Client Privacy Policy

Section A

INTRODUCTION

New laws relating to General Data Protection Regulation (GDPR) came in to effect from 25 May 2018. The purpose of GDPR is to provide a set of standardised data protection laws across all EU member countries.

Data held by Dr Aradhana Perry will be held lawfully and for the retention periods set out in Section B of this policy document. 

This document refers to:

• Written Documents

• Spreadsheets

• Hardcopy case notes and files

• Database entries

• Images

• Recordings

• Emails

• Text messages

• Supervision notes

• Visits to the organisations website

• Social media communication

AIM AND PURPOSE

The purpose of this document is to ensure that Dr Aradhana Perry has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records. 

Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;

• is the right information

• is in the right place

• at the right time

• with the right people

• for the right reasons

This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates.

Information Governance Framework Principles for Aradhanaperry.com

1. Relevant websites and documents, guides and pro-formas have been examined by Dr Aradhana Perry and the rules and recommendations relevant to Aradhanaperry.com have been implemented in line with the legal requirements of GDPR. These will be reviewed every 2 years or as required with constant monitoring of communications from the Information Commissioners Office (ICO).

2. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.

3. Any data collected is solely for the purpose of providing a person-centred service to a User (client/s).

4. The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. https://www.igt.hscic.gov.uk/Caldicott2Principles.aspx

5. All technology used to store or facilitate information and communication is maintained according to the Data Retention Policy for Aradhanaperry.com.

6. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.

7. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.

8. Any electronic devices where personal or sensitive, confidential information is held will be password protected.

9. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.

Section B

Privacy Notice: Use of information

I understand that your privacy is important to you and that you care about how your personal data is used. I respect and value the privacy of all of my clients and am fully committed to ensuring clients privacy and data protection rights. I will only collect and use personal data in ways that are described here, and in a way that is consistent with my obligations and your rights under the law. In line with the professional code of conduct (HCPC), all psychologists are required to receive clinical supervision from a senior psychologist to ensure that they are practicing to the highest possible standard. In doing so, I will discuss aspects of your therapy with my clinical supervisor but you will not be identified by your full name and this again remains completely confidential.

All your details are stored and processed in accordance with the General Data Protection Regulation (GDPR). 

For more information on how I manage your data please scroll to the relevant sections below: 

1. INFORMATION ABOUT ME

For the purposes of the Data Protection Act, and the General Data Protection Regulation ((EU) 2016/679) and this policy, Dr Aradhana Perry is the named Data Protection Officer/Controller/Head of Organisation (aradhanaperry.com), whose registered address is: Women and Health, 4 Carol, Street, Camden, London, NW1 0HU, and whose main trading and postal address is Ffynnonofi, Pembrokeshire, Wales, SA42 0SD. Email: info@aradhanaperry.com and telephone number is: +44 (0) 7816832914

2. WHAT DOES THIS NOTICE COVER?

This Privacy Notice explains how Dr Aradhana Perry uses your personal data: how it is collected, how it is held and how it is processed. It also explains your rights under the law relating to your personal data.

3. WHAT IS PERSONAL DATA?

Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers. It does not include data where the identity has been removed (anonymous data).

The personal data that I use is set out below and in Section 7.

I may collect some or all of the following personal data (this may vary according to your relationship with me):

Identity Data includes first name, last name, username or similar identifier, marital status, title, occupation, date of birth and gender (or preferred identity, education).

Contact Data includes home address, email address and telephone numbers. GP Detail, Next of Kin or emergency contact person (if you chose to provide this)

Sensitive Data may include references to your physical and psychological health and wellbeing, family, lifestyle and social circumstances, racial or ethnic origin, religious or other beliefs of a similar nature, offences and alleged offences.

Financial Data includes bank account and payment card details.

Technical Data includes internet protocol (IP) address, operating system and platform and other technology on the devices you use to access this Site.

Marketing and Communications Data includes your preferences in receiving marketing from me and my third parties and your communication preferences.

4. HOW LONG AND WHERE DO YOU STORE OR TRANSFER MY PERSONAL DATA?

The Data is kept for the time necessary to provide the service requested by the User, or stated by the purposes outlined in this document, or in accordance with the guidelines the professional healthcare organisations that I adhere to. The User can always request that I review, suspend or remove the data.

I will only store or transfer your personal data in the UK. This means that it will be fully protected under the GDPR.

In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.

The security of your personal data is essential to me, and to protect your data, I take a number of important measures, including the following:

Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.

Any document containing personal data will state “Official-sensitive, private and confidential” clearly.

All emails will contain a privacy statement.

Hard copy data will be destroyed via a cross shredding machine owned by Dr Aradhana Perry, electronic data will be permanently deleted.

Basic contact information held on my mobile phone is deleted within three months of the end of therapy.

My standard practice will be to erase your data after 8 years after the end of your therapy, or for children, after 8 years after the client turns 18 years of age.

Retention Schedule

5. YOUR RIGHTS:

Under the General Data Protection and Retention (2018) legislation, as a data subject, you have the following rights which this Policy and my use of personal data have been designed to uphold:

You have the the right to be informed about my collection and use of personal data;

You have the right to request access to the personal data I hold about you (see Section C);

You have the right to rectification if any personal data held is noted to be incorrect, or to have any incomplete data completed. You can request a correction be made (please contact me using the details in Section B, Part 9).

You have the right to request the erasure of personal data; Please email info@aradhanaperry.com with your requests (see Section C).

You have the right to withdraw consent and restrict processing of your personal data;

You have the right to data portability (obtaining a copy of your personal data to re-use with another service or organisation). This means that, if you have provided personal data to me directly, I am using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask me for a copy of that personal data to re-use with another service or business in many cases. If you wish for your data to be provided to another service provider, you may request this in writing.

You have the right to object to me using your personal data for particular purposes; and

You have the right not to be subject to automated decision-making including profiling. Please note that Dr Aradhana Perry does not use automated decision-making tools, including profiling.

Please note that Dr Aradhana Perry may be obliged to refuse these requests in accordance with lawful requirements and the HCPC professional code of conduct: www.hcpc-uk.co.uk.

Website Visitors

When an individual visits aradhanaperry.com Dr Aradhana Perry will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.

Squarespace is a third-party service that hosts Aradhanaperry.com’s website. Squarespace also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website. SquareSpace privacy notice can be found here: https://www.squarespace.com/privacy

Social Media

Dr Aradhana Perry does not use social media. This policy will be updated in the event of that changing.

Data Processing

The lawful basis for processing data at aradhanaperry.com

6. HOW DO YOU USE MY PERSONAL DATA?

Under the GDPR, I must always have a lawful basis for using personal data. This may be because the data is necessary for my performance of a contract with you, because you have consented to my use of your personal data, or because it is in my legitimate business interests to use it.

6.1. Reasons/purposes for processing information

Your personal data may be used for one of the following purposes:

Supplying my services to you: Dr Aradhana Perry processes personal information to enable the provision of therapeutic services and to maintain accounts and records. Your personal details are required in order for me to enter into a contract with you.

In relation to communicating with you: The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file. This may include responding to emails or calls from you.

Processing is necessary in order to protect the vital interests of the data subject or of another natural person.

Processing is necessary for your legitimate interests as specified in Article 9 of the GDPR;

6.2. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

6.3. Paragraph 6.2 shall not apply if one of the following applies:

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 6.4;

6.4 Personal data referred to in paragraph 6.2 may be processed for the purposes referred to in point (h) of paragraph 6.3 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

This means that Dr Aradhana Perry does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.

7. DESCRIPTION OF PROCESSING

The following is a broad description of the way Dr Aradhana Perry processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the Frequently Asked Questions document provided, which compliments the policies detailed here.

Type/classes of information processed

Dr Aradhana Perry processes information relevant to the above reasons/purposes. This information may include:

• personal details

• family, lifestyle and social circumstances

• goods and services

• financial details

• employment and education details

Dr Aradhana Perry also processes sensitive classes of information that may include:

• physical or mental health details

• racial or ethnic origin

• religious or other beliefs of a similar nature

• offences and alleged offences

Dr Aradhana Perry processes personal information about:

• clients (goods and services)

• suppliers

• business contacts

• professional advisers

• supervisors

8. DO YOU SHARE MY PERSONAL DATA?

I will not share any of your personal data with any other third parties for any purposes, subject to one important exception.

In some limited circumstances, I may be legally required to share certain personal data, which might include yours, if I am involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

With your permission and/or where permitted by law, Dr Aradhana Perry may also use your personal data for marketing purposes, which may include contacting you by email AND/OR telephone AND/OR text message AND/OR post with information, news, and offers on my services. You will not be sent any unlawful marketing or spam. I will always work to fully protect your rights and comply with my obligations under the GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and you will always have the opportunity to opt-out. I will never sell your information to others.

9. HOW DO I CONTACT YOU?

To contact me about anything to do with your personal data and data protection, including to make a subject access request, please use the following details :

Email address: info@aradhanaperry.com
Telephone number: +44 (0) 7816832914
Postal Address: Women and Health, Carol Street, Camden, London, and/or Ffynnonofi, Dinas Cross, Pembrokeshire SA42 0SD

10. CHANGES TO THIS PRIVACY NOTICE

I may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if I change my business in a way that affects personal data protection. Any changes will be made available here.

Section C

DATA BREACH

All personal and sensitive data held by Dr Aradhana Perry is held securely. Personal information is minimised in phone and email communication. 

Any electronic data stored on a computer is stored on a password protected computer, in password protected documents held on the C: Drive of the computer and backed up in Apple iCloud storage, also password protected. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked cabinet behind a locked door.

Email applications use private (SSL) settings, which encrypts email traffic so that it cannot be read at any point between my computing devices and mail server. I will never use open or un-secure Wi-Fi networks to send any personal data.

In the case of a data breach Dr Aradhana Perry shall comply with the regulations set out under Article 33 of the GDPR stated below;

1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.

   2. The notification referred to in paragraph 1 shall at least: 

   (a)  describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned; 

   (b)  communicate the name and contact details of the data controller where more information can be obtained; 

   (c)  describe the likely consequences of the personal data breach; 

   (d)  describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 

   3. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. 

   4. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

   5. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.

   6. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.