Introduction to Silvadawn Ltd Company no. 3621054
You may be aware of new laws relating to General Data Protection Regulation (GDPR) that are in effect from 25 May 2018. The purpose of GDPR is to provide a set of standardised data protection laws across all EU member countries. This document sets out how the Directors of Silvadawn comply with these laws.
Data controller with ICO (Information Commissioners Office)
Mr Daniel Pamich is the registered data controllers for Silvadawn Ltd. Associates taking on referrals from Silvadawn Ltd will be data processors for the clients they work with directly and may have access to more detailed data due to the confidential nature of their clinical work with a specific client.
What personal data we hold
Silvadawn Ltd collects and processes the following personal data from therapy clients:
- Personal data: basic contact information: name, address, email, contact number, video conference ID (if online therapy), and GP contact details.
- Sensitive personal data: Signed Consent to the Therapy Agreement, therapy records (therapist notes, letters, reports and/or outcome measures).
- Medical information if seeing a Psychiatrist.
If you are referred by your health insurance provider, we will also collect and process personal data provided by that organisation. This includes basic contact information, referral information and health insurance policy number and authorisation for psychological treatment.
The lawful basis for holding personal data
Silvadawn Ltd has a legitimate interest in using the personal data and sensitive personal data we collect to provide mental health treatment. It is necessary for us to collect this data to be able to provide psychological therapy to clients and to identify clients should an issue or risk arise and the GP needs contacting. We may also ask for information on how you found our service for the purpose of our own marketing research. We will never sell your information to others.
What we do with your personal information
We take your privacy seriously. We will only use your personal information to provide the services you have requested from us. If you do not provide the personal information requested, then we may be unable to provide a therapy service to you as we have to collect identifiable information in case there is a concern regarding risk to self and others and we need to contact a third party concerning this risk.
How long we store personal information
You clinical notes will be stored in Office 365 or Power Diary (our practice management software). We will only store your personal information for as long as it is required by standard for our service and governing bodies. The sensitive personal data defined above is stored for a period of 7 years after the end of therapy. After this time, this data is deleted at the end of each calendar year. Card payments are processed using licensed payment software called Stripe.
What we will NOT do with your personal information
We will not share your personal information with third parties for marketing purposes.
How we ensure the security of personal information
We use a password protected Wi-Fi and information stored on the computer and work phone is password protected. Any information stored on third party servers e.g. OneDrive is protected with two factor authentications.
Personal information is also stored on an office computer and on a secure server. These are password protected. Malware and antivirus protection are installed on all computing devices. Mobile devices are protected with a passcode and all Associate Therapists are under contract to follow the same security procedures.
We will uphold your privacy rights which are:
- Your right to access the personal information we hold about you.
- We will usually share this with you within 30 days of receiving a request.
- There may be an admin fee for supplying the information to you.
- We may request further evidence from you to check your identity.
- A copy of your personal information will be handed to you in a permanent form.
- You have a right to get your personal information corrected if it is inaccurate.
You can complain to a regulator if you think that we haven’t complied with data protection laws, you have a right to lodge a complaint with the Information Commissioner’s Office.
Deleting Information
Silvadawn ltd reserves the right to refuse a request to delete a client’s personal information where this is clinical records. Clinical records are retained for a period of 7 years in accordance with the guidelines and requirements by the BPS and HCPC.