Privacy and Data Protection Notice

1. Who is responsible for personal information

Michele Watson is the data controller responsible for the personal information described in this notice.

Contact details:

Michele Watson
Maris Green
Great Shelford
Cambridge
CB22 5EG

Email: personcentred@gmail.com
Telephone: 07531 280695

ICO registration number: ZB285045

Questions about personal information or requests to exercise data-protection rights should be sent to the email above.

2. The information collected

The personal information collected will depend on whether a person is making an initial enquiry, receiving counselling privately or receiving counselling funded through private medical insurance.

The information collected may include:

• name;
• postal address;
• email address;
• telephone number;
• date of birth;
• age;
• preferred contact method;
• emergency contact information;
• GP or healthcare professional details;
• appointment dates and attendance information;
• correspondence and contact-form messages;
• information supplied during an initial enquiry;
• counselling assessment information;
• brief counselling or session notes;
• physical and mental health information;
• medication information where relevant;
• safeguarding information;
• payment and transaction records;
• invoices and receipts;
• private medical insurance details;
• insurance membership or policy number;
• policyholder name;
• claim or authorisation number;
• number of sessions authorised;
• policy excess information; and
• other information voluntarily provided by the client.

Information concerning a person’s physical or mental health is treated as particularly sensitive personal information.

Only information reasonably necessary to respond to an enquiry, provide counselling, maintain appropriate professional records, administer payment or insurance and meet professional or legal responsibilities will be collected.

3. How information is collected

Personal information may be collected:

• through the website contact form;
• by email;
• by telephone or text message;
• during an initial consultation;
• during counselling sessions;
• through a Counselling Agreement;
• through payment records;
• from a private medical insurer;
• from a GP or other healthcare professional where the client has authorised this;
• from a parent or person with parental responsibility where appropriate;
• from an emergency contact nominated by the client; or
• from another person where disclosure is lawful and necessary for safeguarding or safety.

Where information is obtained from someone other than the client, Michele will explain this to the client where it is appropriate, lawful and safe to do so.

4. Why information is used

Personal information may be used to:

• respond to enquiries;
• decide whether counselling can appropriately be offered;
• arrange and manage appointments;
• provide counselling;
• communicate with clients;
• maintain accurate and appropriate professional records;
• monitor the progress and suitability of counselling;
• manage payments, invoices and accounting;
• confirm private medical insurance eligibility and authorisation;
• submit authorised insurance claims;
• manage cancellations and missed appointments;
• respond to concerns or complaints;
• protect the client or another person from serious harm;
• meet safeguarding responsibilities;
• comply with legal and professional obligations;
• establish, exercise or defend legal claims;
• protect the security and operation of the website; and
• improve the administration of the counselling service.

Personal information will not be used for purposes that are incompatible with those described in this notice unless the client is informed and there is a lawful basis for doing so.

5. Lawful basis for using information

Personal information will only be used where there is a lawful basis under UK data-protection law.

Depending on the circumstances, the lawful bases may include:

Taking steps before or performing a contract

Information may be used to respond to an enquiry, arrange counselling, provide agreed counselling services, manage appointments and administer payment.

Legal obligation

Information may be used where this is necessary to comply with a legal or regulatory obligation.

Legitimate interests

Information may be used where this is reasonably necessary to operate a professional counselling practice, respond to enquiries, maintain appropriate records, administer the service and protect legal rights.

These interests will be balanced against the individual’s rights, interests and reasonable expectations.

Vital interests

Information may be used where this is necessary to protect someone’s life and the person concerned is not capable of providing consent.

Consent

Consent may be requested where a client asks Michele to share information with a GP, healthcare professional, family member, insurer or another nominated person.

Where processing is based on consent, the client may withdraw that consent. Withdrawal will not affect processing that was lawful before consent was withdrawn.

6. Medical and other sensitive information

Information concerning physical health, mental health and counselling is special-category personal data and receives additional protection.

This information will only be used where an appropriate condition under UK data-protection law applies. Depending on the circumstances, this may include:

• the provision and management of health or social care;
• explicit consent;
• protecting vital interests;
• safeguarding a child or an adult at risk;
• establishing, exercising or defending legal claims; or
• another condition permitted by law.

Medical and counselling information will not normally be shared without the client’s knowledge and consent.

A client may ask Michele to share relevant information with:

• their GP;
• another healthcare professional;
• their private medical insurer;
• a family member;
• an advocate; or
• another person nominated by the client.

Medical or counselling information may be disclosed without the client’s consent where disclosure is required by law, ordered by a court, necessary to respond to an immediate or serious risk of harm, or necessary to safeguard a child or an adult at risk.

Where it is lawful and safe to do so, Michele will normally discuss a proposed disclosure with the client before information is shared.

Only the minimum information reasonably necessary for the particular purpose will be disclosed.

7. Private medical insurance

Michele is registered as a private healthcare provider with Bupa, Aviva Health and AXA Health. Counselling may also be funded through another private medical insurer where agreed in advance.

Where counselling is funded through private medical insurance, relevant information may be collected and used to:

• confirm the client’s identity;
• confirm insurance eligibility;
• confirm the policyholder;
• obtain or verify authorisation;
• confirm the number of sessions covered;
• submit claims;
• confirm attendance and treatment dates;
• administer policy excesses;
• respond to payment queries; and
• obtain authorisation for further sessions.

Relevant administrative information may be shared with the insurer where necessary to administer the client’s authorised treatment and payment.

Clinical or medical information will only be provided to an insurer where:

• the client has requested or consented to the disclosure;
• the information is required under the client’s insurance arrangements;
• the disclosure is necessary and lawful; and
• the client has been informed where appropriate.

A client may decline to consent to clinical information being provided to an insurer. However, the insurer may then decline to authorise or continue funding counselling.

Private medical insurers operate under their own privacy notices and are responsible for explaining how they use information they receive.

8. Confidentiality

Information shared during counselling will be treated as confidential and handled in accordance with professional, ethical and legal responsibilities.

Confidentiality is not absolute. Information may be disclosed where:

• the client has requested or consented to the disclosure;
• disclosure is required by law or a court order;
• there is an immediate or serious risk of harm to the client or another person;
• disclosure is necessary to safeguard a child or an adult at risk;
• relevant information is required to administer authorised private medical insurance; or
• limited information is discussed during confidential clinical supervision.

Where disclosure is necessary, only information reasonably required for the relevant purpose will be shared.

9. Clinical supervision

Michele undertakes regular clinical supervision in accordance with her professional responsibilities as a BACP member.

Aspects of counselling work may be discussed confidentially with a suitably qualified clinical supervisor.

A client’s identity will not normally be disclosed. Information will be limited to what is reasonably necessary for professional supervision, and the supervisor is also required to maintain confidentiality.

10. Selling personal information

Personal information will never be sold, rented or provided to another organisation for that organisation’s marketing purposes, and it will never be provided to data brokers or used for unrelated advertising.

Personal information will not be used to send marketing communications unless the person has specifically agreed to receive them.

11. When information may be shared

Personal information will not normally be shared with another party unless:

• the client has requested or consented to it;
• sharing is necessary to provide or administer counselling;
• sharing is necessary to administer authorised private medical insurance;
• disclosure is required by law or a court order;
• disclosure is necessary for safeguarding;
• there is an immediate or serious risk of harm;
• disclosure is necessary to establish, exercise or defend a legal claim; or
• disclosure is otherwise permitted by law.

Depending on the circumstances, information may be shared with:

• a person nominated by the client;
• the client’s GP or another healthcare professional;
• Bupa, Aviva Health, AXA Health or another authorised insurer;
• a confidential clinical supervisor;
• emergency services;
• safeguarding authorities;
• legal or regulatory authorities;
• another recipient where disclosure is required by law.

At present, the service providers used in connection with this website are the website hosting and secure database service that publishes the website and receives contact-form enquiries, and Google, which provides the map shown in the Contact section. No analytics service, advertising service or online payment service is used on this website.

12. Children and young people

Michele provides counselling to young people from the age of 18.

Where the client is under 18, information may also be collected about a parent or person with parental responsibility where this is necessary and appropriate.

The young person’s confidentiality and data-protection rights will be respected in accordance with their age, understanding, individual circumstances and applicable law.

Information may be shared where this is necessary to safeguard the young person or another child or adult at risk.

The confidentiality arrangements applying to a young person will be discussed before counselling begins.

13. How information is protected

Reasonable technical and organisational measures are used to protect personal information against:

• loss;
• unauthorised access;
• accidental disclosure;
• alteration;
• misuse; and
• destruction.

These measures may include:

• password-protected devices and accounts;
• appropriate access controls;
• secure storage;
• secure disposal;
• device and software updates;
• antivirus and security protection;
• limiting access to information; and
• maintaining professional confidentiality.

No email, internet or electronic storage system can be guaranteed to be completely secure. Clients should avoid including unnecessary medical or highly sensitive information in ordinary email messages.

14. How long information is retained

Personal information, correspondence, counselling records and medical information will normally be retained securely for five years from the date on which counselling ends or the client’s last substantive contact with Michele.

Website enquiries from people who do not proceed to counselling will only be retained for as long as reasonably necessary to respond to and administer the enquiry, unless the information needs to be retained for legal or safeguarding reasons.

Payment, invoice and tax records may be retained for the period required by applicable financial and tax law.

Information may be retained for longer than five years where:

• retention is required by law;
• retention is required by a court order;
• it is necessary in connection with a legal claim;
• it is required by a professional insurer;
• it is required by a safeguarding obligation; or
• another professional or regulatory requirement applies.

Where a longer period is required, only information that remains necessary will be retained.

At the end of the applicable retention period, information will be securely and permanently deleted or destroyed.

15. Website contact form

When a visitor uses the website contact form, the following information is collected:

• first name;
• last name;
• email address;
• message; and
• limited technical information needed to deliver and protect the form.

This information is used to:

• respond to the enquiry;
• determine whether counselling may be suitable;
• arrange an initial discussion or appointment;
• maintain necessary correspondence; and
• detect or prevent spam and misuse.

The information entered is sent by email directly to Michele Watson at personcentred@gmail.com. It is not stored permanently in the website database, used for marketing, or sent to any analytics or advertising service.

Visitors should avoid entering more medical or sensitive information than is necessary in the contact form. Please do not include detailed medical or highly sensitive information; more detailed information can be discussed later through an appropriate confidential method.

Submitting the contact form does not establish a therapist-client relationship.

16. Website technical information

When someone visits the website, limited technical information may be processed, including:

• internet protocol address;
• browser type;
• device type;
• approximate location derived from the internet connection;
• pages visited;
• date and time of access;
• security logs; and
• cookie or consent preferences.

This information may be needed to deliver the website, maintain security, prevent misuse and understand whether the website is operating correctly.

Further information is provided in the separate Cookie Policy.

17. Cookies and Google Maps

The website uses essential cookies and similar storage required for security, accessibility, operation and remembering cookie choices.

Non-essential analytics or tracking cookies are not loaded before the visitor has provided any consent required by law.

The Contact section shows a map of the consulting room location provided by Google. When the map loads or is used, Google may receive technical information about the visitor’s device, including the internet protocol address, and may set its own cookies. Google uses that information under its own privacy arrangements. The written practice address is also shown, so the location can be read without using the map.

For information about the cookies and similar technologies used by this website, please read the separate Cookie Policy.

18. Data-protection rights

Depending on the circumstances, an individual may have the right to:

• be informed about how their information is used;
• request access to their personal information;
• ask for inaccurate information to be corrected;
• ask for incomplete information to be completed;
• request deletion of their information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal or professional exceptions.

For example, some information may need to be retained where there is a legal obligation, safeguarding reason, insurance requirement or potential legal claim.

A request for counselling records to be deleted will therefore not be granted automatically. Each request will be considered individually under applicable data-protection law, and the outcome and reasons will be explained.

19. Requesting access, correction or deletion

A person wishing to exercise a data-protection right should contact:

Michele Watson

Email: personcentred@gmail.com

The request should clearly explain:

• the person’s name;
• the right they wish to exercise;
• the information concerned; and
• any information that may help locate the relevant records.

Proof of identity may be requested before personal information is disclosed or changed.

Requests will normally be answered within the period required by applicable data-protection law.

A fee will not normally be charged. A reasonable fee may be charged, or a request may be refused, where the law permits this because a request is manifestly unfounded or excessive.

20. Complaints about personal information

Anyone with a concern about how their personal information has been handled should contact Michele first so that the concern can be considered and, where possible, resolved.

Contact: personcentred@gmail.com

A person also has the right to complain to the Information Commissioner’s Office.

Information about making a complaint is available from the Information Commissioner’s Office, the UK regulator for data protection.

Making a complaint to Michele does not prevent a person from contacting the Information Commissioner’s Office.

21. Changes to this notice

This Privacy and Data Protection Notice may be updated to reflect changes to:

• the counselling service;
• the website;
• professional guidance; or
• applicable law.

The current version and the date it was last updated will be displayed on this page.

Where a change materially affects existing clients, reasonable steps will be taken to bring it to their attention.

22. Contact

Questions about this notice or the use of personal information should be directed to:

Michele Watson
Maris Green
Great Shelford
Cambridge
CB22 5EG

Email: personcentred@gmail.com
Telephone: 07531 280695