Privacy Policy

---

Underpinning Code of Conduct:

I abide by the ethical frameworks of the following organisations of which I am a member: the British Psychological Society, the British Association for Behavioural and Cognitive Psychotherapies, the British Association for Counselling and Psychotherapy, and the Health and Care Professions Council. 

Data Protection and Record Keeping:

I process your data in line with the General Data Protection Regulation 2018 and professional practice guidelines. As such, I am a ‘data controller’ and registered with the Information Commissioner’s Office.

I will obtain your consent to use email and/or SMS to correspond with you; I will only do so via devices that are password and/or biometrically protected and will never include any sensitive information in such messages. My client notes are only contained within ISO27001 certified practice management software, which runs on 256 bit SSL encryption and uses two-factor authentification. 

In accordance with good practice guidelines, I have set up a ‘clinical will’, which is a formal document setting out how clients can be contacted and informed in the event of my death or incapacitation. In such an eventuality, the clinical trustees I have appointed will take responsibility for contacting and informing my clients of this fact. They will not have access to clinical records other than the names, email addresses and phone numbers of my clients. These trustees are professionally registered counsellors/psychotherapists and any such contacts by them will take place within the limits of client confidentiality accordingly. 

I do not transport paper material with identifying information. I take steps to ensure that no one else can access your personal data without your specific consent. In the unlikely event of a data breach, I will report this to you and to the Information Commissioner's Office within 72 hours.

You are able to request copies of the data I hold about you. I will respond within 30 calendar days. There is no charge for this.

After your therapy has ended, I will retain your data for seven years, in line with professional practice guidelines. At that point, they will be destroyed/erased, to include all electronic communications. In certain circumstances, you may wish to have your personal data permanently erased sooner than this. This is known as the right to be forgotten.

To allow me to process your personal data in the above described ways, I will need a clear and specific statement of consent from you.

Dr Annie Stubley.