General Data Protection Regulation Policy
Updated: September 2020
1. Data Flow:
- Personal Data held includes:
- Names
- Dates of Birth
- Addresses
- Relevant medical history, pertinent to need
- Parents / carers / guardians details for contact
- Information is provided by:
- Parents, carers, guardians
- Schools, through consent agreements with parents, carers, guardians
- Individuals under our care
- Care organisations responsible for commissioning services, within their consent agreements
- Funding organisations (e.g. ASF, Education, Social Care etc)
- This information is shared with:
- Back to the commissioners (and information providers requesting assessment / intervention)
- Other health professionals or organisations involved in the individual’s care, ONLY with documented consent of parent, carer, guardian (e.g. Schools, SALTs, Physios, Paediatricians, CAMHS, GP etc).
- The lawful basis for processing this information is:
- The individual / carer/ parents / guardians (or those with approved consent and involved of the care of the individual) has given clear consent for us to process their personal data for the specific purpose of health assessment and intervention.
- The processing is necessary as part of contract to deliver health assessment and interventions.
- The processing is necessary to comply with ethics and guidelines in keeping with professional regulatory body with respect to providing best and accurate healthcare provision.
- The processing is legitimate and at an appropriate level to provide accurate and effective identifiable healthcare provision.
- Personal data is maintained in formats appropriate to need:
- Written documentation stored in line with ico and hcpc guidelines.
- Electronic data is stored with appropriate firewall, and security, with direct acknowledgement and consent of individual / carer / parent / guardian.
- Written documentation / reports (where hard copies) are distributed as above, and maintained until the individual is 19 years old, or where that is less than 7 years, for 7 years, within secure premises and locked filing cabinets.
- Documentation is transported with professionals working with children’s choice therapy service ltd to provide reliable information for on-going interventions within community settings, relevant to current intervention.
- Safe and appropriate storage and use of personal data is the responsibility of each professional as processors and Alison Hart as controller within Children’s Choice Therapy Service Ltd.
2. Rights for Individuals:
- Children’s Choice Therapy Service Ltd recognises the rights for individuals to be:
- Informed of use and retention of personal data and specific personal data.
- Able to access personal data held about them, through appropriate requests.
- Able to request rectification where personal data is incorrect.
- Able to request that personal information is removed where personal information is no longer required, or held within the rights of the professional to maintain legal documents of therapy reports.
- Confident that information will not be shared without consent.
- That data is held and moved around only within need of the health professional and in line with health directed guidelines.
- Discussed in terms of information sharing for best interests of the individual, and to be aware of all acts of profiling.
3. Children’s Choice Therapy Service Ltd information provided:
- Children’s Choice Therapy Service will provide the following privacy information:
- The name and contact details of our organisation
- The name and contact details of the company director
- The purposes for processing information
- The lawful basis for processing information
- The rights available to individuals in respect of the processing
- The right to withdraw consent (where assessment or interventions have not commenced)
- When is privacy information provided:
- At point of consent, within contract of consent
- At request at any point from anyone making enquiries about the organisation
- At point of commissioning contracts
4. Information Audits (Data Protection Impact Assessments – DPIAs):
- Information audits will be completed every 2 years to ensure all data held is:
- Maintained with CCT GDPR guidelines
- Necessary information relevant to health related needs andprovision ofassessment,interventionsandrequiredprofessionalworking
- Deleted and destroyed after the individual’s 19th birthday or where this is less than 7 years; 7 years from intervention completion.
- Clearly identified with who provided the personal data.
5. Information Risks:
- Any therapist recognising any breach of confidential information will immediately report this to the DPO.
- In the case of a personal data breach, data controllers shall, without undue delay, and within 72 hours of becoming aware of any breach, notify the relevant supervisory authority where risk for the rights and freedoms of individuals is felt to be potentiallyimpacted.
6. Deletion of data:
- Data will be erased if the data is no longer necessary for the purpose in which is was originally collected, or is no longer valid in maintaining ethical involvement of healthcare.
- Where an individual withdraws consent to hold data, specific personal data can be removed, where it is no longer valid in maintaining ethical involvement of healthcare.
- All data will be deleted where there is identification of unlawful processing of data.
- Data will not be deleted that impacts the best interest, health and welfare of a child (see data flow).
- Children’s Choice Therapy Service Ltd is committed to ensuring safe holding and deleting of data in line with the GDPR policy, technology and ico recommendations.
7. Web browsing and cookies:
- A cookie is a small file that we send to a third person’s computer or other device that is accessing our website, that we can then access again when they re-visits the site. By sending cookies like this we are able to offer an improved user experience. Most browsers will give the individual the opportunity to disable these cookies (for more information see AboutCookies.org).
- We currently use Google Analytics to monitor and analyse how our site is working,andnumberofvisitorstooursite.Googlesprivacypolicyisavailable at www.google.com/privacypolicy.html
- By completing the contact details on the website the individual is sharing personal data (name, contact number, postcode) with the recipient:
8. General Data Protection Regulation Compliance:
- Children’s choice therapy service ltd and its Staff agree to undertake the performance of the Services with due care and skill and in line with governing and professional bodies’ best practices.
- Unless otherwise agreed in writing, children’s choice therapy service ltd shall not provide any information to any third party.
- Children’s choice therapy service ltd warrants it will use its reasonable commercial efforts to comply with any statutory rules or regulations essential for the completion of any contract.
- Children’s choice therapy service ltd and its Staff are committed to confidentiality and will store personal data in line with the requirements of the Data Protection Legislation (GDPR).
- Children’s choice therapy service ltd will take appropriate measures to ensure that all data is processed securely in line with the requirements of the Data Protection Legislation (GDPR).
- Where Children’s Choice therapy staff are data processes within other organisation’s contracts, they hold responsibility to comply with all related GDPR regulation agreed in contract.
If you have any queries regarding this policy, or document, or concerns for the protection of your data, or data shared within contracts with children’s choice therapy service ltd please do not hesitate to contact us.