Privacy Policy for Inclusive Place
1. Introduction Welcome to inclusive.place. This privacy notice provides information on how Phillip Lupton, functioning as a BACP-registered Gestalt therapist at Therapy Rooms Enfield, collects and processes your personal data when you visit this website or engage in counselling services.
As a professional therapy service, we are committed to protecting your privacy and ensuring your personal information is handled securely, sensitively, and in strict accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The Data We Collect About You To provide effective and safe therapy, we collect and process several categories of personal data:
- Identity Data: First name, last name, and date of birth.
- Contact Data: Email address, telephone number, residential address, and emergency contact details.
- Medical & Safeguarding Data: Contact details for your General Practitioner (GP).
- Special Category Data: Health information, psychological history, presenting issues, and brief, factual clinical session notes.
- Financial Data: Payment and billing information processed securely via direct debit.
- Technical Data: Internet protocol (IP) address, browser type, and basic analytics data collected when you use our website.
3. How Your Data is Collected
- Direct Interactions: You provide most of your data directly by filling out intake forms, communicating via email or phone, and participating in therapy sessions.
- Third-Party Services: We receive booking and scheduling information via our room management system, Skedda, and payment confirmation details via our payment processor, GoCardless.
- Automated Technologies: As you interact with inclusive.place, we may automatically collect technical data about your equipment and browsing actions using standard website cookies.
4. Lawful Basis for Processing Your Data Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following grounds:
- Contract: Processing is necessary to fulfill our therapeutic agreement and provide you with counselling services.
- Legitimate Interests: For running the practice efficiently, including scheduling, billing, and maintaining secure records.
- Special Category Data (Health Information): We process your sensitive health data on the basis of the provision of health or social care (Article 9(2)(h) of the UK GDPR) and with your explicit consent.
5. How We Share Your Data Your information is kept strictly confidential within the therapy practice. We do not sell or share your data for marketing purposes. Data is only shared in the following specific circumstances:
- Clinical Supervision: In accordance with BACP ethical frameworks, cases are discussed with a qualified clinical supervisor to ensure best practice. All client identities are completely anonymized during these consultations.
- Service Providers: We utilize secure, compliant third-party processors to manage the practice, including Skedda (for room bookings) and GoCardless (for processing direct debit payments).
- Clinical Will / Emergency Trustee: In the event of sudden severe illness, incapacity, or death, a trusted and qualified clinical colleague (appointed as a Clinical Executor) will be granted secure access to client contact details solely to inform you and offer alternative support options.
- Legal & Safeguarding Exceptions: Confidentiality may be broken if we are legally required to do so by a UK court of law, or if there is a substantial, immediate risk of serious harm to yourself or to others (including child or vulnerable adult safeguarding concerns). Whenever possible, we will attempt to discuss this with you before breaking confidentiality.
6. Data Security and Storage We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. All digital clinical notes and personal details are stored on password-protected, encrypted devices, and any physical records are kept in locked, secure storage.
7. Data Retention We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.
- Clinical Records: In line with standard professional indemnity insurance and BACP guidelines, clinical notes and therapy records are securely retained for exactly 7 years after your final therapy session. After this period, all data is securely destroyed or permanently deleted.
- Website Data: Temporary technical cookies expire as soon as your browsing session ends, while basic analytical cookies may last up to one year.
8. Your Legal Rights Under data protection laws, you have rights relating to your personal data, including the right to:
- Request access to your personal data (a “Subject Access Request”).
- Request correction of the personal data that we hold about you.
- Request erasure of your personal data (note: this may be superseded by our legal obligation to retain clinical records for 7 years).
- Object to processing or request restriction of processing.
- Request the transfer of your personal data.
- Withdraw consent at any time where we are relying on consent to process your data.
9. Contact Details and Complaints If you have any questions about this privacy policy or wish to exercise your legal rights, please discuss this during a session or contact the practice directly via the contact methods provided on the website.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.