Information Governance Policies and Procedures

Section A

Introduction

Data held by New Horizon Training Ltd & Lisa Williams Therapy will be held lawfully and for the retention periods set out in section B of this policy document. New Horizon Training Ltd & Lisa Williams Therapy ('we', 'I' 'my' 'our') will not disclose users' information to third parties unless legally bound to do, for example there is an identified risk to the client and/or others. I will process your personal data for the purposes of maintaining my client list and contacting you in future. Data collected by this site is used to:

• Contact you in response to an enquiry
• Administer and enhance my web site and service

The term ‘New Horizon Training Ltd & Lisa Williams Therapy’ or ‘us’ or ‘we’ refers to the owner of the website. The term ‘you’ refers to the user or viewer of our website.

If you would prefer that we cease to send you further information about New Horizon Training Ltd & Lisa Williams Therapy simply send an email or call or text us:

Email: enquiries@newhorizontraining.co.uk
Call/Text: 07920 147 101

This document refers to:

• Written Documents
• Spreadsheets
• Hardcopy case notes and files
• Database entries
• Images
• Recordings
• Emails
• Text messages
• Supervision notes
• Visits to the organisation’s website
• Social media communication

Aim and Purpose

The purpose of this document is to ensure that New Horizon Training Ltd & Lisa Williams Therapy has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.

Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;

• is the right information
• is in the right place
• at the right time
• with the right people
• for the right reasons

This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. New Horizon Training Ltd & Lisa Williams Therapy is fully committed to ensuring clients privacy and data protection rights.

For the purpose of this policy Lisa Williams Edgar is the named Data Protection Officer/Controller and Head of Organisation.

Information Governance Framework Principles for New Horizon Training Ltd & Lisa Williams Therapy

1. Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75 minute GDPR CPD Course provided and completed. Refresher training is completed every two years.
2. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.
3. Any data collected is solely for the purpose of providing a person-centred service to an individual client.
4. The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. (https://www.igt.hscic.gov.uk/Caldicott2Principles.aspx)
5. All technology [Microsoft Office products including Outlook] used to store or facilitate information and communication is maintained according to the Data Retention Policy for New Horizon Training Ltd & Lisa Williams Therapy
6. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
7. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
8. Any electronic devices where personal or sensitive, confidential information is held will be password protected. Individual documents stored electronically will also contain individual passwords.
9. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.

Section B

Privacy Notice: Use of information

In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required. 

On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisation’s website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]

• Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
• Any document containing personal data will state “Official-sensitive, private and confidential” clearly.
• All emails will contain a privacy statement.

Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right not to be subject to automated decision-making including profiling.

Please note that New Horizon Training Ltd & Lisa Williams Therapy does not use automated decision-making tools, including profiling.

Website visitors

When an individual visits www.lisawilliamstherapy.co.uk, I use Google Analytics who are considered a third-party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google Analytics only collect non-identifiable data which means I or they cannot identify who is visiting. New Horizon Training Ltd & Lisa Williams Therapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.

Website hosting

The New Horizon Training Ltd & Lisa Williams Therapy website is hosted on a hosting service provided by darkHouse Multimedia, a third-party provider. When you visit my site using a web browser, your browser typically sends some information to the server such as the date and time of your visit, the operating system you use, and your IP address, the page or resource you are requesting, and so on. The web servers hosting my website use this anonymised data to help monitor my site’s performance, bandwidth usage, track any errors, and so on. The hosting services provided by darkHouse Multimedia are compliant with the EU-US Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries and Switzerland. Details of the Privacy Shield Framework can be found here https://www.privacyshield.gov/

Use of cookies

When accessing our Website, we will learn certain information about you during your visit.

Similar to other commercial websites, our website utilises a standard technology called "cookies" and web server logs to collect information about how our website is used. Information gathered through cookies and web server logs may include the date and time of visits, the pages viewed, time spent at our website, and the websites visited just before and just after our web site, your IP address.

A cookie is a very small text document, which often includes an anonymous unique identifier. When you visit a website, that site's computer asks your computer for permission to store this file in a part of your hard drive specifically designated for cookies. Each website can send its own cookie to your browser if your browser's preferences allow it, but (to protect your privacy) your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other sites.

Analytical cookies

We also employ analytical cookies in order to provide meaningful reports about our site visitors. These cookies allow us to recognise and count the number of visitors and see how visitors move around the site. This information helps us to improve the way our website works. However, these cookies do not collect personal data about you.

Some of the following cookies may be used for analytical purposes:

__utma Google Analytics to monitor traffic levels, search queries and visits to this website

__utmb Google Analytics stores IP address anonymously on its servers and neither we nor Google associate your IP address with any personally identifiable information

__utmc Google Analytics to determine whether you are a return visitor to this site, and to track the pages that you visit during your session

__utmz Google Analytics stores the type of referral used by the visitor to reach this site

IP addresses

IP addresses are used by your computer every time you are connected to the Internet. Your IP address is a number that is used by computers on the network to identify your computer. IP addresses are automatically collected by our web server as part of demographic and profile data known as “traffic data” so that data (such as the web pages you request) can be sent to you.

Email information

If you choose to correspond with us through email, we may retain the content of your email messages together with your email address and our responses. We provide the same protections for these electronic communications that we employ in the maintenance of information received online, mail and telephone.

How do we use the information that you provide to us?

Broadly speaking, we use personal information for purposes of administering our business activities, providing customer service and making available other items and services to our customers and prospective customers.

We will not obtain personally identifying information about you when you visit our site, unless you choose to provide such information to us, nor will such information be sold or otherwise transferred to unaffiliated third parties without the approval of the user at the time of collection.

We may use software programs to create summary statistics, which are used for such purposes as assessing the number of visitors to the different sections of our site, what information is of most and least interest, determining technical design specifications, and identifying system performance or problem areas.

For site security purposes and to ensure that this service remains available to all users, we use software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage.

We may disclose information when legally compelled to do so, in other words, when we, in good faith, believe that the law requires it or for the protection of our legal rights.

A special note about children

Children are not eligible to use my web site and services and I ask that minors (under the age of 13) do not submit any personal information to me. If you are a minor, you can use this site only in conjunction with permission and guidance from your parents or guardians.

I have an up-to-date enhanced DBS certificate.

How do we protect your information and secure information transmissions?

Email is not recognised as a secure medium of communication. For this reason, we request that you do not send private information to us by email. However, doing so is allowed, but at your own risk. Some of the information you may enter on our website may be transmitted securely via a secure medium known as Secure Sockets Layer, or SSL.

Policy changes

We reserve the right to amend this privacy policy at any time with or without notice. However, please be assured that if the Privacy Policy changes in the future, we will not use the personal information you have submitted to us in a manner that is materially inconsistent with this Privacy Policy, without your prior consent.

We are committed to conducting our business in accordance with these principles in order to ensure that the confidentiality of personal information is protected and maintained.

Retention Schedule

Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.

Data Processing

What are the lawful basis for processing data at New Horizon Training Ltd & Lisa Williams Therapy?

Consent in relation to communication: the individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.

Processing is necessary in order to protect the vital interests of the data subject or of another natural person;

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:

 (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

1. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

This means that New Horizon Training Ltd & Lisa Williams Therapy does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.

Description of processing

The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.

Reasons/purposes for processing information

New Horizon Training Ltd & Lisa Williams Therapy processes personal information to enable the provision of Psychotherapy and Hypnotherapy, to advertise services and to maintain accounts and records.

Type/classes of information processed

New Horizon Training Ltd & Lisa Williams Therapy processes information relevant to the above reasons/purposes. This information may include:

• personal details
• family, lifestyle and social circumstances
• goods and services
• financial details
• employment and education details

New Horizon Training Ltd & Lisa Williams Therapy also processes sensitive classes of information that may include:

• physical or mental health details
• racial or ethnic origin
• religious or other beliefs of a similar nature
• offences and alleged offences

New Horizon Training Ltd & Lisa Williams Therapy processes personal information about:

• clients
• suppliers
• business contacts
• professional advisers
• supervisors

Section C

Data Breach

All personal and sensitive data held by New Horizon Training Ltd & Lisa Williams Therapy is held securely. Electronic data stored on a computer is stored on a password protected computer, in password protected documents held on the C: Drive of the computer. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked cabinet behind a locked door.

In the case of a data breach New Horizon Training Ltd & Lisa Williams Therapy shall comply with the regulations set out under Article 33 of the GDPR;

1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:

(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;

(b) communicate the name and contact details of the data controller where more information can be obtained;

(c) describe the likely consequences of the personal data breach;

(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

1. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
2. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
3. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
4. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.

Subject Access Request

A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.

A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.

A SAR request will include information we hold about you, New Horizon Training Ltd & Lisa Williams Therapy will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

SAR requests should be put in writing to New Horizon Training Ltd & Lisa Williams Therapy. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to New Horizon Training Ltd & Lisa Williams Therapy.

Right to Erasure

Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made.

Complaints

New Horizon Training Ltd & Lisa Williams Therapy hopes to meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore New Horizon Training Ltd & Lisa Williams Therapy would welcome you raising any concerns you have.

These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact New Horizon Training Ltd & Lisa Williams Therapy.

If you feel you would like to make a complaint about how your personal and sensitive data is handled by Lisa Williams Therapy you can contact New Horizon Training Ltd & Lisa Williams Therapy directly. In the event that New Horizon Training Ltd & Lisa Williams Therapy cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.

Safeguarding your privacy

In the event of my death or sudden illness, my supervisor will contact existing clients and archive any client files in accordance with General Data Protection Regulations.

If you have any questions regarding this policy, or your dealings with our website, please contact us:

enquiries@newhorizontraining.co.uk

FAQs about the General Data Protection Regulations, 2018 (GDPR)

What are the General Data Protection Regulations, 2018 (GDPR) and how do they affect me?

The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information your can read the policy documents accessible via your welcome information pack.

How long will you hold my information for?

I am regulated by the CNHC, an organisation that stipulates I must hold your data for 8 years after your final session. Unless you are a child, in which case I must hold your data until your 25 ^th birthday, unless you are 17 when treatment ends and then I must keep it until your 26 ^th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.

What if I don’t want my records to be held for that long?

Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance companies legal team may want to verify information I send out.

Why do you need to record this information?

I collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent, and to which a consent form will be supplied and signed.

What lengths are made to ensure my information is held securely?

Hardcopy documents – Are all stored in a locked cabinet in a locked room.

Text messages – My work phone is secured with a pin code.

Emails – My email account requires a user name and password.

Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.

Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.

Is what we discuss kept confidential?

Everything we talk about and all that takes place during our therapy sessions are strictly confidential. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR. All that takes place within the therapy sessions is treated with respect, discretion and strict confidentiality. Confidential notes to assist with future treatment are kept in secure files at all times.

What if I see you outside of the session?

If we see each other outside of a session I may smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.

What about other Health and Social Care Professionals?

As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your treatment with me, and then notify them of the treatment ending, I would only do this if you were to sign the specific consent available.

Exceptions:

In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.

If I was issued with a police warrant or required by a court of law for your information, then I would also have to provide them with your information.

New Horizon Training Ltd

Proprietor is Lisa Williams Edgar. Head Office, 7 Westward Close, Wrington, North Somerset, BS40 5LU. Web: www.newhorizontraining.co.uk. Tel: 07920 147101.

Equal Opportunities Policy

Purpose

New Horizon Training Ltd is committed to ensuring equal opportunities for all, ensuring that the qualifications we offer are inclusive and accessible to learners.

All who represent New Horizon Training Ltd are responsible for implementation of this policy. We believe that all members and learners have the right to be treated with dignity and respect regardless of their age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, ethnicity, religion or belief, sex, and sexual orientation. We will not tolerate unfair treatment or unlawful discrimination, whether intentional or unintentional, direct, or indirect.

Policy

New Horizon Training Ltd is committed to The Equality Act 2010 by taking positive action to:

• Comply with current legislative requirements and monitor that this is adhered to
• Develop qualifications, support services and products which take into consideration the needs of all learners and do not unnecessarily discriminate against any individual or group
• Promote fair access to qualifications, minimising any barriers to access or assessment by implementing reasonable adjustments and special considerations policies
• Ensure that learning opportunities and fair assessment is open to all who will benefit without compromising the integrity of qualifications
• Ensure content and language of all written content, including assessment materials and programmes are non-discriminatory and free from any bias or stereotypical wording
• Monitor our qualifications, entry requirements and assessments to identify barriers to access or achievement and remove or minimise unnecessary barriers or bias which could impact on individuals or groups.

New Horizon Training Ltd shall implement this policy through:

• Ensuring staff, members and learners have access to this information to assist them in planning, putting into practice and monitoring their rights and responsibilities under this policy
• Providing support and relevant training/updates for all staff, members and learners and revising any policy or practice that could disadvantage individuals or groups
• Ensuring all staff, members and learners know how to offer feedback and register complaints
• Effective complaints procedures which will be used to resolve complaints of discrimination with a full and prompt consideration under this policy, breaches of this policy will be dealt with through New Horizon Training Ltd complaints procedures.

Monitoring and Review

This policy and its procedures will be reviewed regularly for improvements as part of our quality assurance requirements. This will ensure it is fit for purpose, reflects the services we deliver to our customers and that we provide services which are relevant to the requirements of individual needs. Regular reviews will ensure that we are adhering to our quality policy statement.

*Occasionally circumstances will arise which result in the need to cancel, reschedule or postpone an event, due to an unforeseen occurrence or Act of God. When this is the case New Horizon Training Ltd shall assume no liability.

Other Documents

Further policy documents can be downloaded here:

• Code of Conduct
• Complaint Handling
• Equality, Diversity & Inclusion