Privacy Notice
I am committed to treating your personal information with care, respect and confidentiality. This Privacy Notice explains what information I collect, why I collect it, how it is used and stored, who it may be shared with, how long it is kept, and your rights in relation to your personal information.
Root & Rise Therapy is the data controller for the personal information processed in connection with my therapeutic practice.
Data Controller: Joanna Hassan, Root & Rise Therapy
Email: hello@rootandrisetherapy.uk
Website: www.rootandrisetherapy.uk
ICO Registration: ZB503431
I process personal information in accordance with UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, alongside my professional and ethical responsibilities as a registered member of the British Association for Counselling and Psychotherapy (BACP).
My intention is to be open about how your information is handled and to collect and use only the information that is necessary and proportionate for providing therapy and meeting my professional, legal and regulatory responsibilities.
1. What information I collect
To provide therapy safely and effectively, I collect and process only the personal information that is necessary and proportionate for our work together.
Depending on your circumstances and the nature of our work, this may include:
your name, date of birth, contact details and other basic identifying information
your GP and emergency contact details
relevant personal, health, relational or background information that you choose to share
·assessment information and, where appropriate, clinical outcome measures
·clinical records and therapy notes
information about appointments, attendance, cancellations and rescheduling
correspondence and communications relating to the administration or provision of your therapy
payment and transaction information where required for the administration of your therapy.
Where therapy has been arranged or referred by another person or organisation, I may receive limited information about you from that source, such as your name, contact details, referral information or information necessary to arrange or fund therapy. I will aim to make clear to you what information has been received and where it came from.
Because therapy may involve information about your physical or mental health and other aspects of your personal life, some of the information I process is considered special category data under UK data protection law and is given additional protection.
I do not sell your personal information or use information obtained through our therapeutic work for marketing purposes.
2. Why your information is stored and the lawful basis for doing so
I use your personal information only where this is necessary for the provision and administration of therapy, for maintaining appropriate professional records, and for meeting my legal, ethical and professional responsibilities.
This includes using information to:
respond to enquiries and arrange appointments
provide and manage your therapy
maintain appropriate clinical records
communicate with you about appointments and our work together
process payments and maintain appropriate financial records
support safe and ethical practice, including clinical supervision and safeguarding
respond appropriately to concerns, complaints, legal requirements or matters relating to professional accountability.
Under UK GDPR, the lawful bases I rely upon will depend on the purpose for which the information is being used. These may include:
Contract – where processing is necessary to provide the therapy service we have agreed
Legitimate interests – where processing is necessary for the safe, effective and professionally accountable operation of my therapeutic practice, including maintaining appropriate records, managing the practice and protecting the interests of clients and the practice, provided that these interests do not override your rights and interests.
Legal obligation – where I am required to process or retain information in order to comply with the law
Vital interests – in exceptional circumstances where processing is necessary to protect someone's life.
Special category information
Therapy involves information about health and may also involve other sensitive aspects of your personal life. This is known as special category data and receives additional protection under UK data protection law.
Where I process special category information for the provision of therapy and related professional care, I rely on the condition that processing is necessary for the provision of health or social care or treatment, in accordance with Article 9(2)(h) UK GDPR and the relevant provisions of the Data Protection Act 2018.
I am professionally bound to maintain confidentiality and only process information that is necessary and proportionate for the purposes for which it is required.
3. How your information is stored
I take appropriate steps to protect the confidentiality, integrity and security of the personal information I hold about you. Information may be held electronically and, where necessary, in paper form.
Clinical records
Clinical records are held securely within the electronic practice-management and clinical-record system used by Root & Rise Therapy.
These records may include assessment information, session notes, clinical measures, documents, communications and other information relevant to the safe and effective provision of therapy.
I use a client coding system within my clinical record-keeping arrangements to help minimise the unnecessary use of directly identifying information.
Identifying and contact information
Information that identifies you directly is limited to what is necessary for providing and administering your therapy and meeting my professional, legal and regulatory responsibilities.
Access to personal and clinical information is restricted and appropriate safeguards are used to protect it from unauthorised access, loss, alteration or disclosure.
Paper records
Where information needs to be held in paper form, it is stored securely with access restricted to authorised persons.
I aim to minimise the creation and retention of paper records where an appropriate secure electronic record is available.
4. How long your information is kept
I retain clinical records and the identifying information necessary to manage and retrieve those records for seven years from the end of our therapeutic work together.
This retention period supports professional accountability, continuity of records and the management of any concerns, complaints, legal or insurance matters that may arise following the end of therapy.
Information that does not need to form part of the clinical record, including routine administrative communications, will not be retained for longer than necessary. Where information contained within an email, message or other communication is clinically or professionally relevant, the relevant information may be incorporated into the clinical record and retained accordingly.
At the end of the applicable retention period, records will be reviewed and securely deleted or destroyed unless there is a clear legal, professional or other legitimate reason why particular information needs to be retained for longer.
Retention arrangements are reviewed periodically to ensure that personal information is not kept for longer than necessary.
5. Confidentiality
Everything you share with me in the course of therapy is treated as confidential. Protecting your privacy and the confidentiality of our work is a fundamental part of my professional and ethical responsibilities.
There are, however, limited circumstances in which information may need to be discussed or shared.
Clinical supervision
As part of safe and ethical professional practice, I discuss my clinical work in regular professional supervision. I minimise identifying information and ordinarily use client codes or other non-identifying information when discussing clinical work.
My supervisor is also professionally bound by confidentiality.
Risk, safeguarding and serious harm
There may be circumstances in which I need to share relevant information if I have serious concerns about your safety or wellbeing, the safety or wellbeing of another person, or where safeguarding responsibilities arise.
Any decision to share information will be considered carefully and only information that is necessary and proportionate to the circumstances will be disclosed.
Where it is safe and appropriate to do so, I will aim to discuss this with you before information is shared.
Legal or regulatory requirements
In some circumstances I may be required by law, court order or another binding legal requirement to disclose information.
There may also be circumstances in which disclosure is necessary in connection with safeguarding responsibilities, the prevention or detection of serious crime, or other legal or professional obligations.
Where I receive a request for information, I will consider the legal basis for the request and will not disclose information simply because it has been requested. Wherever possible and lawful, I will aim to discuss any necessary disclosure with you.
Professional continuity or unexpected incapacity
I maintain professional continuity arrangements, including a Clinical Will, for circumstances in which I become unexpectedly unable to practise or communicate with clients myself.
If these arrangements need to be activated, a designated professional may be given limited access to the information necessary to identify and contact current clients, manage immediate practice-continuity matters and support the secure handling of clinical records.
Access would be limited to what is necessary for those purposes and would remain subject to professional confidentiality and data-protection requirements.
Other disclosures
I will not ordinarily share your personal or clinical information with family members, employers, GPs or other professionals without your knowledge and appropriate authority.
Where you ask me to share information with another person or organisation, we will normally agree what information may be shared and for what purpose.
Third-party funded or referred therapy
Where your therapy is funded, commissioned or arranged by an employer, organisation or other third party, limited information may need to be shared with that organisation for agreed administrative purposes, such as confirming attendance, the number of sessions used or information necessary for invoicing.
The nature and extent of any information that may be shared will be made clear to you at the outset. Clinical information about the content of therapy will not ordinarily be shared with a funder or referring organisation without your knowledge and appropriate authority, unless there is a legal or safeguarding reason requiring disclosure.
6. Your rights
Under UK data protection law, you have a number of rights in relation to your personal information. Depending on the circumstances and the lawful basis on which your information is being processed, these may include the right to:
request access to the personal information I hold about you
ask for inaccurate or incomplete information to be corrected
request deletion of your personal information in certain circumstances
request restriction of the way your information is processed in certain circumstances
object to certain types of processing
request the transfer of information you have provided to another organisation, where the right to data portability applies
withdraw consent where consent is the lawful basis being relied upon for a particular use of your information.
Your right to object
Where I rely on legitimate interests as the lawful basis for processing your personal information, you have the right to object to that processing in certain circumstances. If you object, I will consider your circumstances and whether there are compelling legitimate grounds for the processing to continue.
Some of these rights are not absolute and may not apply in every circumstance. For example, there may be legal or professional reasons why particular information needs to be retained even where a request for deletion has been made.
If you wish to exercise any of your data-protection rights, please contact me at hello@rootandrisetherapy.uk.
I will respond to requests without undue delay and normally within one month, in accordance with UK data protection law. In certain circumstances this period may lawfully be extended, in which case I will explain this to you.
You also have the right to raise a concern with the Information Commissioner's Office (ICO) if you are unhappy with the way your personal information has been handled.
7. Digital systems, security and service providers
I take appropriate technical and organisational measures to protect personal and clinical information from unauthorised access, loss, alteration or disclosure.
These measures include the use of password-protected devices and accounts, two-factor authentication where available, access controls, secure electronic storage, encryption where appropriate, software and security updates, and secure methods for the disposal of information and records.
Practice-management and clinical records
Root & Rise Therapy uses Sessionly as a practice-management and electronic clinical-record system. For information held within Sessionly, Root & Rise Therapy remains the data controller and Sessionly acts as a data processor on my behalf.
Sessionly stores client records and clinical data in the United Kingdom. Its documented security measures include encryption of data in transit and at rest, additional encryption of directly identifying client information, access controls, audit logging, pseudonymisation measures and encrypted backups.
Other service providers
I also use carefully selected third-party service providers where necessary to support functions such as secure infrastructure, email communication and payment or practice administration.
Where these organisations process personal information on my behalf, appropriate data-protection arrangements are required. I aim to share or process only the information necessary for the particular service being provided.
Some service providers may process limited information outside the United Kingdom. Where personal information is transferred outside the United Kingdom, this will only take place where an appropriate lawful transfer mechanism is available, such as UK adequacy regulations or appropriate contractual safeguards under UK data-protection law. Further information about the safeguards applying to a particular transfer can be requested from me.
Email and electronic communication
Email and other electronic communications cannot be guaranteed to be completely secure. I therefore aim to minimise the amount of sensitive clinical information communicated through ordinary email or text messaging and use these primarily for appropriate administrative communication.
Email, text and other routine messaging services should not be used to seek urgent or emergency support.
8. Questions, concerns or complaints
If you have any questions about this Privacy Notice or about how your personal information is collected, used, stored or shared, you are welcome to contact me:
Joanna Hassan
Root & Rise Therapy
Email: hello@rootandrisetherapy.uk
If you have a concern about the way I have handled your personal information, I would welcome the opportunity to address this with you directly in the first instance.
You also have the right to raise a concern or make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.
Concerns relating to my professional practice as a therapist may be raised through the complaints process described in my Therapy Agreement and Complaints Policy. As a registered member of the British Association for Counselling and Psychotherapy (BACP), I am also accountable to its applicable professional and ethical standards.