GDPR Policy Document

Appropriate Policy Document as required by the General Data Protection Regulation (GDPR)
Data Protection Act 2018, Schedule 1 Part 2 Paragraph (18)

 

As professional mental health Clinicians, we will always aim to work collaboratively with you.  As  explained in our Therapy & ADHD Agreements, the content of sessions is confidential, although your Clinician may discus the work with a supervisor but will not reveal your name.

 

In extreme circumstances where your Clinician believes there could be a significant risk to you (e.g. suicide) or to someone else (e.g. child protection) they may have to contact other professionals (e.g. GP) without your consent. If possible (and appropriate) they will try to discuss this with you first.  This document provides you with information about the legal context under the GDPR for the processing of your personal information in these circumstances.

“Normal Data” Also referred to as ‘Personal Data’ means any information relating to an identified or identifiable natural person (‘Data Subject’). By reference to an identifier such as name, a telephone number, home address and date of birth.

 

“Special Category Data (SCD)(SC)” is any information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, sex life or sexual orientation.

 

“Criminal Offence (CO)” personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when there is an exception listed under the GDPR.

 

“Processing” any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available.

 

“Controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.  In the case of a contract between a therapist and client in private practice, the therapist is the “data controller.”

 

“Data Concerning Health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her or their health status.

 

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

When we deliver services to you, we process normal data and Special Category (SC) data as defined in the GDPR Article 9. In order to deliver services to you it may be necessary to process a broad range of categories of data including information about your physical and psychological health. My processing activities may also include personal information identifying other important people in your life such as your partner, family members or friends.

In some circumstances, I will be unable to uphold nor acknowledge some of the rights listed in and in accordance with Data Protection Act 2018 such as;

 

• The right to be informed;
• The right to be forgotten
• The right of access
• The right to restrict processing;
• The right to object; and
• Complying with the principles.

 

DPA 2018 Schedule One, Part 2; Section 18 – Safeguarding of children and of individuals at risk.

 

When our Clinicians work with you, they seek to process data with your Explicit Consent in accordance with the GDPR Article 7. However, when this is not possible and they have a professional or legal obligation to protect you or someone else from harm, they can apply a condition known as the DPA 2018 Schedule One Part 2 Section 18 to safeguard either children or adults at risk.

There are two situations in which we can apply the DPA 2018 Schedule One Part 2 Section 18.

 

Reason 1:

 

Section 18(1)(b)(i)(ii) sates that we can use your personal information without your consent when either:

 

• In the circumstances consent to the processing cannot be given by the data subject.
• The controller i.e. therapist, cannot reasonably be expected to obtain the consent of the data subject to the processing, and the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection being provided.
• The processing is necessary for reasons of substantial public interest.

 

Reason 2:

 

When the controller i.e. therapist, has reasonable cause to suspect that the individual or a third party is experiencing, or at risk of, neglect or physical, mental or emotional harm, and as a result is unable to protect himself or herself against the neglect or harm or the risk of it.

The above GDPR information is included in brief in the various agreements we use in this service. These include the Therapy Agreement, ADHD Assessment Agreement and Consent Form for Medication.