The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information your can read the policy documents accessible via your welcome information pack.
I am regulated by the CNHC, an organisation that stipulates I must hold your data for 8 years after your final session. Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. This may not happen immediately if the CNHC or my insurance insist that I have a legal basis in which to hold your data. In some circumstances my insurance companies legal team may want to verify information I send out.
I collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent. See consent in your welcome pack.
When an individual visits www.Tania-Taylor.co.uk, I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Tania Taylor Hypnotherapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed. Google Analytics privacy policy can be found here.
I work with multiple third party services to help me with managing and building my website, mailing lists, and social media presence. Their privacy notices can be found here for further information: Urbansoul Privacy Policy and WordPress Privacy Policy and Active Campaign Privacy Policy. Tania Taylor Hypnotherapy uses third-party providers, Hootsuite, Buffer & Later to manage its social media interactions. Any messages sent to the inbox of social media accounts are stored by Hootsuite and permanently deleted after three months. Their Privacy notice can be found here. Buffers privacy notice can be found here, and Laters privacy policy can be found here. Jo Shea VA privacy policy can be found here. Admin Services Online privacy policy can be found here. Empowered Online Ltd privacy policy can be found here. Yorkshire Marketing Consultants privacy policy can be found here. Tania Taylor Hypnotherapy and Virtual Assistant Services also have a confidentiality data sharing contract in place inline with GDPR legislation.
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR.
If we see each other outside of a session I will smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.
When making confidential requests, it is always safer to use my professional email address: hello@Tania-Taylor.co.uk or website www.Tania-Taylor.co.uk than to use social media messaging services.
To enable us to maintain a good therapeutic relationship, I do not mix social and professional relationships. This means that I will not accept ‘friend requests’ on my personal social media accounts and will not engage in therapeutic conversation outside of our appointments. This is to protect you and your therapeutic rights to be treated by a competent professional. This also meets requirements and professional standards set by regulatory bodies who audit my work as a therapist.
I appreciate that having someone actively listen to you whilst you share information that can sometimes feel difficult, may illicit feelings of wanting to hug, shake hands, or touch. However, to get the most out of our therapetuic relationship and to adhere to professional boundaries, it is best if we limit touch.
As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your treatment with me, and then notify them of the treatment ending, I would only do this if you were to sign the specific consent for this in your welcome pack.
Exceptions:
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for your information, by law I would also have to provide them with your information.
If you have accessed Tania Taylor Hypnotherapy & Psychotherapy services and wish to read the full Information Governance Policies and Procedures, you can access them via this link, by using the password provided to you in your information pack.