PRIVACY NOTICE
The General Data Protection Regulation (GDPR), came into effect on 25th May 2018 and provides a legal framework for ensuring the safety of personal information by organisations. The framework insists that organisations within the European Union (EU) have effective systems in place for handling and storing personal information. It also stipulates that people cannot be contacted by organisations without having given permission to share information. The following privacy notice outlines how Dr Gavin Farrell manages your data and your rights in relation to this. Dr Farrell is the Data Protection Officer (DPO) for the business.
Personal Information held by Dr Farrell and Why
Dr Farrell collects personal information provided by you or a referrer, e.g., insurance company/solicitor appropriate to the service you are accessing, e.g., therapy or supervision. Such information includes, for example, your name, date of birth, contact details (phone numbers, email and address), GP details, your place of work, and where relevant, previous reports generated in relation to accidents or injuries sustained. This information is held so that contact can be made with you to arrange appointments for
relevant services, but also to be able to access support systems for you should you require this over the course of your treatment with Dr Farrell. Information is also held to be able to communicate with you regarding payments (for self-referring clients), e.g., invoicing.
Personal information is held with a view to providing you with a safe, effective and
professional service. If you are browsing Dr Farrell’s Facebook and Linkedin pages, when you engage with this media your information will be stored in the form of cookies. You can opt out of this from the website when the pop up appears. To change your privacy preferences please do this directly on these platforms.
Written notes made during therapy and supervision sessions are stored in a locked filing cabinet. Where electronic communications are made, emails and texts are also stored. Your first name and the first letter of your surname will be held in Dr Farrell’s phone contacts for the duration of your therapy/supervision. At the end of therapy/supervision Dr Farrell will remove your contact from his phone and have only written contact information in the filing cabinet or electronic information on his laptop and backup system.
Keeping information accurate and up to date
It is your responsibility to ensure that Dr Farrell is made aware of any relevant changes to your personal information that he requires to be able to provide you with an effective service.
Sharing of Information
Often referring agencies require reports across the duration of assessment and therapy. Dr Farrell uses the information you share within sessions to provide referrers with a brief summary of assessment and treatment outcomes, e.g., progress made in relation to goals. Dr Farrell does not divulge sensitive information shared in sessions with referring agencies or other third parties unless he is concerned about the risk of harm to yourself or others. Where Dr Farrell is concerned about risks, he will endeavour to discuss this with you and seek your consent to share the information. However, there may be some instances where he has pressing concerns about safety to yourself or others and at such times it may not be appropriate to seek your consent before sharing with appropriate agencies, e.g., GP, police, other relevant professionals. Dr Farrell prioritizes keeping people safe at all times. If information is shared without your consent, Dr Farrell will discuss this with you and his reasons why as soon as is practically possible. Reports are shared with referrers electronically, and sent either via secure email systems, or documents are password protected and the password is provided in a separate email. Different referring agencies have different requirements for sharing of reports. If you wish to see the content of reports prior to Dr Farrell sharing them, please ask. Dr Farrell considers information shared with him by you to be your information and is happy to discuss his clinical notes with you at any time. Dr Farrell does not accept referrals from outside of the UK so all sharing of information is within the UK.
How long is data held for and where?
The British Psychological Society require Dr Farrell to keep clinical records for 7 years after the end of your contact/treatment for adults. Written notes are stored securely. Electronic information is password protected where possible. Emails and texts are kept on a laptop and smartphones, all of which are password protected (passcodes of fingerprint access). IT systems are regularly backed up with appropriate secure and encrypted systems.
Notes relating to on-going court cases are kept until the case is concluded or for up to 7 years after if concluded before that time. After the 7 year deadline and where any court cases are resolved, paper notes are destroyed in line with GDPR regulations, and all electronic information is deleted. The practice guardian will ensure that this is adhered to in the event that Dr Farrell is unable to oversee this. He keeps electronic invoices for seven years as this is the required length to comply with the HMRC requirements.
How to Request Access to your Data
You are able to request access to your notes by putting your request in writing or making a verbal request to Dr Farrell using the contact details for the business. You will be provided with your information within 40 days. You are able to check records for accuracy, and request correction or deletion of your information. Dr Farrell recommends that if you request to see your notes, that you go through them with him so that any concerns or queries can be addressed there and then. You can request that Dr Farrell transfer your data to another business. You can also request that your information be deleted or destroyed before the 7/25 year expiration date. Dr Farrell will discuss each request with you and relevant parties, e.g., referring agencies. Dr Farrell will seek advice from his professional governing bodies, e.g. The Association of Clinical Psychologists (ACP), The Health Care and Professions Council (HCPC) and the Information Commission Office (ICO) on a case-by-case basis at the time of the request. If Dr Farrell is aware of any breach of personal data security, he will contact you as soon as possible to discuss this. Where appropriate, Dr Farrell will advise the ICO. Dr Farrell is registered with the ICO. If you wish to complain to the ICO about Dr Farrell’s GDPR compliance, you can contact them directly. The ICO website is ico.org.uk.
What if my information is incorrect or I wish to be removed from his system?
Please contact Dr Farrell. He may require additional verification that you are who you say you are to process this request. If you wish to have your information corrected, you must provide him with the correct data and after he has corrected the data in his systems, he will send you a copy of the updated information in the same format at the subject access request in section 7.
How can I have my information removed?
If you want to have your data removed you can make this request in writing. Dr Farrell will have to determine if he needs to keep the data, for example, in case HMRC wish to inspect his records. If he decides that he should delete the data, he will do so without undue delay.
Will Dr Farrell send emails and text messages to you?
As part of providing his service to you, Dr Farrell will send information to you via email. He needs to send details of your appointments to you as a reminder and any relevant access links such as zoom links.
