Privacy Notice
How I Use, Share and Protect Your Personal Information
This Privacy Notice tells you what to expect in relation to the personal information that I collect, handle and process about you. It details why this data is collected, who it is shared with and how it is stored.
Organisation Name
Nicola Rivers, Child and Adolescent Psychotherapist
I am the Data Processor and Data Controller. I do not have any employees or associates.
ICO Registration Reference
A8992481
Types of data collected.
Personal and Sensitive Personal Data
Personal data is any information that can identify you as an individual, such as contact details, address, date of birth. It does not include anonymised data.
Sensitive Personal Data includes information about your physical and mental health, personal history, beliefs, feelings, culture, etc.
How this information is collected.
Personal data is collected via the ‘Referral Form’ and any other forms I may provide for your completion. You may also have provided me with some personal data via completing the inquiry form on my website, email contact from you, or verbal communication via the telephone. Further personal details shared verbally by you/ your child in sessions may be recorded in clinical notes. Sometimes information of this kind is also communicated to me by third parties, usually other professionals such as your GP, school, or social care.
Sensitive personal data is gathered in sessions and recorded in the clinical notes. You might also have shared reports, assessments, or letters written by other professionals. This includes psychological, psychiatric, or pediatric reports and information communicated to me by other third-party professionals involved with your family.
The purpose for which the data is collected.
Your data is collected to support the provision of Child and Adolescent Psychotherapy treatment; this is the only purpose for which your personal and sensitive data is collected.
Psychotherapy treatment inevitably involves sharing with me your/your child's sensitive personal information, including personal and medical history, as this is integral to the work of therapy. It also provides a framework for understanding some of the difficulties that might have led you to seek help.
Clinical notes are kept after each session as a record of attendance and treatment progress. These notes will include sensitive personal information, e.g., family history, thoughts, feelings, and beliefs you/your child have shared with me. These notes and your/your child's information remain confidential and are not shared except under the circumstances detailed in the 'Sharing Information' section of this Privacy Notice.
What information do I hold and why.
Contact details for you and your child and relevant medical information are required as a condition of the treatment. This is so an assessment and treatment can be provided effectively, e.g., so I can contact you regarding appointment times, invoicing, etc., and so that I am aware of any medical diagnoses that may inform my assessment or medical conditions that might require an urgent response. Any information that I hold about you must be up to date, so please notify me of any changes to the details that you have provided as soon as possible.
Data Security
Personal and sensitive information is stored digitally using either password-protected or encrypted software and equipment. I will encrypt any reports or correspondence sent by me via email. I ask that you do not share sensitive personal information with me via email (unless encrypted or password protected and that you do so at your own risk) or text message to ensure your privacy. Paper notes are kept securely locked at all times when not in use.
Sharing Information – When, With Whom & Why
If I work with you or your child following assessment, I will share your/your child's name, address, and telephone contact details with two clinical trustees. Sensitive personal information is not shared. I follow this process as it is a requirement for membership of the Association of Child Psychotherapists (ACP) that all clinicians who work in private practice appoint two colleagues to act as clinical trustees who keep a list of their current cases and commitments. This is so in the event of unexpected illness, sudden death, or incapacitation of the therapist, a colleague will contact clients and make appropriate arrangements.
It is a condition of treatment that parents/carers of children in ongoing therapy inform their GP when treatment begins and ends. I will only contact your GP directly in circumstances where you have requested this or where I believe there is an immediate and urgent risk to your child's health and well-being. In a situation where further help is required to ensure your child's safety, I will follow safeguarding procedures. If I need to contact other professionals, I will always endeavour to discuss with you first where permitted. Any information shared is limited to a strictly 'need to know' basis.
I am legally obliged to share your data with third parties where this is necessary if summoned by law or for an individual's safety; this includes safeguarding concerns, criminal investigations by the police, and court purposes.
Sometimes there will be other professionals involved with your family, and I might need to liaise with them to work as a team to support your child. This might include social workers, school staff, doctors, nurses, or CAMHS clinicians (list not exhaustive). It may also include the police or legal representatives. Any information shared will be on a ‘need to know' basis and discussed with you beforehand, unless exceptional circumstances prohibit this. Any reports that I am asked for concerning your child's contact with me will be shared with you where appropriate and is likely to include sensitive personal information.
Any professionals with whom information is shared will also be subject to General Data Protection Regulation (GDPR) regulations and have a duty of confidentiality.
In the event of unpaid fees, I may also have to provide your basic contact details and the amount owed to debt collection agencies.
ACP membership requires that all therapists attend regular clinical supervision of their work. Sensitive information is shared with the supervisor, and other information might include your work role and organisation, but other than this, no personal information is shared. Case material in supervision will be anonymised.
How Long is Information Kept For?
I only retain your/your child’s personal data for as long as necessary to fulfill the purposes I collected it for, including satisfying legal, accounting, or reporting requirements. This means I retain data for seven years after the therapy has ended. At the end of this period, all notes and records will be destroyed securely.
Your Rights
The GDPR gives you specific rights in relation to the data I hold about you. These include:
Your/your child's right to request to see your/your child's personal data. Please note, as confidentiality is central to the therapeutic process, any requests will require detailed consideration, which will include:
1) why the request is being made.
2) whether this is in your/your child's best interests.
3) consideration will be given to the possible implications for treatment.
To make a request, please submit this in writing to me at This email address is being protected from spambots. You need JavaScript enabled to view it. I will respond within one month of receiving your request and can extend this time limit by two further months under certain circumstances. If I am unable to grant access, I will provide you with the reasons why in writing. You may complain to the Information Commissioner's Office (ICO), who will review the decision:
https://ico.org.uk/make-a-complaint/
You have the right to request that your personal data is amended if you think it is inaccurate or incomplete.
You have the right to ask me to restrict the processing of your personal information in certain circumstances.
You have the right to request to have your personal data deleted and no longer processed where the data is no longer needed for the purposes for which it was collected. This is usually possible unless there is a legal requirement for me to retain the data.
There is usually no fee related to the request to access, revise, correct or delete your data in line with GDPR. To make a request, please submit this in writing to me at This email address is being protected from spambots. You need JavaScript enabled to view it.
More information about your rights is available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
How to Complain
If you have any concerns about any aspect of how I collect and use your data, please let me know so that I can try and resolve this.
You can also complain to the Information Commissioner's Office (ICO) if you think I have not complied with data protection laws. The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: www.ico.org.uk
My ICO reference number is A8992481