Information about you: how we use it and with whom we share it If you become a client at the Centre, the information you provide will be used by the University of Edinburgh Centre for Psychological Therapies to deliver a confidential therapy service. More information can be found on our data protection website. The information you provide will be used by us to: provide you with a therapy service offer and manage your appointments with us register your attendance at sessions record any donations that you make manage requests from you for information to be passed on to third parties, for example other health providers contact you to request anonymous feedback about your experience of our service comply with our legal obligations for financial purposes collate anonymised aggregate data for use in statistical research collate anonymised aggregate data for statistical purposes for service improvement A record of your donations is processed to comply with our legal requirements. All sessions both online and in person at CPT are recorded for training and assessment purposes. These sessions are stored securely and deleted two years after the completion of therapy. If, after concluding your sessions at the Centre for Psychological Therapies, you consent to potentially being contacted by a researcher, we will use your data to contact you to ask if you wish to participate in a research request. Gift Aid declaration data is processed under Income Tax Act 2007. Purpose for processing: We use the information you provide to record your contact with us and keep a summary record of information shared by you, by session, in order to provide an ethical therapeutic service. If, prior to being offered an appointment, you decide to withdraw the personal data will not be retained. Where do we get your personal data from? We receive personal data about you from the following sources: Initial Enquiry Form Initial email Initial appointment information Treatment notes Register of attendance at sessions Consent forms We process this data to meet the legitimate interests of the Centre as a practice, training, and research centre. We will hold the personal data you provided us as below: Client notes, personal data, record of your donation, any letters will be retained for seven years from the date of your initial appointment. Recordings will be stored for two years following the end of therapy. Forms that you have signed to give your consent to be approached to participate in research are retained for one year. If we contact you to ask if you wish to participate in a research project your signed consent form is retained for five years Gift Aid declarations are retained by the University for six years after the end of the tax year of the last claim for which that declaration was used. Records of your financial donations are retained for six years plus one financial year from the date the donation was made. Legal Basis We keep the personal data you provide for five years after your last contact with our Service. There is more than one legal basis for the use of your information. The appropriate legal basis for each purpose of use is noted against each category in Uses of your data. A brief explanation of each legal basis is noted below: Article 6 (1) (a), Consent - on specific occasions we will only process certain data if you consent e.g. when you attend for an assessment appointment we ask you to complete an evaluation form. Article 6 (1) (b), necessary for the performance of our Therapeutic Contract - we will process your data to enable us to meet our commitments to you in providing a confidential counselling service. Article 6 (1) (c), when processing is necessary for the Legitimate interest of the University over the interests of the data subject (e.g. when we record concern expressed about a client by a third party). Information will only be shared: at your request if there is a clinical or legal obligation to do so if we believe you or a third party is in serious danger, we may share information with other University staff or other appropriate services e.g. your General Practitioner, NHS services, Police. If you have any questions, please contact Joanne Hendry or Dr Rachel Happer at CPT@ed.ac.uk Data sharing In addition to the primary purposes, we are also legally obliged to share certain data with other public bodies such as HMRC and will do so where the law requires this; we will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate. Data controller and contact details For data collected under this privacy notice, the University of Edinburgh (the “University”) is the Data Controller (as that term is defined in the EU General Data Protection Regulation (Regulation (EU) 2016/679), registered with the Information Commissioner’s Office, Registration Number Z6426984. You can contact our Data Protection Officer at dpo@ed.ac.uk. Our data protection policy is on our website here. Your rights You have the right to request access to, copies of and rectification or (in some cases) erasure of personal data held by the University and can request that we restrict processing or object to processing as well as (in some cases) the right to data portability (i.e. the right to ask us to put your data into a format that it can be transferred easily to a different organisation). If you wish to make use of one of these rights, please email your local contact. If we have asked for your consent in order to process your personal data you can withdraw this consent in whole or part at any time. To withdraw consent, please email your local contact, who will explain the consequences of doing so in any particular case and initiate proceedings for withdrawing consent. Complaints If you are unhappy with the way we have processed your personal data you have the right to complain to the Information Commissioner’s Office at casework@ico.org.uk but we ask that you raise the issue with our Data Protection Officer first.
