What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?

The GDPR replaces the 1998 Data Protection Act to ensure that your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. The GDPR is there to protect your rights as a consumer of a service or product that might involve your identifiable data, for example, your name and address or your date of birth or gender. Particularly in respect of our counselling relationship, I may hold sensitive data, such as your counselling history, medication and other information you may be asked to disclose to me to support your counselling sessions. GDPR also covers any session records, text messages or emails we exchange.

How long will you hold my information for?

I am regulated by the British Association for Counselling and Psychotherapy (BACP). They recommend that I hold your data, for seven years after your final session, unless you are a child, in which case I hold your data until your 25th birthday. If you are 17 when treatment ends, I will retain your information until your 26th birthday. All records will be deleted in the 1st month after the applicable retention period has ended.

What if I don’t want my records to be held for that long?

Under GDPR you can make a request in writing to me, for all your records to be deleted and I will then do so, confirming in writing to you that your records have been deleted. All your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would only retain the request for deletion you made but would not save any other data.

Why do I need to record this information?

I collect information about you that supports your counselling, which includes, medical information, information about your important others, historical data, alongside session notes that I use to ensure continuity of counselling between sessions. The information is necessary for me to provide you the services we have agreed in our contract together, ensuring I am equipped with the knowledge of our previous discussions prior to each session. I retain your information, in line with the retention policy outlined above. Your contact details / address and Doctors details, will only be used with your explicit consent or if an emergency occurs.

What lengths are made to ensure your information is held securely?

Hardcopy documents – Are stored in a locked cabinet in a secure building.

Text messages – My phone is secured with a secure pin code.

Emails – My email account is secured by a user name and password.