Centre for Psychological Therapies Privacy Statement

If you become a client at the Centre, the information you provide will be used by the University of Edinburgh Centre for Psychological Therapies to deliver a confidential therapy service. 

Data about you and your treatment here will also be used by our clinicians to improve our service. Some of your data may be shared, in an anonymous form, with researchers conducting research on healthcare and mental health. 

This privacy statement covers the information the Centre collects and processes. It does not cover data collected and processed when you use our website, engage with us on social media or via email, or when you make a donation. 

Privacy notices covering this information can be found here and here. 

More information can be found on our data protection website.

What data do we collect and why?

We collect data directly from you that helps us deliver a safe, confidential and effective therapy service. This includes your name, address, GP Practice, where you have previously received support, and the issues you are currently experiencing. We also collect ongoing data about your therapy, in the form of treatment notes and session recordings. 

We receive personal data about you from the following sources: 

• Initial enquiry form
• Initial appointment information
• Treatment notes and recordings 
• Register of attendance at sessions
• Consent forms

Some of the data we collect from you is also used to improve and develop our service, and for research into mental health, and mental health treatments. The data used for service evaluation and research is anonymised: individuals cannot be identified from this information. 

We also collect data created by others. When researchers use the Centre for research, they are required to return the results underpinning their research to us at the end of their project. These results are then made available for other researchers to access.

Our Legal Basis for collecting and processing data 

We rely on a number of legal bases to use your personal information. A brief explanation of these, and where they apply, is below: 

Article 6 (1) (a), Consent – on specific occasions we will only process certain data with your consent; e.g., when you attend for an assessment appointment, we ask you to complete an evaluation form. 

Article 6 (1) (b), necessary for the performance of our Therapeutic Contract – we will process your data to enable us to meet our commitments to you in providing a confidential counselling service. 

Article 6 (1) (c), when processing is necessary for the Legitimate interest of the University over the interests of the data subject (e.g., when we record concern expressed about a client by a third party). 

We only share your information:

• At your request
• If there is a clinical or legal obligation to do so 
• If we believe you or a third party is in serious danger, we may share information with other University staff or appropriate services, e.g your General Practitioner, NHS services, or Police Scotland
• In an anonymous form (so you cannot be identified) with bona fide researchers conducting research for the public good
• If it is necessary for student assessment. Information in this case is removed of direct-identifiers.

Your data and research 

Routine patient data is a valuable resource, helping researchers improve services like ours, and make mental health treatments more effective. At The Centre for Psychological Therapies, we anonymise some of the data we collect from patients so it can be used by researchers. 

Researchers will not have access to your personal information, and they cannot identify you from the information we share with them. 

Routine patient data includes: gender; age; number of sessions attended; and questionnaire scores. 

Researchers won’t know what you talk to your therapist about; they do not have access to your treatment notes and recordings of your sessions.

To access this data, researchers have to show us their research is high-quality, and will benefit those with mental health challenges. We only give researchers access to the data they need to answer their research questions.

If you do not want your anonymous data to be included in our research database, you can opt out using the Information Form. 

The University of Edinburgh has an overarching privacy statement for participants in research projects, which can be found here. 

How do we store your information?

We keep your personal data securely stored and retained for 7 years for adults, and until the age of 25, or 26 if they were 17 at the time of the last service provision, for young people. This practice follows guidelines from the British Psychological Society (BPS) and the American Psychological Association (APA). Therapy session recordings, used for training and supervision, are securely stored and deleted at the end of the students’ 2-year placement.

Anonymous data collected and generated for research purposes will be kept for as long as there is a legitimate interest in doing so. 

Personal information relating to you and your therapy is kept on our secure, client database. Access to this database is limited to those involved in your therapy, and members of the Operational Team who book your appointments. 

Anonymised information that will be used for research is kept in a separate database, away from the client database. Approved researchers can apply to us for access to this database; they tell us what data they need for their research, and we prepare it for them. They do not have access to the entire database. 

If you have any questions about anything in this Privacy Notice, please contact Joanne Hendry or Dr Rachel Happer at CPT@ed.ac.uk

You can contact our Data Protection Officer at dpo@ed.ac.uk. Our data protection policy is on our website here.