Privacy Policy

Dr Marc Williams Privacy Policy V.3

This document explains how I (Dr Marc Williams) collect, use, store and protect personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It applies to people receiving private psychological therapy, brief therapeutic/support sessions (including sessions provided through the Climate Psychology Alliance), and professional supervision from me.

I am the data controller for the personal information described in this policy. This means that I am responsible for deciding why and how your personal information is processed.

You are the data subject.

1. Personal information I collect and process

I aim to collect only information that is necessary and relevant to providing the service you have requested. Depending on the nature of our work, I may process the following information:

Personal data

• name
• contact details, such as address, telephone number and email address
• date of birth or age, where relevant
• contact details for another person, such as an emergency contact, where these have been provided
• GP or other healthcare-provider details, where these are relevant and have been provided
• administrative and payment information relating to the service

Special category personal data

This may include:

• notes relating to therapeutic support, psychological therapy or supervision
• information about your mental and physical health that is relevant to our work
• psychological questionnaire or outcome-measure responses, where these are used
• information relating to risk, safety or safeguarding
• letters and reports
• information you provide in emails or other communications where this is relevant to the service
• other sensitive information that you choose to disclose and which is relevant to our work

I do not routinely collect every category listed above from every client. The information collected will depend upon what is reasonably necessary for the particular service being provided.

I usually collect information directly from you, including through initial enquiries, forms or questionnaires where these are used, and during our sessions. On occasion, and with an appropriate basis for doing so, I may also receive relevant information from another professional or third party.

2. Why and on what legal basis I process your information

I process personal information in order to provide the psychological, therapeutic-support or supervision service that you have requested, to communicate with you about that service, to maintain appropriate professional records, and to meet my professional and legal responsibilities.

For ordinary personal data, my principal lawful basis under Article 6 of the UK GDPR is that processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract (Article 6(1)(b)).

Where I process health information or other special category personal data in providing psychological or therapeutic services, I rely upon Article 9(2)(h) of the UK GDPR: processing necessary for the provision of health care or treatment. This is supported by the relevant provisions of the Data Protection Act 2018 and my professional duty of confidentiality as a registered health professional.

Different lawful bases may apply to particular processing where I am required to comply with a legal obligation or where information needs to be processed or disclosed in exceptional circumstances concerning safety, safeguarding or other legal requirements.

I do not normally rely on your consent as the legal basis for processing information that is necessary to provide and record psychological services. This is separate from your consent to take part in therapy, therapeutic support or supervision. You are free to stop taking part in the service at any time, although I may still need to retain some records in accordance with my professional and legal obligations.

I will never sell your information to others. I will not share your personal information with third parties for marketing purposes.

3. What I do with your personal information

I use your personal information only for purposes connected with providing and administering the service you have requested, maintaining appropriate clinical or professional records, communicating with you, managing safety and safeguarding where necessary, and meeting my professional, regulatory and legal obligations.

I aim to minimise the information I collect. I will not ask you to provide information simply because it is routinely collected in other healthcare settings if it is not reasonably necessary for our work.

If you do not provide information that is reasonably necessary for me to provide the service safely and appropriately, I may be unable to provide or continue providing that service.

4. How long I keep personal information

I keep personal information only for as long as there is an appropriate clinical, professional or legal reason to do so.

Clinical records relating to psychological therapy and therapeutic support are normally retained for seven years following the end of our work together. I periodically review my retention arrangements and may retain information for a different period where there is a specific legal, safeguarding or professional reason for doing so.

Supervision records are retained for an appropriate period having regard to the nature of the supervision, professional requirements and any contractual or legal obligations.

Basic contact information held solely for convenient communication, such as a telephone contact saved on a device or teleconferencing service, is normally deleted after our final session where there is no continuing reason to retain it.

When the relevant retention period has expired, records are securely deleted.

5. Confidentiality and sharing personal information

I treat information about clients and supervisees as confidential and will not normally disclose identifiable personal information to another person without an appropriate reason and, where applicable, your agreement.

There are, however, limited circumstances in which information may need to be disclosed.

These may include:

• where I have serious concerns about your safety or the safety of another person and disclosure is justified in order to reduce or respond to that risk;

• where there are safeguarding concerns relating to a child or an adult at risk;

• where disclosure is required by law, such as in response to an applicable court order or another legal obligation;

• where disclosure can otherwise be justified in the public interest, including in exceptional circumstances involving the prevention of serious harm or serious crime;

• where relevant information needs to be shared with another healthcare professional involved in your care. Ordinarily I would seek your agreement before doing this;

• if treatment has been instructed by a solicitor, where information is appropriately shared with legal representatives in accordance with the terms of the instruction, your authority and applicable legal requirements.

Wherever reasonably practicable, I will discuss a proposed disclosure with you beforehand. There may be exceptional circumstances in which it would be inappropriate or unsafe to do so, or in which urgent action is required.

If an urgent safety concern arises during remote work, I may ask you for information about your current physical location and/or appropriate people or services who could assist you.

In line with professional practice, I receive regular clinical supervision from appropriately qualified mental-health professionals. I may discuss my clinical work in supervision in order to maintain safe and effective practice. I minimise identifying information wherever practicable, and my supervisors are themselves bound by professional duties of confidentiality.

For payment of fees I prefer to use bank transfer. Banks and payment providers will therefore process the information required to complete those transactions under their own data-protection arrangements.

6. Security of personal information

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, disclosure or alteration.

I minimise personal information contained in routine phone and email communication where practicable. Particularly sensitive documents may be password protected or otherwise transmitted using an appropriately secure method.

I use password protection and appropriate account-security measures on services used to store or process confidential information, including multi-factor authentication where available and appropriate.

Any organisations providing technology, storage, email, videoconferencing or other services through which personal information is processed may act as data processors or independent controllers, depending upon the service and circumstances. I take reasonable steps to use services that provide appropriate data-protection and security safeguards.

Where personal information is transferred or processed outside the UK, I take appropriate steps to ensure that the transfer complies with UK data-protection requirements.

7. Remote sessions / teletherapy

I may use secure videoconferencing technology, such as Google Meet, for remote sessions.

I conduct sessions in a private setting and take reasonable steps to prevent conversations from being seen or overheard by others.

I ask you to take reasonable steps to ensure that you also have sufficient privacy for remote sessions and that the device and internet connection you use are appropriately secure.

Where clinically relevant, particularly if there are concerns about immediate safety, I may ask you to confirm where you are physically located during a remote session.

Remote therapeutic support is not an emergency or crisis service. If you require immediate assistance between sessions, you should contact an appropriate emergency, crisis or healthcare service rather than relying on email or other messages to me, which may not be seen immediately.

8. Where personal information is held

Personal information may be held within password-protected electronic systems that I use to provide and administer my professional services, including secure email and electronic file-storage systems.

Clinical and professional records are stored in password-protected electronic files with access restricted to me.

Where I use an online questionnaire or form to collect information, I will use an appropriately approved platform and will tell you about any additional information relevant to the processing of your data where necessary.

I periodically review the systems I use to ensure that they remain appropriate for handling the type of information involved.

9. Your data-protection rights

Under UK data-protection law you have a number of rights. Which rights apply can depend upon the nature of the information and the lawful basis upon which it is being processed.

You have the right to ask me for access to personal information that I hold about you. This is known as a subject access request.

I will respond without undue delay and normally within one month of receiving a valid request. In some circumstances the period may be extended in accordance with data-protection law.

I do not normally charge a fee for responding to a subject access request. A reasonable fee may be permitted in limited circumstances, such as where a request is manifestly unfounded or excessive or where additional copies are requested.

I may need to obtain reasonable evidence of your identity before disclosing information to you.

You may also have the right to:

• have inaccurate personal information corrected;
• have incomplete information completed;
• ask for processing to be restricted in certain circumstances;
• request erasure of personal information in certain circumstances;
• object to certain types of processing; and
• receive or transfer certain information in a portable format where the legal requirements for data portability apply.

These rights are not absolute. For example, I may be entitled or required to retain clinical records despite a request for deletion where there is an appropriate legal or professional basis for doing so.

If you make a request relating to your personal information, I will consider it in accordance with the UK GDPR and Data Protection Act 2018.

10. Questions or complaints about your information

If you have a question or concern about how I use your personal information, I encourage you to contact me in the first instance using the contact details through which we normally communicate.

I hope that we can resolve any query or concern about my use of personal information.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Information about making a complaint is available from the Information Commissioner’s Office at ico.org.uk.

11. Changes to this privacy policy

I may change this privacy policy from time to time to reflect changes to my practice, the services I use or relevant legal and professional requirements.

Where a change is material to the way I process information relating to an existing client or supervisee, I will take reasonable steps to inform them.

12. Agreement to the service and use of personal information

Before beginning therapy, therapeutic support or supervision, I will provide appropriate information about the nature of the service, confidentiality and how personal information is handled.

Your decision to engage in a service with me does not mean that I rely upon GDPR consent as the lawful basis for all processing of your personal information. Instead, personal information that is necessary to provide and administer the service is processed on the lawful bases described in section 2 above.

You remain free to decide whether to participate in or continue therapy, therapeutic support or supervision, subject to any separate contractual arrangements that apply.

Dr Marc Williams Clinical Psychologist