What is the General Data
Protection Regulations, 2018 (GDPR) and how does it affect me?
The
GDPR replaces the 1998 Data Protection Act to ensure your personal and
sensitive, confidential data is kept private and held securely, being processed
in the way that you have agreed to. It is there to protect your rights as a
consumer of a service or product that might involve your identifiable data,
e.g. your name and address or whether you have a specific condition. It also
covers any session records, text messages or emails we exchange. For more
information you can read the policy documents accessible via your welcome
information pack.
How long will you hold my information for?
I
am regulated by the CNHC, an organisation that stipulates I must hold your data
for 8 years after your final session. Unless you are a child, in which case I
must hold your data until your 25th birthday, unless you are 17 when treatment
ends and then I must keep it until your 26th birthday. Therefore, all records
will be deleted in the January after the above retention scales. This is in
line with NHS regulations for holding data.
What if I don’t want my records to be held for that long?
Under
the GDPR you can make a request in writing to me, for all your records to be
deleted. In this case all your paper records would be shredded with a cross
shredding machine and any electronic data such as emails or text messages would
be permanently deleted from the devices they are stored on. I would have to
save the request for deletion you made but would not save any other data. This
may not happen immediately if the CNHC or my insurance insist that I have a
legal basis in which to hold your data. In some circumstances my insurance
companies legal team may want to verify information I send out.
Why do you need to record this information?
I
collect information about; why you are using the service, a small amount of
medical information and a small amount of information about your important
others, alongside brief session notes. This information enables me to provide a
high quality service to you, ensuring I am equipped with the knowledge of our
previous discussions prior to each session. Your contact details / address and
Doctors details will only be used with your explicit consent. See consent in
your welcome pack.
What lengths are made to ensure my information is held securely?
Hardcopy
documents –
Are all stored in a locked cabinet in a locked room.
Text
messages –
My work phone is secured with a pin code.
Emails – My email account
requires a user name and password.
Email
attachments –
Any attachments sent by email to you containing your personal information would
be password protected and the password would be sent to you via text message.
Electronic
documents –
Any electronic documents e.g. A letter to your GP, or an invoice, are password
protected and stored on a password protected computer if they contain personal
or sensitive information.
Is what we discuss kept confidential?
Everything
we talk about during our sessions are strictly confidential between you and me.
To ensure I am doing my job effectively and that I have the right support, I
may discuss elements of our sessions with my supervisor. During these
discussions I do not disclose any details that may identify you to my
supervisor, and my supervisor also adheres to the GDPR.
What if I see you outside of the session?
If
we see each other outside of a session I will smile but will not engage in any
further conversation to ensure your confidentiality. You are welcome to say
hello if that feels appropriate. You are welcome to share with other people
about the therapy you are receiving, but I am obligated by GDPR law to ensure
your confidentiality is protected. I would request that in order to ensure the
success of your treatment, that you refrain from discussing your treatment with
me outside of your sessions.
What about other Health and Social Care Professionals?
As
I adhere to the GDPR any contact, relating to you, with other health care
professionals would only be made with your signed consent. E.g. If I were to
write to your GP to notify them of your treatment with me, and then notify them
of the treatment ending, I would only do this if you were to sign the specific
consent for this in your welcome pack.
Exceptions:
In
order to safeguard you and the people around you, if you were to disclose that
you were going to carry out harm to yourself or someone else, then under my
“Duty of Care” I am obligated by law to inform the relevant authorities. This
is to support you to live well, and I would always aim to discuss this with you
prior to contacting anyone.
If
I was issued with a police warrant or court order for your information, by law
I would also have to provide them with your information.
If you have accessed Stephanie Betschart Hypnotherapy & Qi
Gong services and wish to read the full Information Governance Policies and
Procedures, please contact me here and I will send you a link.
