Privacy & Data Protection

For clients who have been supplied with the ‘contract for therapeutic services’ by Dr Banwell, please read the Privacy Notice and Data Protection information below prior to acceptance of the contract terms.

1. Who I am and how to contact me

I am Dr Elizabeth Banwell, a Health and Care Professions Council Registered Clinical Psychologist, providing clinical psychology services through Banwell Clinical Psychology. I am responsible for deciding how and why personal information is processed for my practice.

Contact: contact@banwellclinicalpsychology.co.uk

Website: www.banwellclinicalpsychology.co.uk

2. What personal information I may collect

Depending on the circumstances, I may collect and use:

·       name and contact details;

·       appointment and session information;

·       information provided when you enquire about or arrange therapy;

·       information about your psychological and physical health, assessment, treatment and clinical needs;

·       relevant information provided by you or, where appropriate and lawful, by another professional or organisation;

·       correspondence relating to your care;

·       payment information necessary to administer fees and insurance arrangements; and

·       information needed to meet legal, professional, safeguarding, insurance or regulatory requirements.

Health information is special category personal data and receives additional protection under data protection law.

3. Why I use your information

I use personal information to:

·       provide and manage psychological assessment and therapy;

·       communicate with you about appointments and your care;

·       maintain appropriate clinical records;

·       manage payments and insurance arrangements, including communications with insurers where applicable;

·       respond to requests and enquiries;

·       manage safeguarding concerns and comply with legal or professional obligations;

·       maintain appropriate professional supervision and governance; and

·       protect the security and integrity of my practice and information systems.

4. Why I am allowed to use your information

Data protection law requires me to have a lawful reason for using your personal information. The reason depends on what I am using the information for. In practice, this may include:

• Providing your therapy: I need to use information about you to provide and manage your therapy, including arranging appointments and dealing with payments. This is generally necessary for providing the service you have asked me to provide (Article 6(1)(b) UK GDPR).

• Meeting legal requirements: I may need to use or keep information to comply with a legal or professional requirement (Article 6(1)(c) UK GDPR).

Your agreement to the therapeutic contract, or your receipt of this Privacy Notice, does not mean that you have given consent to every possible use of your personal information. Some information is processed because it is necessary to provide your therapy or to meet legal or professional requirements, rather than because you have given consent.

Where the law requires your consent for a particular use of your information, I will ask for that consent separately and explain what you are being asked to consent to.

When I use health information as part of providing and managing your therapy, I also need to meet an additional legal requirement under Article 9 of the UK GDPR. This may include the condition that applies to the provision and management of health or social care or treatment (Article 9(2)(h)), together with the relevant requirements of UK law.

Information about your physical or psychological health is treated as special category personal data and has additional protection under data protection law.

Health information

• Running my practice safely and appropriately: I may use information where this is necessary for the proper administration, security and professional governance of my practice, provided that this is appropriate and does not unfairly override your rights and interests (Article 6(1)(f) UK GDPR).

• Protecting someone's life in an emergency: In exceptional circumstances, I may need to use information to protect someone's life or prevent serious harm (Article 6(1)(d) UK GDPR).

5. Where information comes from

Most information comes directly from you. Where appropriate and lawful, information may also come from healthcare professionals, insurers, referrers or other organisations involved in your care or the administration of your treatment.

6. Who I may share information with

I keep information confidential and only share it where there is a lawful and appropriate reason.

Depending on the circumstances, information may be shared with:

·       your insurer, where this is necessary for an insurance-funded service or policy excess administration;

·       relevant healthcare or other professionals involved in your care, where lawful and appropriate;

·       my professional supervisor, where necessary for supervision and professional governance, subject to appropriate confidentiality safeguards;

·       service providers who process information on my behalf, such as providers of secure email, cloud storage or video-conferencing services;

·       professional, regulatory or legal bodies where disclosure is required or permitted by law; and

·       emergency or safeguarding services where necessary to protect you or another person.

Where a service provider processes personal information on my behalf, I use appropriate contractual and data-protection safeguards. This includes ensuring that relevant processors are subject to appropriate written terms and that I consider their security, use of sub-processors, data location, international transfers and arrangements for access, return or deletion of information.

I do not sell personal information.

7. Google Workspace, Google Drive and Google Meet

I use Google Workspace Business Starter for my professional email and certain practice-related information, including Google Drive for electronic document storage and Google Meet for online sessions where applicable.

I have accepted Google's applicable data processing terms for Google Workspace. Access to my practice information is controlled through my Google Workspace account and account security settings. I do not intentionally make client information publicly accessible.

Google may process data as a service provider under its applicable contractual and privacy arrangements. Information may be processed or stored in locations outside the UK where permitted by applicable data protection law. Where UK GDPR international-transfer rules apply, I will use an applicable lawful transfer mechanism and appropriate safeguards. Information about Google's processing arrangements, sub-processors and transfer safeguards is available in Google's current contractual and privacy documentation.

I do not use AI transcription or automated note-taking tools in therapy sessions.

8. Local storage and security

Some information is also stored locally on my password-protected practice laptop. I use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure.

These measures are proportionate to the nature and sensitivity of the information and may include account and access controls, password protection, security updates, malware protection, secure storage and appropriate backup arrangements.

No electronic system can be guaranteed to be completely secure. If a personal data breach occurs, I will assess it and take the steps required by applicable data protection law. Where required, I will notify the Information Commissioner's Office and/or affected individuals within the relevant legal timescales.

By choosing to communicate with me by email, you acknowledge that there is a small residual risk associated with electronic communication, despite the security measures I use.

For this reason, I will take reasonable steps to minimise the amount of sensitive information sent by email and will use an alternative method of communication where I consider this more appropriate for the sensitivity of the information. You should also take reasonable care to protect the security of your own email account, devices and any information sent to or received from me.

However, email and other internet-based communications cannot be guaranteed to be completely secure. Once an email has been sent, it may pass through systems or networks outside my control, and I cannot guarantee the security of the recipient's email account, device or internet connection.

I use email to communicate with you about appointments, enquiries and, where appropriate, your therapy. I use my professional Google Workspace account and take reasonable steps to protect information sent and received by email.

9. How long I keep your information

I normally retain clinical records for seven years following the end of therapy.

In some circumstances, it may be necessary to retain information for longer, for example where this is required by law, professional or insurance requirements, or where the information is reasonably required in connection with actual or anticipated legal proceedings or the establishment, exercise or defence of legal rights.

Any information retained beyond the usual retention period will be kept only for as long as it remains necessary and proportionate for that purpose, and will then be securely deleted or disposed of.

Different types of information may be retained for different periods depending on why the information is held and the applicable requirements. I review information in accordance with my retention arrangements and securely delete or dispose of information when it is no longer required.

10. Your data protection rights

Subject to applicable legal conditions and exemptions, you may have rights to:

·       request access to your personal information;

·       request correction of inaccurate or incomplete information;

·       request erasure in certain circumstances;

·       request restriction of processing in certain circumstances;

·       object to certain processing;

·       request data portability where the relevant legal conditions apply; and

·       withdraw consent where processing relies on consent.

If you make a Subject Access Request, I will normally respond within one calendar month. Where a request is genuinely complex, the law may allow additional time. I will carry out a reasonable and proportionate search for the information covered by your request and may need to verify your identity or ask you to clarify your request.

Some information may need to be withheld or redacted where the law requires or permits this, for example information relating to another person or information covered by a relevant health or other legal exemption.

To exercise a data protection right or ask a question about how I use your information, contact me at contact@banwellclinicalpsychology.co.uk. I may need to verify your identity before responding.

You also have the right to complain to the Information Commissioner's Office if you believe your personal data has been handled unlawfully.

You have the right to complain directly to me about how I have handled your personal information. Please contact me at contact@banwellclinicalpsychology.co.uk and I will deal with your concern in accordance with my data protection complaints procedure.

If you ask me to erase your information, I will consider the request in accordance with the legal requirements and exemptions. I may need to retain clinical records during the applicable retention period.

11. Confidentiality and safeguarding

Information shared during psychological therapy is treated as confidential. There are circumstances in which confidentiality may need to be limited, for example where there is a serious concern about the safety of you or another person, where safeguarding duties arise, or where disclosure is required or permitted by law.

Where practicable and appropriate, I will discuss significant disclosures with you first. The need to share information will be considered carefully and only information that is necessary will be disclosed.

12. Automated decision-making and AI

I do not use automated decision-making or profiling to make decisions about clients. I do not use AI transcription or AI note-taking tools for therapy sessions.

13. Changes to this Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in my practice, technology or applicable data protection requirements. The current version will be made available on my website.

If a significant change affects how your information is processed, I will take reasonable steps to bring the change to your attention.

14. Complaints

If you have a concern about how I use your personal information, please contact me first so that I can try to resolve it. You have a right to complain directly to me about the way I have handled your personal information, and I have a procedure for dealing with data-protection complaints.

You can also contact the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

ICO website: https://ico.org.uk/

This Privacy Notice is intended to provide clear information about the personal data processing carried out by Banwell Clinical Psychology. It should be read alongside the Contract for Therapeutic Services.

15. Website visitors

This website is hosted by Squarespace. Squarespace collects personal information when you visit this website, including:

  • Information about your browser, network and device

  • Web pages you visited prior to coming to this website

  • Web pages you view while on this website

  • Your IP address

Squarespace needs the data to run this website, and to protect and improve its platform and services. You can read more about how Squarespace uses your data (site usage information of end users) for its own purposes in their Privacy Policy.

16. Third Party Information and Links

The therapist does not take any responsibility or have any control about the information contained in websites or information linked from this site. Please consult the privacy and information storage policies for the sites that you access.