GDPR AND DATA PROTECTION COMPLIANCE

 

PART 1 — PUBLIC PRIVACY NOTICE

 

Privacy Notice

 

1. Who I am

 

I am Leigh Manning, a private psychotherapist and the data controller for Leigh Manning Psychotherapy. I provide psychotherapy and counselling on a face-to-face, online and telephone basis. I am registered with the Information Commissioner's Office (ICO) and process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and my professional obligations as a psychotherapist. If you have questions about how I use your personal information, you can contact me using the contact details provided on my website.

 

2. What information I collect

 

Depending on the circumstances, I may collect and process:your name and contact details; information needed to arrange appointments; information about the therapeutic work we undertake; information you choose to disclose during therapy; relevant information concerning your physical or mental health; correspondence between us; payment and accounting information where necessary; information provided through my website enquiry form; information necessary to deal with professional, legal or regulatory matters. Information concerning your physical or mental health is classed as special category personal data under UK data protection law.I aim to collect and retain only information that is relevant and necessary for the purposes for which it is used.

 

3. How I collect information

 

I may receive information: directly from you when you make an enquiry; during assessment and therapy; by telephone, email or messaging; through my website enquiry form; when arranging or administering appointments; through payment and accounting processes; where necessary, from another person or professional involved in your care, where there is an appropriate lawful basis for doing so.

 

4. How I use your information

 

I use personal information for purposes including: responding to enquiries; arranging and providing psychotherapy or counselling; maintaining appropriate clinical records; communicating with you about appointments; dealing with payments and accounting; meeting legal, professional and regulatory obligations; protecting the safety of clients or other people where necessary; dealing with complaints or potential legal claims; maintaining the security and proper functioning of my practice and website. I do not use your therapy information for advertising or marketing purposes.

 

5. My lawful bases for processing information

 

The UK GDPR requires me to have a lawful basis for processing personal information. For providing therapy, I generally rely on Article 6(1)(b) UK GDPR, where processing is necessary for the performance of the therapeutic agreement between us. Because therapy involves health information and other special category information, I also rely on an appropriate Article 9 condition, including Article 9(2)(h), where processing is necessary for the provision or management of health or social care and is carried out subject to appropriate professional confidentiality safeguards. For other activities, different lawful bases may apply. These may include:Article 6(1)(c) — legal obligation, for information I am legally required to keep, such as appropriate accounting and tax records;Article 6(1)(f) — legitimate interests, where appropriate, for limited activities such as maintaining necessary records after therapy has ended, dealing with potential legal claims, protecting the security of my practice and responding to certain website enquiries; other lawful bases where required by the particular circumstances. I do not rely on consent as the general GDPR lawful basis for providing therapy. Your agreement to participate in therapy and your consent to particular aspects of therapeutic work are separate matters from the lawful bases used under data protection law.

 

6. Confidentiality

 

Information you share during therapy is treated as confidential. There are circumstances in which confidentiality may have to be limited, for example: where there is a serious and foreseeable risk of significant harm to you or another person; where disclosure is required by law; where disclosure is otherwise legally authorised or justified; where information needs to be shared appropriately in relation to safeguarding; where professional consultation or supervision is necessary. Where appropriate and possible, I will discuss such disclosures with you before making them. This may not always be possible where doing so could increase risk or where the law prevents it. I may discuss aspects of my clinical work with a professional supervisor. Where possible, information is anonymised and identifying details are not used.

 

7. Clinical records

 

I keep appropriate clinical records of therapy. My clinical notes are maintained in Word documents using the client's first initial rather than their full name. I avoid including unnecessary identifying information such as addresses or place names. The clinical records are stored on an encrypted USB storage device. A separate encrypted USB backup is maintained to protect against accidental loss, destruction, technical failure or other incidents affecting the primary storage device. Clinical records are not routinely stored in iCloud or other cloud storage. I do not record therapy sessions, including Zoom sessions.

 

8. Telephone, email and messaging

 

I may use telephone, email and WhatsApp to communicate with clients, principally for practical matters such as arranging or changing appointments. I use Gmail for email communication and WhatsApp for messaging. Please remember that electronic communications can involve risks outside my direct control. You should avoid including highly sensitive therapeutic information in ordinary messages unless it is necessary.

 

9. Online therapy

 

Online therapy is provided using Zoom. I do not record Zoom therapy sessions. I take reasonable steps to protect the privacy of online sessions, including using password-protected devices and appropriate account security. You are also responsible for choosing a private and secure environment from which to participate in online therapy.

 

10. Face-to-face therapy

 

For face-to-face therapy, I take reasonable steps to protect confidentiality and privacy in the physical environment. Any paper or other physical information containing personal data is kept securely and is not left where unauthorised people can access it. I aim to minimise the amount of physical personal information held.

 

11. Website enquiries

 

If you contact me through the enquiry form on my website, I may process the information you provide in order to respond to your enquiry and, where relevant, arrange an initial discussion or therapy. The website is provided using Wix. Information supplied through the enquiry form is treated confidentially and is not used for unrelated marketing purposes. If an enquiry does not lead to therapy, I will normally delete or securely dispose of unnecessary personal information after an appropriate period.

 

12. Accounting and financial information

 

I use FreeAgent for accounting and financial administration. Information processed for accounting and tax purposes may include your name, payment information and other information necessary for maintaining appropriate financial records. Where information is required to comply with tax or other legal obligations, I may retain it for the period required by law.

 

13. iCloud

 

I use iCloud for personal/device storage. My clinical therapy records are not stored in iCloud. I avoid transferring or storing therapy information in cloud storage.

 

14. Who may receive your information

 

I do not routinely disclose information about clients to third parties. Information may be disclosed where necessary and lawful, including: to my professional supervisor, subject to confidentiality and with identifying information minimised wherever possible; to service providers that process information on my behalf, such as providers of email, website, video-conferencing, messaging or accounting services; where disclosure is required by law; where there is an appropriate safeguarding or other legally recognised basis for disclosure; where necessary in connection with legal proceedings or the establishment, exercise or defence of legal claims. I take reasonable steps to ensure that third-party service providers used by my practice provide appropriate safeguards for personal information.

 

15. International processing

 

Some technology and communications providers may process personal information in countries outside the United Kingdom. Where this occurs, the relevant provider's own data-protection arrangements and any applicable UK GDPR requirements concerning international transfers will apply. I will take reasonable steps to ensure that personal information is handled in accordance with applicable data-protection requirements.

 

16. How long I keep information

 

I do not keep personal information indefinitely. I retain clinical/therapy records for six years after the end of therapy. After the applicable retention period, records will be securely deleted or destroyed, subject to any circumstances requiring a longer retention period, such as an actual or reasonably anticipated legal claim or another legal or professional requirement. Where an enquiry does not result in therapy, unnecessary personal information will normally be deleted after an appropriate period and will not be retained indefinitely. Financial and accounting information will be retained for the periods required by applicable tax and accounting requirements. Other personal information is retained only for as long as it is reasonably necessary for the purpose for which it was collected or for another lawful purpose. Retention periods are reviewed periodically.

 

17. Your data protection rights

 

Depending on the circumstances, you may have rights under the UK GDPR including: the right to be informed about how your information is used; the right to request access to personal information I hold about you; the right to request correction of inaccurate information; the right to request erasure in certain circumstances; the right to request restriction of processing in certain circumstances; the right to object to certain processing; the right to data portability in certain circumstances; rights relating to automated decision-making and profiling where applicable. These rights are subject to certain legal exemptions and limitations. For example, the right to erasure is not absolute and does not necessarily apply where information needs to be retained for a legal or other recognised purpose. If you wish to request a copy of personal information I hold about you, please contact me using the contact details on my website. I will normally respond to a valid subject access request within one month, subject to the circumstances and any applicable legal extensions or exemptions. I may need to verify your identity before providing information.

 

18. Complaints

 

If you have concerns about how I have handled your personal information, I would encourage you to contact me first so that I can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection. ICO website: https://ico.org.uk/19. I may update this Privacy Notice from time to time to reflect changes in my practice, technology, legal requirements or professional obligations.

​

 

PART 2 — CLIENT-FACING WORKING AGREEMENT & PRIVACY INFORMATION

 

Working Agreement

 

Therapy is based on a therapeutic agreement between the client and therapist. Before therapy begins, I discuss the practical and professional arrangements with the client, including fees, appointments, cancellations, communication, confidentiality and the nature of the therapeutic work.

 

Confidentiality

 

Information shared during therapy is treated as confidential, subject to the limitations explained in the Privacy Notice. I may discuss aspects of my clinical work with my professional supervisor. I anonymise information and do not use the client's name. Confidentiality may need to be limited where there is a serious concern about significant harm, where disclosure is required by law, or where disclosure is otherwise legally or ethically justified.

 

Records

 

I keep appropriate clinical notes. Clinical notes use the client's first initial rather than their full name and avoid unnecessary identifying information. Notes are stored on encrypted removable storage. I do not record therapy sessions. Clinical records are normally retained for six years after therapy ends and are then securely deleted or destroyed, subject to circumstances requiring longer retention.

 

Online therapy

 

Online sessions are provided using Zoom and are not recorded. Clients should participate from a reasonably private location and take appropriate steps to protect their own privacy.

 

Communication

 

Email, telephone and WhatsApp may be used for practical communication such as arranging appointments. Clients should avoid sending highly sensitive therapeutic information by ordinary email or messaging unless necessary.

 

Data protection

 

Personal information is processed in accordance with the UK GDPR and Data Protection Act 2018. Clients may have rights to access, correct, restrict or request deletion of their personal information, subject to applicable legal exemptions and limitations.