At Hall-Payne Psychology, we are committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, and manage your personal data when you engage with our services. Our practices comply with the EU General Data Protection Regulation (GDPR) that came into effect on 25 May 2018.

By engaging with Hall-Payne Psychology, you consent to the following practices:

1. Why We Collect Your Personal Data

We collect information about you to:

• Identify and communicate with you in a personal and effective manner.
• Maintain session notes, which are essential for therapy. These notes help us understand how best to assist you and form the basis of any necessary reports.
• Perform administrative tasks related to our services, such as arranging appointments, raising invoices, and managing payments, whether self-funded or through health insurance.

2. What Personal Information We Collect

To provide you with therapy, we need to collect the following information:

• Your name.
• Your contact details, including postal address, telephone number(s), and email address.
• Your GP details.
• Your next of kin details.
• Your health insurance details (if applicable).
• A summary of the therapy session content.

3. How We Use the Information We Collect

• We use your contact details, such as your telephone number and email address, to communicate with you about your appointments.
• To write progress reports or raise invoices for your health insurance company, we use your session notes, name, membership number, and contact details.

4. Where We Keep the Information

• All therapy session notes recorded on paper and questionnaires are securely stored in a locked filing cabinet.
• Electronic therapy session notes stored on an iPad are labeled with your initials only and are password-protected.
• All electronic devices (e.g., iPad, laptop, and phone) used to access stored information are themselves password-protected.

5. How Long We Keep the Information

• We observe the British Psychological Society (BPS) Practice Guidelines for independent practitioners regarding the retention of your information. For adults, this means records are kept for 7 years after the end of therapy. For children, records are kept until the age of 26, following NHS guidance. This is subject to any overriding legal obligations.
• Electronic invoices are kept for 7 years to comply with HMRC requirements.

6. Who We Share Your Information With

• Confidentiality is maintained at all times, and your information is not shared without your consent unless there are exceptional circumstances such as risk to yourself or others. In such cases, we may contact your GP, social services, or the police without your consent, as required by professional obligations. However, we will inform you if we intend to break confidentiality.
• Reports may be sent to you, your insurance company, and anyone we are required by law to inform. All electronically sent reports are password-protected attachments.

7. How You Can Access Your Information

• You have the right to access the information we hold about you. A ‘subject access request’ (SAR) can be made for copies of your records, and there may be a £25 administration charge. These records will be provided within one calendar month of the request being made.

8. What Happens if Your Information is Incorrect

• If you believe any of your information is incorrect, you may request it to be corrected. Once we have updated your data, we will send you a copy of the updated information in the same format as the subject access request mentioned in section 7.

If you have any further questions about how we handle your data or wish to make a subject access request, please contact us through the details provided on our website.