Data Protection Policy

This data protection policy is designed to ensure that the rights to privacy of individuals are protected. I am committed to the principles set out in the General Data Protection Regulation and have reviewed my personal data processing activities so as to provide psychological assessment and/or therapeutic interventions in compliance with the provisions of the Regulation.

Data protection lead: I am a sole trader and as such, I have sole responsibility for ensuring compliance with policies and procedures on data protection, for conducting audits, risk assessments and for responding to requests from data subjects and dealing with data breaches.

Data subject refers to an individual whose personal data is processed.

I process personal data, including limited amounts of sensitive data to enable me to assess and meet the psychological and therapeutic needs of clients referred to me.

Personal data is any information from which a living individual can be identified, either directly or indirectly. It is not limited to names and identification numbers, or to photographs or addresses.

I process personal data and a limited amount of special category data as follows:

• Names, addresses, dates of birth and other personal data as provided by the client or their Social Worker.
• Children’s Services records or health information as provided by the client/patient or their Social Worker.
• Anonymised personal data in invoices and copy receipts, accounting records, tax returns and related information;

Special category data is information revealing an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic and biometric data, health information and data in relation to a person’ s sex or sexual orientation.

The special category personal data that I hold includes:

Health, educational or Children’s Services records

Information on sex, race and ethnic origin

This information is held for the shortest time possible, for the purpose of assessment and the writing of a report.

Processing covers any activity involving personal data, including holding, storage and destruction. The Information Commissioner says it is difficult to image an activity involving personal data that does not fall within the definition.

I process personal data in order to carry out work as a psychologist and therapist.

The data processing activities include: collecting assessment data and compiling reports, collating and keeping client therapy notes, securely sending and receiving emails and documents externally, submitting anonymised invoices and filing them with receipts, and destroying information.

Sharing of personal data:  I share personal data in person as part of the fulfilment of my professional duties and also electronically when necessary to provide my professional services. I share electronic data anonymously via a secure platform and special category data is encrypted before it is shared. There is no transfer of data abroad.

The Data controller decides the personal data processing protocol required. A controller can be a sole trader, a partnership, a private or public limited company or a large multi-national organization. They decide the purpose  and manner of personal data collection and processing. I am the data controller for the purposes of the identified activities of Dr Nici Long.

As a Data processor I process personal data in compliance with GDPR requirements.

Legitimising conditions: The processing of personal data is unlawful unless a legitimising condition, or lawful basis, applies. Legitimising conditions:

• Contract (with employees)
• Explicit consent
• Processing is necessary for the purposes of medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

Data protection principles: Where there is a lawful basis for processing personal data, I take proportionate steps to maintain compliance with the GDPR principles and requirements.

Accountability: This principle is designed to ensure that data protection is embedded in my professional practice. I need to have procedures and policies in place to demonstrate compliance with the General Data Protection Regulation.

Data protection by design: This is an aspect of the accountability principle. It means that data protection risks are evaluated and eradicated and reduced at the very earliest stage, whenever there is a significant change in processes or procedures which entail a risk to data subjects.

Data protection by default: minimisation: No more data should be collected, shared and stored than is strictly necessary. The retention periods for personal data is dependant upon individual contractual agreements.

Security:  I have taken appropriate measures to ensure that personal data is processed securely. Hard copy as well as electronic data is processed in accordance with information security policy.

Personal data breach: I am responsible for responding to personal data breaches, which includes the notification of the Information Commissioner as necessary, and also data subjects where the risk to them is high.

Breaches which carry any risk to data subjects must be reported to the Information Commissioner’s Office (ICO) within 72 hours, together with a summary of the nature of the breach, the steps taken to reduce the risk to data subjects, and measures to prevent the breach from happening again.

Rights of data subjects: Data subjects have rights that include:

Right to be informed about what personal data is collected, how it is collected, for what purposes, if and how it is stored and shared.

Right of access to personal data by means of a subject access request

Right to rectification of inaccurate data, and to add to the information that I hold about the data subject if it is incomplete or inaccurate.

Right to erasure, otherwise known as the right to be forgotten.

Right to restrict the processing of personal data.

Right to object to the processing of personal data.

I must respond to requests from data subjects within one month.

Data Protection Risk Register: All personal data processing activities are recorded in the data protection risk register.

Personal data breaches are recorded in the risk register, whether they are reportable or not.

Enforcement and disciplinary action: Failure to comply with the General Data Protection Regulation is a criminal offence in many cases and can result in large fines. It is important that I act in accordance with this policy, and maintain an up to date awareness of data protection principles and requirements, and that this policy is properly implemented.

Information Security Policy

This security policy is designed to ensure that I comply with the security requirements of the General Data Protection Regulation, and that the rights to privacy of data subjects are protected. In compliance with Articles 24, 32, and 40. I am selective with regards to the information stored, I am mindful of the risks involved in storing this information and I have implemented appropriate physical, organisational and technical measures to ensure a level of security appropriate to the risk.

As a practitioner psychologist, I am registered with the HCPC in the name of Dr Nicolette Long. In the main I work outside of the home in community venues such as Children’s Centres and work within my own home for administrative purposes, and for some technologically mediated meetings via phone or video-link.

Security measures

The following security measures have been taken:

Physical

• The building where I work and store data is kept secure and is alarmed.
• I do not tend to receive information or documents by post. Should this occur in the future I will ensure that it is stored, opened and filed securely by me. I will comply with GDPR requirements. 
• Computer screens are used in an office space that is not accessed or viewed by others.
• Both hard copy and electronic copies of personal data are processed. Hard copies are stored in line with GDPR, in a locked filing cabinet that is out of site, and where the key is securely stored in a place separate to the filing cabinet.
• In some instances, I carry with me, or provide hard copies of sensitive information. If this occurs, I ensure that the information is handled, and shared, in compliance with confidentiality and security requirements.

Electronic / Technical

• Sensitive and personal data shared by email is encrypted and password protected as appropriate.
• I do not routinely store identifiable electronic data. Where I have access to electronic special category data it is encrypted and accessed only by me. It is accessed for the briefest period necessary, and usually only through a secure platform, rather than stored directly on my computer.
• If special category information needs to be stored electronically, all information including special category data is encrypted with restricted access.
• My laptop is encrypted and password protected, and has anti-virus and anti-spyware and firewall protection installed. It is locked when not in use.
• My mobile phone is password protected and locked when not in use.

• Computers and other electronic equipment will be disposed of in a safe manner by an outsourced and certificated provider.

This policy is regularly reviewed by me, Dr Nici Long to ensure that I am compliant and provide the level of information security expected of me. I maintain up to date knowledge of requirements with regards to data protection.

Privacy Notice

As a practitioner psychologist, I (Dr Nici Long) keep some information that may be of a personal and sensitive nature. The following statement explains the purpose of data collection and the way in which your data is processed (collected, stored and shared.)

I am the sole person who has direct access to the personal information that I hold.

I collect, hold and store this information solely for the purpose of my work with you. I collect data to enable me to deliver an effective and efficient psychological service to meet your individual needs. The data may be collected by psychometric or clinical assessment, or from therapy sessions, or from documentation provided by you or your Social Worker. This information informs my therapeutic practice and the writing of any psychological reports.

What personal data information do I store?

I may collect details such as your name, address and contact details.

I will keep anonymised notes of the meetings and sessions that we have together.

I may keep assessment data information that pertains to your presenting concerns, your mental health, life experiences, and these may include your name and date of birth.

I may keep notes from consultations and meetings with other professionals where your needs are discussed.

I may be provided with documents about your current experiences, personal history, or the work that other professionals engage in with you.

I may write a psychological report for the purpose of informing and supporting the interventions that others provide to you.

The purpose of data collection

To ensure that you receive the best quality of care that meets your needs

To permit any effective investigation if you are unhappy with the care that you receive

For the purpose of research and continuous professional development

To evaluate service delivery

How do I collect, store and use your data?

Data Collection

Data is typically collected directly from you, or, with your permission, shared by your Social Worker.

Data is collected in a verbal form in meetings, or in an electronic form via an encrypted email platform.

In some instances I may be provided with hard copy information. This will be handled and stored securely in a locked filing cabinet.

I aim to keep accurate records of your details and to keep them securely in an anonymised form primarily as a hard copy in a locked filing cabinet. I store some limited identifiable details on my computer and mobile phone primarily to enable me to contact you.

If I keep specific details such as your name, date of birth and address, these will be kept separate from any anonymised clinical notes taken for assessment or therapeutic purposes. This will ensure that the identifying details are not matched with detailed information.

Personal Computer systems and phones that are locked and password protected when not in use.

Sharing of information

If it is in the interests of your wellbeing, and with your permission, I will share information to professionals involved in your care, if required:
Social Workers, GP, Teachers, Safeguarding Boards.

If the client is a child I will also share information with parents.

If I am aware of information that constitutes a safeguarding matter, I will share the information with your Social Worker or the Safeguarding Board.

In all instances of information-sharing I will endeavour to seek your consent with regards to the details that I would like to share, however, with regard to safeguarding matters, information will need to be shared even if you are not able to give consent.

When sharing information I will remind the other party of the confidential nature of the information.

Sensitive, identifiable and personal information that is communicated electronically, will be communicated via secure platforms such as egress.

For how long

I store data for the duration of the work together, and for a brief period afterwards as stipulated by any contractual agreement.

Information can be shared with you or the contractor or destroyed as per agreement.

Access to information

The Data Protection Act allows you access to the information that I keep.

You have a right to request access to this information, and I need to ensure that the information is available to you in a form that is accessible and understandable.

If you believe that the information that I hold is incorrect or unfair, or would like me to delete it, please inform me verbally, or in writing. Your request will be dealt with promptly, within the ICO guidelines, and you will be informed of my actions.

Complaints can be made in writing to me or to the Information Commissioner’s Office

https://ico.org.uk/make-a-complaint

ICO helpline on 0303 123 1113.

Safeguarding Policy

This policy needs to be read in conjunction with the existing Safeguarding Policies and Procedures of Adoption Cumbria https://www.cumbria.gov.uk/LSCB/professionals/policies.asp

The aim of the Safeguarding Policy

The aim of this policy is to ensure an awareness of the duty of care with regard to the safeguarding of children, young people and adults at risk.  This includes Child Protection issues, and awareness of the definitions, risks and signs of abuse. 

The policy is supported by Human Rights Legislation and the Children Act 1989 and 2004.

Duty of Care to Children, Young People and Adults at Risk

I have a responsibility to ensure that people who receive a service from me are not abused, and that my policies and practices serve to minimise the risk of abuse, through the appropriate reporting of concerns regarding the safety or wellbeing of service users.

Adults at Risk are people who are over 18 years of age and receiving help, or may need help and services to live in the community.  They may be unable to take care of themselves or protect themselves from harm or exploitation by other people.  Abuse can take place in any setting, public or private, and can be perpetuated by anyone.  It may be a single act or repeated acts that result in harm, contravene human rights or take advantage of someone’s vulnerability. 

Children can be hurt, put at risk of harm or abused. I have a duty to provide a service that protects children from mistreatment; prevents impairment of children’s health and development; ensures that children grow up, learn, play and socialise in circumstances consistent with the promotion of safe and effective care; and that I take action to enable all children and young people to have the best outcome.

Government guidance makes it clear that safeguarding of vulnerable people is a shared responsibility, and depends upon effective joint working between agencies and professionals that have different roles and expertise.  Action to promote the welfare of children and protect them from harm is everyone’s responsibility.  Everyone who comes into contact with children and families has a role to play (Working Together to Safeguard Children, HM Government, July 2018).

Everyone who works with children has a responsibility for keeping them safe. No single practitioner can have a full picture of a child’s needs and circumstances and, if children and families are to receive the right help at the right time, everyone who comes into contact with them has a role to play in identifying concerns, sharing information and taking prompt action (Working Together to Safeguard Children, HM Government, July 2018). 

Categories of Abuse

The main categories of abuse relating to Adults at Risk are:

Physical abuse, such as hitting, slapping, burning, pushing, restraining, giving too much medication or giving the wrong medication, inappropriate restraint or inappropriate physical sanctions.

Psychological abuse, such as shouting, swearing, frightening, blaming, ignoring or humiliating, emotional abuse, threats of harm or abandonment, deprivation of contact, controlling, intimidation, coercion, harassment, verbal abuse, bullying, isolation or unreasonable and unjustified withdrawal of services or supportive networks.

Financial abuse, such as the illegal or unauthorised use of a person’s property, money, pension book or other valuables, theft, fraud and exploitation, coercion in relation to an adult’s financial affairs or arrangements, including pressure in connection with wills, property, inheritance or financial transactions, or the misuse or misappropriation of property, possessions or benefits. This can include “cuckooing” where a person’s property is taken over and used for illegal activities.

Sexual abuse, such as forcing a person to participate in any sexual activity without their consent, including rape and sexual assault, sexual harassment or sexual acts to which the adult has not consented or was pressured into consenting.

Neglect, such as depriving a person of food, heat, clothing, comfort or medication, wilfully ignoring medical or physical care needs, failure to provide access to appropriate health and social care, including not supporting a person to access clinical appointments and support, the withholding of the necessities of life, such as medication, adequate nutrition and heating or depriving someone of stimulation or company, adaptations, equipment or aids to communication.

Discrimination, such as racist, sexist and other forms of harassment. Unequal treatment based on age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion and belief, sex or sexual orientation (known as ‘protected characteristics’ under the Equality Act 2010).

Domestic Abuse.  The cross-government definition of domestic violence and abuse is: any incident or pattern of incidents of controlling, coercive, threatening behaviour, honour-based violence, violence or abuse between those aged 16 or over who are, or have been, intimate partners or family members regardless of gender or sexuality (Gov.UK, 2013). The offence of coercive and controlling behaviour in intimate and familial relationships was introduced into the Serious Crime Act (2015) and recognition of violence against women domestic abuse and sexual violence (VAWDASV) is part of the Social Services and Well-being (Wales) Act 2014.

Female Genital Mutilation (FGM).  FGM comprises all procedures involving partial or total removal of the external female genital organs or any other injury to the female genital organs for nonmedical reasons. FGM is most often carried out on young girls aged between infancy and 15 years old. Whilst there is a mandatory requirement to report incidents of FGM for children and young people this is not a requirement for adult women. If a professional has safeguarding concerns about an individual who has experienced FGM a referral should be made in line with usual local safeguarding arrangements (Gov.UK, 2012).

Self-Neglect covers a wide range of behaviour, neglecting to care for one’s personal hygiene, health or surroundings, and can include behaviour such as hoarding and non-attendance at necessary health/dental appointments. Consideration must be given to the impact on other family members and/or the wider community, mental capacity legislation and whether this gives rise to a safeguarding concern.

Organisational abuse.  An incident or a series of incidents involving on-going ill treatment.  It can be through neglect or from poor professional practice resulting from inadequate structure, policies, processes and practices within an organisation, e.g. this may range from isolated incidents to continuing ill-treatment in an institution or in relation to care provided in one’s own home.

Modern Slavery.  The Modern Slavery Act 2015 encompasses slavery, human trafficking, forced labour and domestic servitude. Traffickers and slave masters use whatever means they have at their disposal to coerce, deceive and force individuals into a life of abuse, servitude and inhumane treatment. Trafficking is the movement of people by means such as force, fraud, coercion or deception with the aim of exploiting them. It is a form of Modern Slavery.  People can be trafficked for many different forms of exploitation, such as forced prostitution, forced labour, forced begging, forced criminality, forced marriage, domestic servitude, and forced organ removal. Trafficking can occur within the UK as well as countries outside the UK.

In relation to children, the different categories of abuse are:

Physical abuse, when a child is physically hurt or injured by hitting, shaking, squeezing, burning, biting, attempting to drown or suffocate, giving the child inappropriate substances such as alcohol, drugs and poison or there is a failure to prevent harm or physical injury to the child.

Sexual abuse, when someone exploits a child sexually, which can take the form of grooming, sexual touching or intercourse, or exposes a child to any form of inappropriate sexual behaviour or pornographic material.

Emotional abuse, a persistent and severe emotional influence that can affect a child’s development, including rejection, the withholding of love, aggression towards the child, over-protection or actions that influence self-esteem.

Neglect, when a child’s basic needs are not being met, such as the need for food, shelter, clothing and health, or when they are left unsupervised or alone in situations that are inappropriate generally, or for their age.

Recognising Possible Signs

It is necessary to understand and recognise potential signs that may be associated with abuse, in order to identify possible issues relating to safeguarding.

Physical abuse: there may be visible physical signs, such as injuries that the individual cannot explain, or that are not treated properly, or that are on parts of the body where accidental injury is unlikely, such as cheeks, chest and thighs.  There may also be bite marks, cigarette burns, bruising that reflects hand marks, broken bones or scalds.

Behaviourally, children may present as aggressive or display moods that are out of character.  They may demonstrate a fear of being at home or being in the presence of their parents, a reluctance to get undressed or show arms and legs even when it is hot, or possibly over compliance with parents.

Sexual abuse: physical signs of this form of abuse may be pain, itching, bruising, bleeding or recurrent discharge in genital or anal areas, having a sexually transmitted disease, stomach pains or discomfort when walking or sitting down.  Children may show a change in behaviour, fear of a particular person, they may self-harm, have nightmares, engage in substance misuse, demonstrate eating problems, sexualised behaviour or drawings, functioning above their age-appropriate level, a reluctance to get undressed or they may allude to having secrets.

Emotional abuse: Children may demonstrate delayed physical and/or emotional development or develop speech disorders.  Behaviourally, individuals who have experienced emotional abuse may display compulsive nervous behaviour, fear of making mistakes, self-harm, lack of self-esteem or have a need for excessive approval, attention and affection.

Neglect: physical signs of neglect may include unkemptness in physical appearance, constant hunger or stealing/searching for food, being underweight, depressed or having inappropriate or untreated health issues.  Behaviourally, children who suffer from neglect may appear tired much of the time, they may be frequently late or miss school, fail to attend appointments, have few friends, steal or be left unsupervised. 

How to Respond to Signs or Suspicions of Abuse

Keeping a written record of concerns.  I will record and report any safeguarding incident on the same day along with a record, verbatim as to what the client or others and I said and did in response.

How to Respond to an Allegation or Disclosure of Abuse

If a Service User discloses abuse, whether recent or historical, it is important to remain calm, listen without interrupting, demonstrate that I understand and that I am taking what they are saying seriously, and sensitively alleviate any feelings of guilt, so that they do not feel as if it is their fault or feel guilty for showing or telling me or the person to whom they disclosed.

It is important to be mindful of body language.  Avoid conveying any sense of shock, or any expressions or comments that may be perceived as judgement, or commenting on any alleged abuser(s).  I must not promise to keep it a secret or probe for further information.  I must reflect back exactly what has been said or shown to me.   I may ask questions for clarification only.  An appropriate question could be “Can you tell me a little more about that?”  I must avoid asking questions that suggest a particular answer.  Asking those sort of questions would be likely to invalidate any future legal action or process as it could be claimed that I have asked leading questions and that it has compromised the evidence.

I will tell the person concerned that, in the interest of their safety, I will need to talk about this with other trusted persons. This will be done in their best interest.

Information Sharing and Reporting Concerns

I will notify the relevant Social Worker or Manager (or the Safeguarding Hub in relation to cases in which Children’s Services are not involved).  Consent of the child and or parent/carer should be sought if appropriate before contacting Children’s Services, though not in a case where this would put a child at greater risk. 

Use of Recording Devices, Camera, Video etc

In relation to children, staff must obtain permission from the person with parental responsibility for the child, and additionally permission from the child where the child is old enough or capable of understanding the request.  Where possible, written consent is required.

The Local Authority has shared Parental Authority for Children Looked After and consent must be obtained via Children’s Services.

Allegations made against me

If an allegation is made against me, I have a responsibility to notify my professional body, the HCPC and the BPS, and also, my professional liability insurer -Towergate Insurance.