Data Protection and Privacy Policy
Why we hold information about you
Family Focused Psychology Services Ltd needs to gather and use information about individuals in order to provide psychological assessment, therapy, supervision, teaching, consultation and training activities as well as process payments for services. This information is gathered and retained as required to fulfil our contract with you or because there is a legitimate interest in our needing to collect this information (e.g. so that we can communicate with you directly about the services we are providing to you).
Who might we hold information about
Individuals can include clients, referring organisations and agencies, statutory organisations, suppliers, business contacts, employees and other people the company has a relationship with or may need to contact.
What is personal information
In providing you with our services, Family Focused Psychology Services Ltd will need to handle your personal information.
Personal information is details about you from which you can be identified, such as your name and contact details including a postal address, telephone number(s) and electronic contact such as email address.
Depending on what services you receive from us, we may process additional sensitive data such as information about your health. This information is essential to inform, facilitate and provide assessment and therapeutic services which are appropriate to your individual needs.
Why keep personal information
Under the requirements of the Health Care Professions Council (HCPC) and British Psychological Society (BPS), Family Focused Psychology Services Ltd are obliged to keep documentation of your personal data to allow us to provide assessment and therapy services to you. This falls within the legitimate interests of provision of our services, for example:
We collect this information directly from you. We may also collect information about you from third parties; for example, if we need to gather information from another health professional (such as your GP) to provide a complete psychological assessment.
Family Focused Policy
This policy describes how personal and sensitive data is collected, handled and stored (if you contact us or when we contact you) to meet the company’s data protection standards.
Data Controller
Family Focused Psychology Services Ltd is committed to the protection of all personal and sensitive data for which it holds responsibility as the Data Controller and the handling of such data in line with data protection principles as specified by the UK Data Protection Act (1998) and updated by the General Data Protection Regulation 2018. Changes to data protection legislation shall be monitored and implemented to remain compliant with all requirements.
The member of staff responsible for data protection is: Dr Johanna Hilton, Director.
Family Focused Psychology Services Ltd is also committed to ensuring that its staff are aware of data protection policies, legal requirements and adequate training is provided to them. Staff members are responsible for ensuring data is handled and processed in line with the policy and data protection principles. The requirements of this policy are mandatory for all staff employed by Family Focused Psychology Services Ltd and applies to all contractors, supplies and other people working on behalf of the company.
Data Processing
The data processing activities of Family Focused Psychology Services Ltd are registered with the Information Commissioner’s Office (ICO) as required of a recognised Data Controller. Details are available from the ICO.
Changes to the type of data processing activities being undertaken shall be notified to the ICO and details amended in the register.
Sensitive Data
All data within the control of Family Focused Psychology Services Ltd shall be identified as personal, sensitive or both to ensure that it is handled in compliance with legal requirements and access to it does not breach the rights of the individuals to whom it relates.
The definitions of personal and sensitive data shall be as those published by the ICO for guidance.
Principles of the Data Protection Act (1998) and the General Data Protection Regulation (2018)
The principles of the Data Protection Act shall be applied to all data processed:
Family Focused Psychology Services Ltd aims to be transparent about the intended processing of data and ensure that individuals are aware of how their data is being used and how to exercise their rights under the GDPR. This information will be notified to clients via the company’s data protection and privacy policy, and, where relevant, be written in a form understandable by those defined as ‘Children’ under the legislation. A version will also be available on our website: www.familyfocused.co.uk.
Requests for data to be erased
You have the right to ask for your information we hold on you to be erased by contacting our Data Protection Officer, Dr Johanna Hilton, Director at PO BOX 10106 Nottingham NG1 9HE, or via email to admin@familyfocused.co.uk.
If you want to have your data removed, we have to determine if we need to keep the data. For example, HMRC wish to inspect our records or if in doing so we would breach our professional organisations data retention requirements.
If there is an on-going legal matter related to your case or if your request falls within the timeframe that our governing practice body has a requirement that we hold data for (around 7 years for adults and until 25 years of age for children). In this instance, we may not be able to erase your data before that time has passed or any court action is ended.
If we decide that we should delete the data, we will do so without undue delay.
Confidentiality
The confidentiality of your personal information is very important to Family Focused Psychology Services Ltd. All our services are confidential, and we will not share your information unless we judge that there is a serious risk of harm to yourself or others, or with your written consent, or when we are legally obliged to do so.
Confidential information is restricted only to those who have a reasonable need to access it.
Notifications shall be in accordance with ICO guidance.
If another party has access to your data we will tell you if they are acting as a data controller or a data processor, who they are, what they are doing with your data and why we need to provide them with the information.
The intention to share data relating to individuals to an organisation outside of Family Focused Psychology Services Ltd shall be clearly defined within notifications and details of the basis for sharing given. Data will be shared with external parties in circumstances where it is a legal requirement to provide such information. Any proposed change to the processing of individual’s data shall first be notified to them.
Protecting your Information
Family Focused Psychology Services Ltd is committed to keeping the information we hold about you secure. To protect your personal data, we follow the guidelines and recommendations in line with our professional bodies (The British Psychological Society and The Health Care Professionals Council) and regulatory bodies such as the Information Commissioners Office.
We have physical, electronic, and operational procedures in place to protect your data. In the unlikely event of our security processes being compromised leading to a significant breach of your information, we will endeavour to inform you within 72 hours of the breach being identified as well as the ICO.
Subject Access Requests
All individuals whose data is held by Family Focused Psychology Services Ltd, have a legal right to request access to such data or information about what is held. Subject Access Requests (SARs) should be made in writing to the nominated Data Protection Officer, Dr Johanna Hilton, by letter (PO Box 10106 Nottingham NG1 9HE) or email (admin@familyfocused.co.uk).
Responses to such requests made by individuals will be made within 30 days and will usually be processed free of charge. Verification of the identity of anyone making a Subject Access Request will be required before information can be shared.
We may withhold such personal information to the extent permitted by law. In practice, this means that we may not provide information if we consider that providing the information will violate your vital interests.
In relation to Assessments as part of Court Proceedings, any request for access to data needs to be made via the Court as we are not free to give out to anyone records relating to an assessment prepared for legal proceedings. To see this information, you will need to make an application to the court and the court would decide. You will need to explain exactly what you want to see and why.
It is unlikely you will be permitted to see information about anyone except yourself.
We are not usually allowed to give out the original and reference material relating to questionnaires (psychometrics) and how they are scored. If the court agrees, these may be shared with another psychologist you have instructed. The psychologist you have instructed must be qualified to interpret the assessments used.
You can also ask for your information to be transferred to another provider of psychological services. We will respond to your request within 30 days.
Verification of the identity of anyone making such a request will be required before information can be shared.
Data Storage and Security
Information about you will be held in the form of written notes, emails, questionnaires, and letters, in addition to invoices. This information could be collected at any point during your contact with us and/or during your receipt of services from us. Your information will be collected, managed and stored solely for the purposes of us providing you with psychological services or training.
Security of data shall be achieved through the implementation of proportionate physical and technical measures. Nominated staff shall be responsible for the effectiveness of the controls implemented and reporting of their performance.
The security arrangements of any organisation with which data is shared shall also be considered and these organisations will be invited to provide evidence of the competence in the security of shared data.
We keep your information on our company computers
We use personal computers that are located at our administrative base. The computers are password protected and the hard drives are encrypted. Passwords are not shared beyond those who need access to a given computer.
Where cloud services are used, these meet GDPR requirements and all data is securely encrypted when stored there.
We keep records of written communication electronically. We also record some aspects of our interaction with you in Microsoft Excel Spreadsheets on a computer in our office. We occasionally need to transfer our accounts Excel Spreadsheet to our (UK-based) accountant. This is done using encrypted transfer and our accountant has stated that their company’s processes are GDPR compliant.
Electronic data will be stored in designated drives which are encrypted and servers which meet acceptable security standards, and all computers and servers containing such data will be protected by approved security software and a firewall. Regular checks will be performed to ensure security hardware and software is functioning properly. Electronic data will be backed up regularly and these backups will be tested regularly, in line with the company’s standard backup procedures. Where data is uploaded to cloud computing services, these will be compliant with GDPR.
Data which is stored on removable media, such as USB, CD or DVD, will be encrypted and kept in a secure, locked filing cabinet when not being used. Data which is stored electronically is protected from unauthorised access using passwords.
We also take hand written notes when we meet you. These notes may be used to create a report on the services that we provide to you, to you or to an approved third party (i.e. your GP).
Mostly, however, our written notes serve simply as an aide memoire for your therapist to ensure continuity of treatment over time. We also keep the raw data from any questionnaires you have completed. We keep a paper copy of your notes and any invoices in locked filing cabinets in our offices when not required and will not be accessible to unauthorised personnel.
Following the conclusion of our work, after 3 months, paper records and removable electronic media are destroyed or if still required will be transferred to a GDPR compliant storage facility.
Data Use and Security
Employees should treat all data covered by this policy as confidential and only access that which is required for the purpose of their work. When access to confidential information is required, this will be requested from the nominated Data Protection Officer, Dr Johanna Hilton. Employees should keep all data secure by following sensible precautions and following the guidelines of this policy. Requests for clarification and help should be made to the nominated Data Protection Officer.
When working with personal data, employees of Family Focused Services Ltd will ensure the screens of their computers are locked by a password when left unattended. Access to and updating of personal data will always be from the central copy of any data. Personal and sensitive data will not be shared informally, either by telephone or email, unless consent of the client has been obtained. Personal and sensitive data shared formally, either by spoken or written communication, will be done only with the explicit consent of the client (and or parent/guardian for minors aged under 16 years). Data will be encrypted and password protected before being transferred electronically or by Egress secure email.
In certain circumstances, such as safeguarding concerns, the Data Protection Act (1998) allows for personal data to be disclosed to other professional and law enforcement agencies. Under these circumstances Family Focused Psychology Services Ltd are legally obliged to disclose such data.
Data Accuracy
Family Focused Psychology Services Ltd will take reasonable steps to ensure personal and sensitive data is kept accurately and is up to date. Data will be held in as few places as necessary.
A central system is utilised to access personal data pertaining to contact details such as name, address, telephone number(s), and email address. Staff should take every opportunity to ensure such data is current, for example, confirming contact details at appointments. Inaccuracies and amendments will be updated to the client’s file and central system database as soon as possible.
Clients will be encouraged to update the personal information Family Focused Psychology Services Ltd holds about them. Please contact the Data Protection Officer, Dr Johanna Hilton. We may require additional verification that you are who you say you are to process this request.
We will aim to update your information within 30 days.
In relation to assessment as part of Court Proceedings, any concerns regarding the accuracy of information should be raised with your solicitor in the first instance and with the Court for consideration.
Data Retention and Disposal
Family Focused Psychology Services Ltd recognises that the secure disposal of redundant data is an integral element to compliance with legal requirements and rights for data minimisation and is an area of increased risk.
We will hold information about you for as long as required by legislation and our Professional guidance. For assessment and therapeutic services we will normally hold your information for 7 years following the date of our last contact with you. If our identified client is a minor, we will hold information about the services that we have provided to them until they are 25 years old. This is in accordance with mental health legislation. Please see Www.gov.uk/government/publications/records-management-code-of-practice-for-health-and-social-care.
Financial records will be destroyed after 7 years.
After this time all data, paper or electronically held, will be securely destroyed or eradicated.
In accordance with GPDR guidance you will not be notified of this.
If you want to have your data removed we have to determine if we need to keep the data, for example in case HMRC wish to inspect our records, or other legal requirements. If we decide that we should delete the data, we will do so without undue delay.
If you have concerns about your data management:
Should you have any concerns about the management of your data by Family Focused Psychology Services Ltd, please contact our Data Protection Officer, Dr Johanna Hilton, in the first instance.
If we are unable to resolve your concerns, you have a right to complain to the Information Commissioner’s Office.