Privacy Notice

1. Data controller and contact details

Data controller

Rob Higgins / The Teaching Self

Contact

rob@theteachingself.co.uk | 07960 191 009

2. Information collected and where it comes from

Depending on the circumstances, I may collect:

• identity and contact details; GP and emergency-contact details; enquiry, referral and correspondence information;
• information relevant to therapy, including health, mental health, medication, relationship, risk and safeguarding information, and other sensitive information you choose to disclose;
• brief assessment and clinical notes; appointment, attendance, payment, invoice and complaint records.

Information usually comes directly from you. Where authorised or otherwise lawful, it may also come from a referrer, GP or other professional, emergency contact, authorised representative, family member or carer. You are not required to provide information simply to make an enquiry, but some information is necessary to assess suitability, enter into the therapy agreement and provide the service safely. Without it, I may be unable to offer or continue therapy.

3. How and why information is used

I use personal information only where necessary:

• to provide counselling or psychotherapy, maintain brief records, review the work and obtain confidential clinical supervision — on the bases of contract and legitimate interests;
• to manage appointments, fees, accounts and correspondence — on the bases of contract, legitimate interests and legal obligation where applicable;
• to respond to serious risk, safeguarding or emergencies — on the bases of recognised legitimate interests, vital interests and/or legal obligation where the relevant conditions are met;
• to handle complaints, insurance, regulation and legal claims — on the bases of legitimate interests, legal obligation and the establishment, exercise or defence of legal claims.

My legitimate interests are to operate a safe, ethical, secure and properly administered practice, maintain proportionate records, obtain supervision and protect legal rights. These interests are considered against your rights and the duty of confidentiality.

Therapy records include special category information. The principal condition is that processing is necessary for health or social care under Article 9(2)(h) UK GDPR and the Data Protection Act 2018, subject to professional confidentiality. Where relevant, the conditions for safeguarding, vital interests or legal claims may also apply. Consent may be used for a specific disclosure requested by you, but it is not the main basis for holding clinical records.

4. Confidentiality and sharing

Information is confidential and is shared only where necessary and proportionate. This may include a clinical supervisor (with identifying details minimised); a GP or other professional where you request or agree this; emergency services or safeguarding bodies where serious harm is at issue; and legal advisers, insurers, regulators, professional bodies or public authorities where required. Where practicable and appropriate, I will discuss a disclosure with you first.

5. Service providers and international transfers

I use carefully selected providers acting on my instructions: Cliniko (Red Guava Pty Ltd, Australia) for practice management, records, appointments, invoices and secure telehealth; Titan Solution Ltd SEZC (Cayman Islands) for email; and Lovable Labs Incorporated (United States) for website hosting, contact forms and limited technical website data.

These providers and their subprocessors may store or access information outside the UK. Restricted transfers are protected, as applicable, by UK adequacy regulations or safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required data protection test. Further information about applicable safeguards is available on request. Any non-essential website cookies or analytics will be used only where the required information and consent mechanism are provided.

6. Security and retention

Reasonable technical and organisational measures are used to protect information. Access is restricted; electronic records are password-protected and encrypted where appropriate; and any paper records are kept securely.

Clinical notes and associated administrative records are ordinarily retained for up to eight years after therapy ends. Enquiries that do not lead to therapy are normally deleted within six months. Records may be kept longer where required for a legal, safeguarding, insurance, regulatory or complaint-related reason. When no longer required, they are securely deleted or destroyed.

7. Your rights

Depending on the circumstances, you may have rights to be informed; access your information; have inaccurate information corrected; request erasure or restriction; object to processing; receive portable data; and withdraw consent where consent is relied upon. I do not use solely automated decision-making or profiling. Requests may be made by email or telephone and will normally be answered without undue delay and within one month. Further guidance is available from the Information Commissioner's Office.

8. Data protection complaints

Please send a data protection complaint to rob@theteachingself.co.uk or call 07960 191 009. I will acknowledge it within 30 days, make appropriate enquiries, keep you informed and explain the outcome without undue delay. You may also complain to the ICO: ico.org.uk/make-a-complaint or 0303 123 1113.