Client GDPR Policy

General

This policy has been produced to explain what data Catherine may collect from clients and how it is used and stored. It helps Catherine comply with the General Data Protection Regulation (GDPR).

How long will you hold my information for?

Catherine is a member of the AfSFH and the NCH, and is bound by their regulations on how long client information is held. These organisations require that client data is held for eight years after your final session. The rule for children is different: their data must be held until their 25th birthday. The exception is young people whose treatment ends when they are 17, whose records must be kept until their 26th birthday. Client records are destroyed in the January after the dates given above. This is in line with NHS regulations for holding data.

What if I would like my data to be destroyed before this date?

Catherine is professionally obliged to keep certain data, in particular session notes and any communication relating to how you work with her. You can request that these be anonymised, and that all identifying information be removed from her systems. In that case, the identifying items are removed and the documents stored using coded filenames. Requests for deletion and anonymisation can be sent to Catherine by email (catherine@chdhypnotherapy.co.uk). There is no charge for this service.

Am I able to see or get a copy of the information held?

In line with GDPR, if you send Catherine a request in writing, specifying the data you wish to see, she will supply you with a copy of your data within 30 days. Catherine will need to confirm your identity before sending the information. There is no charge for this service. Please note that Catherine's insurance company's legal team may wish to verify any information Catherine sends out.

What data is collected, and why?

Catherine is keen to offer the highest quality support, and to do so she will collect the following:

• An idea of what you would like to achieve by coming for hypnotherapy
• A small amount of medical information
• Some brief session notes
• Your contact details
• Your GP's contact details
• Some basic information about your important others

This information allows Catherine to provide continuity within the sessions and to refer back to the content of earlier sessions and previous discussions, to help you towards your goal. Catherine will only use your contact details and your GP's details with your explicit consent (there is one exception to this, please see below).

How do I know that my information is stored safely?

Notes: Session notes are taken either on an electronic tablet secured by a PIN and/or face or fingerprint recognition, or in paper format locked in a filing cabinet stored behind a locked door. Initial consultation notes and any other sensitive data are stored as a PDF in a secure electronic folder protected by PIN and/or facial or fingerprint recognition, or in paper format locked in a filing cabinet behind a locked door.

Text messages: Catherine's mobile phone is face-recognition and PIN protected.

Emails: Catherine's email account is protected by a strong password.

Are our discussions within the sessions confidential?

Everything you discuss with Catherine during your sessions remains strictly confidential. Occasionally it may be necessary for Catherine to discuss elements of your sessions with her supervisor, to ensure she is helping you in the most effective way. No identifying features about you are disclosed during these discussions. Catherine's supervisor is also registered with the ICO and abides by GDPR requirements.

What if I see Catherine outside of a session?

Catherine is obliged to protect your confidentiality at all times. For this reason, although she may acknowledge you, it would be ideal if any further conversation relating to therapy could be avoided. However, if you wish to discuss your therapy with other people, that is entirely your choice and you are very welcome to do so.

Will you discuss information about me with other health and social care professionals?

Catherine is only able to contact other health and social care professionals with your written consent. Should she write to your GP, to notify them that you have entered into a therapeutic relationship with her, or that your therapy has successfully concluded, she would require your consent, in line with GDPR requirements. Exceptions apply, please see below.

When might confidentiality have to be broken?

Catherine has a duty of care towards her clients. If she has reason to believe that you were about to harm yourself, or others, she may be professionally obliged to break confidentiality and inform the relevant authorities. Catherine would always aim to discuss this with you before taking any action. Legally, Catherine would also have to provide the police with information as set out in a warrant or court order, should the situation arise.

Who is the Data Controller?

The Data Controller is Catherine Hartle-Driver.

This policy was last updated in November 2024. It may be updated at any time, so please check back regularly to ensure you are aware of the latest version.