Privacy and Retention Policy
Data protection law states that individuals have the right to be informed as to how their personal data is held and used. This privacy notice explains how data will be collected and used.
As a private practitioner I act as both:
Data Controller (which means that I plan procedures regarding how data is held according to the new GDPR regulations) and
Data Processor (which means that I collect and store data required within my art therapy practice).
I process data slightly differently when working with children or adults. Please see below privacy policies for both areas of work.
|
When working with Children Personal information collected could include:
I could hold information received from the local authority, the child’s school or G.P. Why this information is collected Client information is collected for the following purposes:
Legal basis for using this data Information is collected and shared only when it is lawful to do so. Most commonly that would be when
Less commonly, the client information may be processed when
When permission has been given to use client’s personal data, consent can be withdrawn at any time and this will be made clear to the client. How client information is collected Client information will be collected through hand written completion of an assessment form. Some of this information is requested on a voluntary basis and in order to comply with the data protection legislation, we will inform you whether you are required to provide certain information or if you have a choice. Information is routinely collected from the child, parent/carers. Other agencies involved with the child such as schools, social services or medical professionals may offer additional information. How data is stored Client data is stored in a locked file for the duration of the therapeutic intervention. Additionally, in accordance with the British Association of Art Therapists guidelines, data will be stored securely for six years after the completion of the therapy or six years after the child's eighteenth birthday. Any email correspondence will be sent from a pass word protected email address. With whom might the information be shared? Information regarding clients is not routinely shared without consent to do so. Under certain circumstances the law may require such sharing; an example would be when there are safeguarding concerns) https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/592101/Working_Together_to_Safeguard_Children_20170213.pdf. In such a situations personal information may be shared with:
Requesting access to your personal data Under data protection legislation, individuals have the right to request access to personal information being held in their regard. Parents/Carers can make a request regarding their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent. To make a request for your personal information, contact [email protected] If you make a subject access request, and if I do hold information about your or your child, I will
You have the right to:
If you have a concern or complaint about the way I am collecting or using your personal data, you should raise your concern in the first instance by contacting [email protected] or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/ Contact If you would like to discuss anything in this privacy notice, please contact [email protected] This policy has been adapted from the Department for Education’s model privacy notice https://www.gov.uk/government/publications/data-protection-and-privacy-privacy-notices |
|
When working with Adults Personal information collected could include:
Why this information is collected Client information is collected for the following purposes:
Information is collected and shared only when it is lawful to do so. Most commonly that would be when:
More commonly, the client information may be processed if and when
When permission has been given to use client’s personal data, consent can be withdrawn at any time and this will be made clear to the client. How client information is collected Client information will be collected the through hand written completion of an assessment form. Some of this information is requested on a voluntary basis, in order to comply with the data protection legislation, we will inform you whether you are required to provide certain information or if you have a choice in this. Information is routinely collected from the client. How data is stored Client data is held securely for the duration of the therapeutic intervention. Additionally, in accordance with the British Association of Art Therapists guidelines, data will be stored securely for six years after the completion of the therapy. Documentation will be stored securely in a locked file. Any email correspondence will be sent from a pass word protected email address. With whom might client information be shared? Information regarding clients is not routinely shared without consent to do so. Under certain circumstances the law may require such sharing; an example would be when there are safeguarding concerns) In such situations personal information may be shared with:
Requesting access to your personal data Under data protection legislation, individuals have the right to request access to personal information being held in their regard. To make a request for your personal information, contact [email protected] If you make a subject access request, and if I do hold information about you, I will
Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances. You have the right to:
If you have a concern or complaint about the way I am collecting or using your personal data, you should raise your concern in the first instance by contacting [email protected] or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/ Contact If you would like to discuss anything in this privacy notice, please contact: [email protected]. This policy has been adapted from the Department for Education’s model privacy notice https://www.gov.uk/government/publications/data-protection-and-privacy-privacy-notices |
