Privacy Policy Notice & Cookies Notice

This document provides information about the personal information we process to provide our services in compliance with the General Data Protection Regulation (GDPR) and to meet the legitimate interests of our service.

This privacy notice applies to anyone who interacts with us about our service in any way and it describes how we handle this information, regardless of the way of contact (by email, by post,  through our website or websites where our service is advertised or by phone).


By consenting to this privacy notice you are giving us permission to process your personal data specifically for the purpose outlined in this document. Where we are asking you for sensitive personal data, we will always tell you why and how the information will be used. You can withdraw consent at any time by using the postal or email address provided at the end of this Privacy Notice.

 

Introduction

Spiral Psychology Ltd (the “data controller” referred to below as we’, ‘us’ or ‘our’) a limited liability partnership incorporated in England (registered number 12182670) whose registered office is at the above address. It is registered with the Information Commissioner’s Office, registration number ZA547890.  It provides clinical psychology services.

We are committed to protecting your privacy when dealing with your personal information. In this privacy notice you will find details about the information we collect about you, how we use and protect this information. It also provides information about your rights. For any queries about the way we handle your information, please contact Dr Venetia Leonidaki, Director, at venetia@spiralpsychology.co.uk

 

This policy only applies to data collected by the director, who may also be the treating clinician, associate therapists, and administrators, and voluntarily via our own forms and website. Our associate therapists working under the umbrella of Spiral Psychology act as their own Data Controllers, and thus work within Spiral Psychology Privacy Policy but may have their own note taking facilities and data securing measures around this. Third party agents, and websites which are linked to ours, are not covered by this policy.

 

What information we collect

We collect information that may include personal information such as:

  • First name or given name
  • Family name or surname
  • Address
  • Telephone numbers
  • Email address
  • Date of birth
  • Next of kin
  • Health insurance details (if applicable)

 

We collect information about you when you are registered with us or place any order for services through websites where our services are advertised. The privacy policy of specific websites will also be applicable in this case. We collect information when you voluntarily complete contact/registration forms. If applicable, we may also collect information from your insurance company, if you have one, provided you have granted us consent towards this purpose.

We also collect administrative data regarding your utilisation of Spiral Psychology Services (e.g dates of appointments, payments etc)

 

Sensitive personal data is collected when you are seen for clinical assessment/therapy, which may include information about:

 

  • current personal, social, medical and financial circumstances
  • ethnic origin, data concerning a natural person’s sex life, sexual orientation
  • background and family history
  • psychiatric and forensic history
  • medical history

Your treating clinician verbally collects this information voluntarily by yourself in your consultation appointments or via questionnaires handed over to you. Your treating clinician may also collect this information from professional reports/referrals/your insurer or your General Practitioner provided consent has been granted towards this purpose. The privacy policy of other practices will also be applicable in this case.

 

If you are partnering with us, sensitive personal information collected may include:

 

  • professional background, qualifications, experience, professional memberships, indemnity insurance, ICO certificate, and DBS.

 

What we use information for

Our legitimate interest is to promote psychological assessment/therapy, supervision, and consultation services, to manage our relationship with our clients/partners, and to keep our records up to date to fulfil our administrative, legal and contractual obligations.

If you are a partner or subcontractor, we will also have a contract with you, which will be our lawful reason to process your data.

What information we share

Spiral Psychology will not routinely pass your personal information to third parties, with the exception of your health insurer (if applicable). If your Health insurer is covering the cost of your appointments/assessments, we may need to share with them some personal information, for example name, date of birth, policy number, diagnosis and treatment plan. The information shared differs from one insurer to the other.

 

Spiral Psychology will keep your personal information safe and secure. In many circumstances we will not disclose personal data without consent.
  • Spiral Psychology may share information with caregivers or professionals involved in your care or others whom you have requested or agreed we should contact.
  • If you are aged 16 or over, you are able to consent to the sharing/not sharing of personal information. If you are under 16 you also often able to provide/withhold consent, where you are deemed to be competent to make this decision to share information, however we would generally also seek the consent of your parents/caregivers

There are however some situations in which the treating clinician may need to break confidentiality to provide information to third parties. This can happen in the following situations:

  • Serious harm – Spiral Psychology may share information with the relevant authorities, professionals, if we have reason to believe that this may prevent serious harm being caused to you or another person.
  • Compliance with law – Spiral Psychology may share information where we are required to by law or by the regulations and other rules to which we are subject.

If you are a young person, we may think it is beneficial to you to share information with a parent/caregiver, but you may decline this consent, and we would respect this unless we were seriously concerned about your safety or we thought that you are not in a position to make such a decision (capacity).

For data storage purposes, personal information kept for administrative purposes may be handled by administrative personnel who are not directly involved in your clinical care. Therapy notes will be typically handled by the treating clinician only.

Finally, your treating clinician may need to share your data anonymously with another colleague for the purpose of supervision. This will be done anonymously, and you will not be personally identifiable. The supervisor would also be compliant with GDPR and only ‘need to know’ information would be shared, for the purposes of advice and consultation and to ensure you are receiving optimal treatment.

How we keep information safe and for how long

Electronically held personal information are stored in electronic folders operated by G-suite. They are only to be accessed from password-protected devices and by authorised personnel at Spiral Psychology. This information includes registration forms, invoices, appointment bookings, payments, emails received at admin@spiralpsychology.co.uk, and audit of initial queries.

Electronically held sensitive personal information (referrals, reports, questionnaires) are kept in a separate folder, which can only be accessed by the treating clinician.

Registration information received through websites where our service is advertised is partly covered by their policy.

Any incoming communication containing sensitive data, including post or email or clients physically handing over documents, is uploaded electronically to our folders before being deleted/shredded. Our emails are hosted by G-mail.

Outcoming communication is mainly electronic and takes place via our email system. For outcoming communication that includes sensitive information (e.g. sending you a report), attached documents are protected via password and password is then sent to you in a separate email. No sensitive information is included in the body of the email. If sensitive information needs to be sent via royal mail, registered delivery is being used.

Our electronic records are regularly backed up and stored on a password-protected, and encrypted laptop/folder. The encryption programme used is Vera Crypt.

For the purpose of video meetings, Microsoft team or Skype business or Skype platforms are being used.

Paper-based therapy records are kept by your treating clinician and separately from any personal identifiable information. We keep minimal content notes which we hold for 7 years. They are stored in a locked robust filling cabinet housed in a secure room accessible only to the treating clinician and/or are uploaded to an electronic folder. After the 7-year period expires, we are disposed of these documents securely.

Paper-based process notes are used for the purpose of formulation, reflection and supervision and are pseudonymised and destroyed every 6 months. Formulation documents may be added in patient’s/client’s therapy records.

We take care to store your personal information as securely as possible. In the unlikely event of a data breach incident, you will be informed ‘without undue delay’ and  the ICO will be informed within 72 hours.

Cookies notice

At Spiral Psychology we use the following four Google Analytical performance cookies:

-utma This enables us to ascertain the number of unique visitors to our site and is updated with each page view. The cookie remains in existence for a period of 2 years either from initial creation or a subsequent update.
-utmb This cookie is used to establish and continue a user session on our site. Each time a user visits a different page this cookie updates for a further 30 minute period. The cookie then remains in existence for a further 30 minutes, either from initial creation or a subsequent update.
-utmc This cookie operates in conjunction with the -utmb cookie to determine whether or not to establish a new session for the user. The cookie remains in existence until you have closed your browser.
-utmz This cookie stores the type of referral used by the visitor to reach your site, whether via a direct method, a referring link, a website search, or a campaign such as an ad or an email link. It is used to calculate search engine traffic, ad campaigns and page navigation within your own site. The cookie is updated with each page view and expires 6 months from initial creation or a subsequent update.

For more information about the cookies used by Google Analytics:
https://developers.google.com/analytics/resources/concepts/gaConceptsCookies

Managing Cookies

Most web browsers will allow some management of cookies via your browser settings. For further information about managing cookies, please visit www.aboutcookies.org.

For further information about cookies, please visit
www.allaboutcookies.org

 

Your rights

 

You have the following rights in accordance with GDPR (certain exceptions apply):

 

  • Right of access: you have the right to request a copy of the information that we hold about you.
  • Right to rectification: you have the right to have inaccurate factual information about you corrected or removed
  • Right to erasure: in certain circumstances you have the right to ask to have certain personal information about you erased from our records.
  • Right to restriction of processing: the right to request that your personal information is only used for restricted purposes
  • Right to object: you have the right to object to certain types of processing such as direct marketing.
  • Right to data portability: the right to ask for your personal information be transferred to another organization
  • Right to withdraw consent:  the right to withdraw any consent you have previously given us.
  • Right in relation to automated decisions:  you also have the right not to be subject to the legal effects of automated processing or profiling.

 

Please note that your rights are not absolute: they do not always apply in all cases and we will let you know in our correspondence with you how we will be able to comply with your request.

 

Access to your personal data

If you make a request, we will ask you to confirm your identity if we need to, and to provide information that helps us to understand your request better. If we do not meet your request, we will explain why. Please see below how to contacts us, if you wish to make a request to access information, we hold about you.

 

Queries or complaints

Please contact us if you have any questions about our privacy policy, about the information we hold about you, or if you wish to make a complaint:

 

 

  • Post – 4 Old Park Lane, W1K 1QW

If they are not satisfied with the response you receive, you are encouraged to raise your complaint with the Information Commissioner’s Office (ICO).

https://ico.org.uk/concerns/ Telephone: +44 (0) 303 123 1113

 

If you wish to raise a complaint for the clinical care that you receive by your treating clinician, then you can contact the Health Care Professions Council.

https://www.hcpc-uk.org/complaints/raiseaconcern/howto/

Changes to our privacy policy

We keep our privacy policy under regular review and we will inform you about any updates via our web page.