Please download the client contract form and return it to me before your appointment. Thank you
1. TERMS AND CONDITIONS (pdf)
DownloadInformation Governance Policies and Procedures
Section A
Introduction
Data held by 'Fiona Hepworth - Hypnotherapy' will be held lawfully and for the retention periods set out in section B of this policy document. 'Fiona Hepworth - Hypnotherapy' ('we', 'I' 'my' 'our') will not disclose users' information to third parties unless legally bound to do, for example there is an identified risk to the client and/or others. I will process your personal data for the purposes of maintaining my client list and contacting you in future. Data collected by this site is used to:
The term 'Fiona Hepworth - Hypnotherapy' or ‘us’ or ‘we’ refers to the owner of the website. The term ‘you’ refers to the user or viewer of our website.
If you would prefer that we cease to send you further information about 'Fiona Hepworth - Hypnotherapy' simply send an email or call or text us:
Email:contact@fionahepworth-hypnotherapy.com
This document refers to:
Aim and Purpose
The purpose of this document is to ensure that 'Fiona Hepworth - Hypnotherapy' has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.
Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. 'Fiona Hepworth - Hypnotherapy' is fully committed to ensuring clients privacy and data protection rights.
For the purpose of this policy Fiona Hepworth is the named Data Protection Officer/Controller and Head of Organisation.
Information Governance Framework Principals for Tree of Life Hypnotherapy
Section B
Privacy Notice: Use of information
In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisation’s website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
Please note that 'Fiona Hepworth - Hypnotherapy' does not use automated decision-making tools, including profiling.
Website visitors
When an individual visits www.FionaHepworth-Hypnotherapy.com, I use Google Analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google Analytics only collect non-identifiable data which means I or they cannot identify who is visiting. 'Fiona Hepworth - Hypnotherapy' will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.
Website hosting
The 'Fiona Hepworth - Hypnotherapy' website is hosted on a hosting service provided by GoDaddy, a third party provider. When you visit my site using a web browser, your browser typically sends some information to the server such as the date and time of your visit, the operating system you use, and your IP address, the page or resource you are requesting, and so on. The web servers hosting my website use this anonymised data to help monitor my site’s performance, bandwidth usage, track any errors, and so on. The hosting services provided by GoDaddy are compliant with the EU-US Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries and Switzerland. Details of the Privacy Shield Framework can be found herehttps://www.privacyshield.gov/
Use of cookies
When accessing our Website, we will learn certain information about you during your visit.
Similar to other commercial websites, our website utilises a standard technology called "cookies" and web server logs to collect information about how our website is used. Information gathered through cookies and web server logs may include the date and time of visits, the pages viewed, time spent at our website, and the websites visited just before and just after our web site, your IP address.
A cookie is a very small text document, which often includes an anonymous unique identifier. When you visit a website, that site's computer asks your computer for permission to store this file in a part of your hard drive specifically designated for cookies. Each website can send its own cookie to your browser if your browser's preferences allow it, but (to protect your privacy) your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other sites.
Analytical cookies
We also employ analytical cookies in order to provide meaningful reports about our site visitors. These cookies allow us to recognise and count the number of visitors and see how visitors move around the site. This information helps us to improve the way our website works. However, these cookies do not collect personal data about you.
Some of the following cookies may be used for analytical purposes:
__utma Google Analytics to monitor traffic levels, search queries and visits to this website
__utmb Google Analytics stores IP address anonymously on its servers and neither we nor Google associate your IP address with any personally identifiable information
__utmc Google Analytics to determine whether you are a return visitor to this site, and to track the pages that you visit during your session
__utmz Google Analytics stores the type of referral used by the visitor to reach this site
IP addresses
IP addresses are used by your computer every time you are connected to the Internet. Your IP address is a number that is used by computers on the network to identify your computer. IP addresses are automatically collected by our web server as part of demographic and profile data known as “traffic data” so that data (such as the web pages you request) can be sent to you.
Email information
If you choose to correspond with us through email, we may retain the content of your email messages together with your email address and our responses. We provide the same protections for these electronic communications that we employ in the maintenance of information received online, mail and telephone.
How do we use the information that you provide to us?
Broadly speaking, we use personal information for purposes of administering our business activities, providing customer service and making available other items and services to our customers and prospective customers.
We will not obtain personally-identifying information about you when you visit our site, unless you choose to provide such information to us, nor will such information be sold or otherwise transferred to unaffiliated third parties without the approval of the user at the time of collection.
We may use software programs to create summary statistics, which are used for such purposes as assessing the number of visitors to the different sections of our site, what information is of most and least interest, determining technical design specifications, and identifying system performance or problem areas.
For site security purposes and to ensure that this service remains available to all users, we use software programs to monitor network traffic to identify unauthorised attempts to upload or change information, or otherwise cause damage.
We may disclose information when legally compelled to do so, in other words, when we, in good faith, believe that the law requires it or for the protection of our legal rights.
A special note about children
Children are not eligible to use my web site and services and I ask that minors (under the age of 13) do not submit any personal information to me. If you are a minor, you can use this site only in conjunction with permission and guidance from your parents or guardians.
I have an up to date enhanced DBS certificate.
How do we protect your information and secure information transmissions?
Email is not recognised as a secure medium of communication. For this reason, we request that you do not send private information to us by email. However, doing so is allowed, but at your own risk. Some of the information you may enter on our website may be transmitted securely via a secure medium known as Secure Sockets Layer, or SSL.
Policy changes
We reserve the right to amend this privacy policy at any time with or without notice. However, please be assured that if the Privacy Policy changes in the future, we will not use the personal information you have submitted to us in a manner that is materially inconsistent with this Privacy Policy, without your prior consent.
We are committed to conducting our business in accordance with these principles in order to ensure that the confidentiality of personal information is protected and maintained.
Retention Schedule
Information Asset
Information Owner Asset
Retention
Trigger for Disposal
Email (including sent items)
Head of organisation
Annual review period every January, any remaining live data untouched until following review period.
End of retention period
Contact details held on mobile devices
Head of organisation
All entries to be deleted prior to decommissioning of mobile device or reissue of device
End of retention period
Recordings
Head of organisation
5 years or earlier if consent is withdrawn
End of retention period
Images taken
Head of organisation
5 years or earlier if consent is withdrawn
End of retention period
Promotional materials
Head of organisation
Until superseded – Consent to be rechecked prior to reissue
End of retention period
Paper Diaries
Head of organisation
3 months from the period in which its use ends.
End of retention period
Policies
Head of organisation
Until new policy has been put into place
End of retention period
Client records including session notes, initial consultation notes and client overview form
Head of organisation
In accordance with CNHC regulation, 8 years after final treatment session has ended. Child records should be held until after 25 th birthday, or 26 thbirthday if aged 17 when treatment ends.
End of retention period
Safeguarding records
Head of organisation
In accordance with the current organisations insurance policy, 5 years after final treatment session has ended, unless superseded by new insurance policy.
End of retention period
Sat Nav records
Head of organisation
All entries to be deleted prior to decommissioning of mobile device or reissue of device
End of retention period
Sum Up Card Payment Records
Head of organisation
HMRC requirements for retention of records of payments – 6 years
End of retention period
Waiting lists
Head of organisation
Annual review period every January, old waiting list destroyed and new waiting list developed with any remaining live data transferred to new live document.
End of retention period
Continual Professional Development Records
Head of organisation
To be retained when worker is in service and until 8 years afterwards.
End of retention period
Worker supervision records
Head of organisation and workers supervisor
To be retained when worker is in service and until 8 years afterwards.
End of retention period
Service evaluation records
Head of organisation
Transfer to anonymised data within 6 months of collection.
End of retention period
Tax returns
Head of organisation
6 years from the end of the financial period to which they pertain to.
End of retention period
Incident/Accident reports
Head of organisation
40 years from date report was closed
End of retention period
Insurance policies
Head of organisation
40 years from date policy ended.
End of retention period
Complaints
Head of organisation
8 years from complaint being resolved
End of retention period
Right to Erasure Request
Head of Organisation
8 years from request being submitted and completed.
End of retention period
Subject Access Request
Head of organisation
8 years alongside session notes, or plus 2 years from case closure if request is made after 6 years of storing data.
End of retention period
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
Data Processing
What are the lawful basis for processing data at 'Fiona Hepworth - Hypnotherapy'?
Consent in relation to communication: the individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
This means that 'Fiona Hepworth - Hypnotherapy'0011q does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
'Fiona Hepworth - Hypnotherapy'processes personal information to enable the provision of Psychotherapy and Hypnotherapy, to advertise services and to maintain accounts and records.
Type/classes of information processed
'Fiona Hepworth - Hypnotherapy' processes information relevant to the above reasons/purposes. This information may include:
'Fiona Hepworth - Hypnotherapy' also processes sensitive classes of information that may include:
'Fiona Hepworth - Hypnotherapy' processes personal information about:
Section C
Data Breach
All personal and sensitive data held by 'Fiona Hepworth - Hypnotherapy' is held securely. Electronic data stored on a computer is stored on a password protected computer, in password protected documents in iCloud. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked cabinet.
In the case of a data breach 'Fiona Hepworth - Hypnotherapy' shall comply with the regulations set out under Article 33 of the GDPR;
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Subject Access Request
A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, 'Fiona Hepworth - Hypnotherapy' will:
SAR requests should be put in writing to 'Fiona Hepworth - Hypnotherapy' A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to 'Fiona Hepworth - Hypnotherapy'.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made.
Complaints
'Fiona Hepworth - Hypnotherapy' hopes to meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore 'Fiona Hepworth - Hypnotherapy' would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Tree of Life Hypnotherapy.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by 'Fiona Hepworth - Hypnotherapy' you can contact Tree of Life Hypnotherapy directly. In the event that 'Fiona Hepworth - Hypnotherapy' cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.
Safeguarding your privacy
In the event of my death or sudden illness, my supervisor will contact existing clients and archive any client files in accordance with General Data Protection Regulations.
If you have any questions regarding this policy, or your dealings with our website, please contact us:
contact@fionahepworth-hypnotherapy.com
FAQs about the General Data Protection Regulations, 2018 (GDPR)
What are the General Data Protection Regulations, 2018 (GDPR) and how do they affect me?
The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information your can read the policy documents accessible via your welcome information pack.
How long will you hold my information for?
I am regulated by the CNHC, an organisation that stipulates I must hold your data for 8 years after your final session. Unless you are a child, in which case I must hold your data until your 25 th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
What if I don’t want my records to be held for that long?
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance companies legal team may want to verify information I send out.
Why do you need to record this information?
I collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent, and to which a consent form will be supplied and signed.
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about and all that takes place during our therapy sessions are strictly confidential. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR. All that takes place within the therapy sessions is treated with respect, discretion and strict confidentiality. Confidential notes to assist with future treatment are kept in secure files at all times.
What if I see you outside of the session?
If we see each other outside of a session I may smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.
What about other Health and Social Care Professionals?
As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your treatment with me, and then notify them of the treatment ending, I would only do this if you were to sign the specific consent available.
Exceptions:
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or required by a court of law for your information, then I would also have to provide them with your information.