What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?
The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private
and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of
a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific
condition. It also covers any session records, text messages or emails we exchange. For more information you can
read the policy documents accessible via your welcome information pack.
How long will you hold my information for?
I am regulated by the CNHC, an organisation that stipulates I must hold your data for 8 years after your final session.
Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment
ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the
above retention scales. This is in line with NHS regulations for holding data.
What if I don’t want my records to be held for that long?
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper
records would be shredded with a cross shredding machine and any electronic data such as emails or text messages
would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you
made but would not save any other data. In some circumstances my insurance companies legal team may want to verify
information I send out.
Why do you need to record this information?
I collect information about; why you are using the service, a small amount of medical information and a small amount
of information about your important others, alongside brief session notes. This information enables me to provide a high
quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session.
Your contact details / address and Doctors details will only be used with your explicit consent. See consent form below.
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password
protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and
stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job
effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these
discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the
GDPR.
What if I see you outside of the session?
If we see each other outside of a session I will smile but will not engage in any further conversation to ensure your
confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by
GDPR law to ensure your confidentiality is protected.
What about other Health and Social Care Professionals?
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to
yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is
to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for your information, by law I would also have to provide them with
your information.
Please Read This Document Carefully
The frequently asked questions and related answers in this document establish the terms and conditions for treatment at
Finding Solutions.
Please ensure that these terms and conditions are fully accepted by you prior to attending subsequent appointments. If
you feel you would require a change to your terms and conditions, please speak with me prior to our second session.
As the processing of your personal data is required to enable me to provide you with a service, I do not require consent
from you to hold your information securely or to provide you with this service, but will take this opportunity to assure
you I adhere to all laws and procedures relating to data protection (Article 9, paragraph 2, (h) of the GDPR) and will
only use your data to provide you with this service and for any further reason you explicitly consent to below.
Please tick and sign below to confirm you consent to contact from Finding Solutions for the purpose of:
Appointment reminders/rearrangements ☐
Homework or discussion synopsis ☐
Evaluation of service ☐
Newsletters ☐
Promotional offers ☐
Please tick to confirm which formats you agree for Finding Solutions to contact you :
Text ☐
Phone call ☐
Email ☐
Facebook Messenger ☐
Your privacy and confidentiality are important, and Finding Solutions will never use your information for any purpose
other than that to which you have explicitly consented to above. You may withdraw consent at any time by getting in touch.
I have discussed and been provided with access to the GDPR Policies and Procedures for Finding Solutions :
Signed…………………………………………………………………………Date……………………………