clear, and accurate records for everyone you care for, treat, or provide other services to. You must complete all records promptly and as soon as possible after providing care, treatment or other services. You must keep records secure by protecting them from loss, damage or inappropriate access.”

Collection of personal information

Information will be collected from yourself and your child/family (as applicable) as part of any assessment and intervention. With your consent (for yourself, or as a parent) information may also be collected from other professionals (e.g. teachers, NHS or private professionals who may also be working with you).

Following an enquiry, if this does not result in your child being seen then any email or written communication in relation to this will be deleted within one year, to enable follow up discussion if wanted. You may request for this to be deleted sooner. If your child is subsequently seen then these initial details will be added to their personal record. A personal record includes the registration forms, initial enquiry form and information shared during the assessment and intervention sessions. It will also include notes in relation to the therapy plan and content of sessions and observations.

Confidentiality

Confidentiality is maintained at all times, in accordance with the information that you have consented to be shared. This is upheld unless there are concerns about the safety of your child or another person and where there are deemed to be risks involved. In such circumstances concerns will be discussed with you where possible and information provided about whom information has or will be shared with. This may include your GP, Social Care or the police. They may be contacted and provided with the information deemed necessary in relation to any concerns, without your consent. This is in line with the professional duty of care and priority of child safeguarding.

Use of personal information

Personal information is used only for the purpose of delivering a Clinical Psychology service to yourself and/or your child and family. Unless required to do so by law, no personal information will be disclosed to any person other than as set out below. We do not employ agents to process personal data or send out general mailing communication. No client details are ever given to or sold to any third parties.

With your consent, information about your own or your child’s emotional/mental health needs may be shared with other professionals involved in your own or your child’s care, when it is in your child’s best interests and with prior discussion in advance about what will be shared and how. A record of your consent is kept within your own or your child’s case notes. Minimal information may also need to be shared with health insurance companies or case managers as necessary, when these parties are involved and the level of information shared will be discussed with you.

In email correspondence with yourself (and other professionals as necessary), a minimum of personal information will be shared within any emails, including only using an initial for your child’s name. Confidential information, including reports will be sent as password protected attachments, with the password being provided separately. Letters sent to professionals such as GP’s and teachers, by post, will be clearly marked ‘Private and Confidential’.

Videos may be taken of clients with your consent for yourself or for your child as their parent. This is for the purposes of scoring assessments or for supervision with a similarly qualified colleague, with whom work is discussed. These are temporarily stored with encryption and password protection and are deleted within 30 days. They can also be shared with you upon request.

Storage and retention of personal information

On any occasion that any confidential information needs to be taken out of the Clinical Psychology office base, e.g. for discussion in supervision or participation in a school meeting or home visit, the information carried will be minimal and will be kept either with Dr Dansey at all times or in the locked boot of the car.

All information held within paper personal records is stored securely within a locked filing cabinet. Data in relation to payment records and appointments is kept in a non-identifiable form using a code for each client. Financial records are kept and processed in accordance with HMRC guidelines. All electronic documents containing confidential information are password protected, as are the electronic devices (i.e. laptop and phone) upon which these are stored and accessed and these are also treated securely.

Where there is no identifiable mental health concern (e.g. the provision only of parenting advice) the records made will be kept for two years before being securely destroyed.

Mental health records are subject to special legislation e.g. children’s records need to be kept until the child reaches age 26 and adult records kept for 8 years after the last contact with the service Www.gov.uk/government/publications/records-management-code-of-practice-for-health-and-social-care. The records will be destroyed securely at that time.

Some records may be held indefinitely if there were any issues of concern that could lead to police investigation in the future.

My responsibilities

I am committed to maintaining the security and confidentiality of the personal records of all clients. I constantly work to ensure compliance with current data protection regulation and security measures are actively implemented to ensure that information is safe. These processes are audited regularly.

Personal details will never be shared with any third party without your prior consent, unless this is allowed for or required by law.

Your rights

Data protection legislation gives you various rights to your own information or that held about your child as their parent. The most important of these are as follows:

• You have the right to request a copy of the information held about yourself or your child.
• You have the right to ask for the record to be amended if you believe that it is inaccurate.
• You have the right to retract your consent for the record to be held. This would terminate intervention with immediate effect, as I am unable to practice without this in place.
• Should you wish to move to another practitioner and you wish for your notes to be transferred then this can be discussed and facilitated with your consent.
• If you would like your own or your child’s personal record to be erased then the advice of the governing body would need to be sought, due to the rules in relation to data retention (see ‘data storage’ above). They may or may not provide permission for this, dependent upon the circumstances.

How to access your own or your child’s records

You can access this information by requesting this in person or in writing. This can be shared with you in person or copied and sent to you, for which there may be an admin charge. Access to the information will be given within 30 days of your request.

Alternative arrangements if needed 

In the event of death or incapacity of the Clinical Psychologist, arrangements have been made for records to be held by a named professional colleague who will then have access to stored records and continue with the above obligations.

Further information

If you have any further questions about how your information is used, please contact DrDansey@goalsandwishes.co.uk

Further information about data protection legislation and your rights is available from the Information Commissioner’s Office or by calling 0303 123 1113, 9am to 5pm, Monday to Friday or visiting www.ico.gov.org