Information Governance Policy and Procedures
What are the lawful basis for processing data at hello?
In relation to communicating with clients: The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
Processing is necessary for your legitimate interests as specified in Article 9 of the GDPR;
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
This means that hello does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
hello processes personal information to enable the provision of counselling, to advertise services and to maintain accounts and records.
Type/classes of information processed
hello processes information relevant to the above reasons/purposes. This information may include:
family, lifestyle and social circumstances
goods and services
employment and education details
hello also processes sensitive classes of information that may include:
physical or mental health details
racial or ethnic origin
religious or other beliefs of a similar nature
offences and alleged offences
hello processes personal information about:
Third Party Services
All personal and sensitive data held by hello is held securely. Client data is held securely in a locked cabinet behind a locked door.
In the case of a data breach hello shall comply with the regulations set out under Article 33 of the GDPR stated below;
1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
6. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
7. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.
Subject Access Request
A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after eight years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, Hello will:
give you a description of it;
tell you why we are holding it;
tell you who it could be disclosed to; and
let you have a copy of the information in an intelligible form.
SAR requests should be put in writing to hello. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. hello may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to hello.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made. In some instances insurance company’s may require us to lawfully hold your files until the end of their retention period.
hello hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Hello would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Hello.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by hello you can contact hello directly. In the event that hello cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.
What is the General Data Protection Regulations, 2018 (GDPR)?
The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information your can read the policy documents accessible via your welcome information pack.
How long will you hold my information for?
We will hold your data for 5 years after your final session. Therefore, all records will be deleted in the January after the above retention scale.
What if I don’t want my records to be held for that long?
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. We would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance companies legal team may want to verify information I process.
Why do you need to record this information?
We collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring we are equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent.
Low detailed analytics are used on the hello website to monitor traffic coming to the site. There is no risk of identification via this reporting tool.
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – any mobile phones used are secured with a pin code.
Emails – Email is encrypted and requires a user name and password.
Is what we discuss kept confidential?
Everything we talk about during our sessions are strictly confidential between you and me. However, there are limits to confidentiality (see below section on Exceptions to confidentiality.) We may discuss aspects of our sessions within Supervisor sessions as a required method of development and safety for all therapists. This is to ensure we are working with people in a supported and safe way. During these discussions there is no discloser of details that may identify you. Supervisors also adhere the GDPR.
Social Media Policy
We do not answer personal question or hold sessions online through social media. The hello social media platforms are created as a base for directing clients to our website where the protection and security of our ethos, services and contact methods are present. We discourage commenting and therefore remove the commenting aspect of our social platforms. If you would like to get in touch, please contact us via the hello website or direct email.
What about other Health and Social Care Professionals?
As we adhere to the GDPR any contact relating to you with other health care professionals would only be made with your signed consent. For example writing to a GP to notify them of your treatment.
Exceptions to confidentiality
If you give me reason to believe that you intend to seriously harm yourself I may wish to inform someone.
There are some things which I must pass on to others, for example, if it seems likely that you represent a danger to others, if I am told about knowledge of terrorism or terrorist activity, or if I am told about a child (person under the age of 18), or vulnerable adult, that has been harmed or may be at risk.