- Who am I
I, Dr Oonagh Duffy at Glasgow Clinical Psychologist deliver independent psychological therapy and counselling to children, adolescents and adults in clinic rooms, outside of the therapy room during behavioural experiments, or occasionally in the home of clients. Glasgow Clinical Psychologist is owned and directed by me, Dr Oonagh Duffy. I am registered with the Health and Care Professions Council (HCPC).
- Data Control
I, Dr Oonagh Duffy am the data controller for Glasgow Clinical Psychologist and I am registered with the Information Commissioner's office (ref ZA450208) which can be searched for at: www.ico.org.uk.
- The lawful basis for processing personal data
I have a legitimate interest in using the personal data and sensitive personal data collected to provide health treatment; it is a requirement of my regulatory body, the Health and Care Professions Council. This ensures best practice care is achieved for my clients and is necessary for me to provide psychological therapy to clients. No information you provide is passed on without your consent. I will never sell your information to others.
- What information do I collect about you?
When you/your child are/is a patient or client of mine, I record all your/your child's treatment and details of your/their appointment so that I can plan your/your child's treatment correctly. Your/your child's health record is kept confidential within Glasgow Clinical Psychologist at all times and is only shared when it's necessary for the safety and wellbeing of you/ your child.
I collect information about you/your child that may include personal or sensitive information, such as:
Personal data: basic contact information: name, address, date of birth, gender, email, contact telephone number, and GP contact details.
Sensitive personal data: Signed Therapy Client Agreement, therapy records (therapist notes, letters, reports and/or outcome measures).
Medical Insurance data: If you/your child are referred by a health insurance provider, then I will also collect and process personal data provided by that organisation. This includes basic contact information, referral information, and health insurance policy number and authorisation for psychological treatment.
- What I do with your personal information
I take your/your child's privacy seriously. I will only use your personal information to provide the services you have requested from me. If you do not provide the personal information requested, then I may be unable to provide a therapy service to you. I use the information collected to provide services to you/your child, and process payment for such services.
- How do I store the information about you?
I am committed to taking reasonable steps to protect any individual identifying information that you/your child provide/s. Once I receive your/your child's data, I make best efforts to ensure its security on my systems. All personal information provided is stored in compliance with EU General Data Protection Regulations (GDPR) rules.
- How long I store personal information?
I will only store your personal information for as long as it is required. Basic contact information held on my mobile phone is deleted within 6 months of the end of therapy. The sensitive personal data defined above is stored for a period of 7 years after the end of therapy. As children gain legal capacity when they turn 18 years old, I am required to keep their notes until they are 25 or 26 years of age (The Limitation Act, 1980). After this time, this data is deleted at the end of each calendar year.
- Who I might share personal information with
I hold information about each of my clients and the therapy they receive in confidence. This means that I will not normally share your/your child's personal information with anyone else. However, there are exceptions to this when there may be need for liaison with other parties. For example, if you/your child are/is referred by a health insurance provider, or otherwise claiming through a health insurance policy to fund therapy, then I will share appointment schedules with that organisation for the purposes of billing. I may also share information with that organisation to provide treatment updates. If you would like me to share information about your/your child's treatment with outside organisations that are directly involved in your/your child's care/case, for instance, your GP or psychiatrist, or your child's school, I will require your written consent. I will tell you with whom I would discuss your/your child's care, and what details I would share with them. In exceptional circumstances, I might need to share personal information with relevant authorities, for example, when there is need-to-know information for another health provider, such as your GP, or when disclosure is in the public interest, to prevent a miscarriage of justice or where there is a legal duty, for example a Court Order. I would also need to share information when there are concerns of risk of harm to the client, or risk of harm to another adult or a child. I will discuss such a proposed disclosure with you unless I believe that to do so could increase the level of risk to you or to someone else.
- Your Rights
Data protection legislation gives you/ the parent, various rights. The most important of these are as follows:
- You have the right to a copy of information I hold about you/ your child.
- You have the right to ask for your/ your child's record to be amended if you believe that it is wrong.
- How you can access your information and correct it, if necessary.
I try to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if I hold any personal information by making a 'subject access request' or 'Right of Access' under the Data Protection Act and the General Data Protection Regulation. I will usually share this with you within 30 days of receiving a request. You have a right to get your personal information corrected if it is inaccurate. To make a request to Glasgow Clinical Psychologist for any personal information I may hold you need to put the request in writing. I may request further evidence from you to check your identity.
- Complaints or queries
I try to meet the highest standards when collecting and using personal information. For this reason, I take any complaints I receive about this very seriously. I encourage clients to bring it to my attention if they think that the collection or use of information is unfair, misleading or inappropriate. I would also welcome any suggestions for improving my procedures. If you believe that I am not processing your personal data in accordance with the law you have the right to raise your complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/concerns/ or Telephone: +44 (0) 303 123 1113