General Data Protection Regulations, 2018 (GDPR)
Frequently asked questions & Terms and Conditions of receiving therapy
Terms
“Iona Lawson”; and “Iona Lawson Hypnotherapy” are used interchangeably in this document.
General
This Policy has been produced to explain what data Iona Lawson may collect from clients and how it is used or stored. It serves to help Iona Lawson Hypnotherapy comply with the General Data Protection Regulations (GDPR).
Please Read This Document Carefully
The frequently asked questions and related answers in this document establish the terms and conditions for therapy at Iona Lawson Hypnotherapy.
Please ensure that these terms and conditions are fully accepted by you prior to attending appointments. If you feel you would require a change to your terms and conditions, please speak with me prior to your next session.
For more information you can read the policy documents accessible via my website – www.ionalawsonhypnotherapy.co.uk.
What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?
The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange.
How long will you hold my information for?
I am regulated by the NCH, CNHC and AfSFH. As such, I am bound by their regulations regarding the length of time I can hold on to client information. I must hold your data for 8 years after your final session. If you are a child however, I must hold your data until your 25th birthday, unless you are 17 when therapy ends and then I must keep it until your 26th birthday. Your records will be deleted in the January after the above retention dates.
What if I don’t want my records to be held for that long?
Under the GDPR you can write to me, asking for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance company’s legal team may want to verify information I send out.
Why do you need to record this information?
I collect information about your reason for coming to see me, a small amount of medical information and some information about your important others, alongside brief session notes. This information enables me to provide a high- quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent (there is an exception to this, please see below).
Am I able to see or get a copy of the information held by Iona Lawson Hypnotherapy?
In line with GDPR, if you send Iona Lawson a request in writing, specifying the data you wish to see, they will supply you with a copy of your data within 30 days. Iona Lawson will need to confirm your identity before sending you the information. There will be no charge for this service. NB Iona Lawson’s insurance company’s legal team may wish to verify any information Iona Lawson Hypnotherapy sends out.
What lengths are made to ensure my information is held securely?
- Hardcopy documents – Are all stored in a locked cabinet in a locked room.
- Text messages – My work phone is secured with a pin code and fingerprint access.
- Emails – My email account requires a username and password.
- Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
- Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you, and my supervisor also adheres to the GDPR.
What if I see you outside of the session?
If we see each other outside of a session I may smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your therapy, that you refrain from discussing your therapy with me outside of your sessions.
What about other Health and Social Care Professionals?
As I adhere to the GDPR any contact relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your therapy with me, and then notify them of the therapy ending, I would only do this if you were to sign the specific consent for this.
Exceptions:
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for your information, by law I would also have to provide them with your information.
What happens if my therapist becomes incapacitated by illness or is asked to self-isolate due to COVID-19?
Whenever possible, the therapist will contact you directly to inform you and to discuss appointment arrangements.
Who is the Data Controller and what is their ICO registration number?
The Data Controller is Iona Lawson (trading name: Iona Lawson Hypnotherapy).
ICO registration number: ZB340414
This policy was last updated: December 2023.
It may be updated at any time, so please check back regularly to ensure that you’re aware of the latest version. Please note that the Privacy Policy for Iona Lawson Hypnotherapy is available to view here.