GDPR and Privacy Notice
How will my data be stored?
In May 2018 the Data Protection Act was replaced by the General Data Protection Regulations (GDPR). The changes to the Data Protection Act are aimed at ensuring that your personal, confidential and sometimes sensitive data, is held privately and securely.
How long will you hold my information for?
I am regulated by the NCH, an organisation that stipulates I must hold your data for 8 years after your final session. Unless you are under 16, in which case I must hold your data until your 25th birthday. If you are 17 when your sessions end I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
What if I would like my data to be destroyed before this date?
What is the right to erasure? Under Article 17 of the UK GDPR individuals have the right to have personal data erased. This is also known as the 'right to be forgotten'. The right only applies to data held at the time the request is received.
Am I able to see or get a copy of the information held by you?
In line with GDPR, yes, within 30 days
What are your Reasons for collecting this information?
I collect information about why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent. See consent form below.
How do I know that you will store my information securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Are our discussions within the hypnotherapy sessions confidential?
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR.
What if I see you outside of a hypnotherapy session? I will not approach you unless we have a prior relationship and will, should you approach me, allow you to disclose how we know each other.
Will you discuss information about me with other health and social care professionals?
Only with your written consent and only if strictly necessary for the continuation of our work together.
Exceptions:
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for your information, by law I would also have to provide them with your information.
Data controller
As a student hypnotherapist I am in the process of researching how to become a data controller and gain an ICO registration.