Introduction
Your privacy is very important to me and you can be confident that your personal information will be kept safe and secure. It will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This privacy notice tells you what I will do with your personal information from the point of initial contact through to after your therapy has ended.
I am happy to chat through any questions you might have about my data protection policy and you can contact me here.
‘Data Controller’ is the term used to describe the person that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me, Lavine Ellington.
I am registered with the Information Commissioner’s Office and my registration number is C1532713.
My lawful basis for holding and using your personal information.
The GDPR states that I must have a lawful basis for processing your personal data.
There are different lawful bases depending on the stage at which I am processing your data. I have explained these below:
If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information.
If you are currently having therapy or if you are in contact with me to consider therapy, I will process your personal data where it is necessary for the performance of our contract.
What data do I keep and why do I need it?
I collect, store and process personal information about you to enable me to run my counselling/psychotherapy practice and deliver the services you are employing me for. This information can include contact information, as well as information about your age, health (mental and physical), sexuality (where relevant to the therapeutic work), domestic and financial arrangements (where relevant) and other special category data. I collect this information upon the legal basis of “Contract”, as per GDPR regulations. This data will be collected when you contact me to enquire about my services. Alternatively, your GP or other health professional may send me your details when making a referral OR a parent or trusted individual may give me your details when making an enquiry on your behalf.
Will I share your data and if I do who will I share it with and for what purpose?
Please rest assured that everything you discuss with me is confidential and it is unlikely that I will share your data. I will not sell it on, share it with a third party or use it for unethical reasons. However, I may have to share it if I am required to do so by law (such as Acts of Terrorism, human/drug trafficking, money laundering) or if my notes are subpoenaed by the courts. Also, if you or anyone you tell me about is being harmed or is at risk of harm, I may have to pass this information on to my supervisor, your GP or police. I would always endeavour to discuss this with you prior to taking any action unless there are safeguarding issues that prevent this.
How will I store your data?
Your identifiable data is kept in a password protected file. Your anonymised session and assessment notes are kept separately in an online password protected file within my password protected OneDrive. Your phone numbers will be kept in my business mobile phone which is passcode protected. Emails are held in my business account which is operated, and password protected by Roundcube WebMail. Emails will be deleted after 24 hours if they are not important. If necessary, I will transfer the salient information into your session notes.
If you contact me via the contact form on my website, this information is contained in a separate folder on my website account page, which is password protected and only accessible by me. My website is powered by WebHealer and I do not allow WebHealer to use your identifying information for their purposes. I do, however, use Google analytics (through Webhealer) to monitor my website’s visitor patterns but this does not use your identifying information. I use legitimate interests as my lawful basis for holding and using your personal information in this way when you visit my website.
I do not retain text messages for more than 24 hours. If there is relevant information contained in a text message, I will transfer that to your session notes or identifiable data as appropriate for longer term storage.
Online Counselling:
Where online counselling is agreed, this will be offered via MS Teams. It is advised that you to check the terms and conditions to ensure that you are in agreement with their data privacy and usage policies. I attach the link below:
MS Teams: Microsoft Teams Privacy - Microsoft Teams | Microsoft Learn
Your rights
I try to be as open as I can be in terms of giving people access to their personal information. You have a right to ask me to delete your personal information, to limit how I use your personal information, or to stop processing your personal information. You also have a right to ask for a copy of any information that I hold about you and to object to the use of your personal data in some circumstances. You can read more about your rights at For the public | ICO.
If I do hold information about you I will:
You can also ask me at any time to correct any mistakes there may be in the personal information I hold about you.
To make a request for any personal information I may hold about you, please put the request in writing and address it to: Ellington Counselling at info@ellingtoncounselling.com.
How long will I store your data for and how will I dispose of it?
If you have had therapy with me, I’ll keep your session records and any documentation containing your personal data (including this statement, the assessment and working agreement) for 5 years which is the time frame requested by my insurance company. After 5 years all documentation will be disposed of confidentially and securely. I will delete your phone number out of my mobile phone around one calendar month after our work finishes and emails will also be deleted around one calendar month after our work has come to an end. If you would like me to delete your information sooner, please let me know.
Complaints
If you have any complaint about how I handle your data, please do not hesitate to get in touch by writing or emailing via the contact details above. I always welcome suggestions for improvement.
If you wish to make a formal complaint, you can contact the ICO at Information Commissioner's Office (ICO) or phone them on 0303 123 1113.
Consent
If you do not consent to me using your data in this way it is unlikely that I am able to work with you. Do you consent to me using your data in this way?
Please write yes or no:
Printed name: ____________
Signature: ____________
Date: ____________