Data Protection and Privacy Policy Agreement for Viki Margerum Therapies

As of 25th May 2018, under the new General Data Protection Regulations (GDPR), I am required by law to inform you about how I process and keep safe any data about you.

I am required to gain your explicit consent regarding how I hold and process your data. You have the right to withdraw your consent at any time. I am registered with the ICO (Information Commissioner’s Office), which means I need to tell you what data I am collecting from you, what I intend to do with it and for keeping it safe. My registration number is: ZB346590

If you have any questions about this privacy notice, or about how your information is handled, you can contact me at: Email: vikimargerum@gmail.com, Phone: 07984792936

This policy applies to people who contact me for therapy, visit my website, work with me therapeutically or who otherwise provide me with personal data about themselves. It sets out how I collect, process, and hold your personal data.

What Data is Held About You? I hold certain data about you so that I can work safely, professionally and in line with the guidelines of my Insurer, Balens. I may receive the following data from you via my website, an online contact form, email, letter, or phone message.

·       your name

·       your email address

·       your phone number

·       the information you choose to share in your enquiry

·       any preferences around contact, availability or therapy/supervision format

If we arrange an initial call or begin therapy or supervision, I may also collect:

·       your address

·       your date of birth

·       your GP details

·       emergency contact details, where appropriate

·       relevant health, mental health or wellbeing information

·       information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy/supervision

·       brief clinical/supervision notes

·       attendance, payment and appointment information

·       correspondence between us

I only collect information that is necessary for providing therapy and supervision safely, ethically and professionally. I am required to hold this information by my professional liability Insurer (Balens). They require me to keep this data for seven years after which all information can be destroyed.

How I use your information
I use your personal information to:

·       respond to enquiries

·       arrange initial calls and appointments

·       provide therapy or supervision

·       keep appropriate clinical records

·       manage payments, invoices and appointments

·       communicate with you about sessions

·       meet legal, professional and ethical responsibilities

·       manage risk, safeguarding or emergency situations where necessary

·       maintain insurance, tax and accounting records

·       respond to data protection requests or complaints

Session notes: Notes may be made in writing on paper during or after sessions and may also be typed up in Word after sessions. Session notes will include your first name, session number, the date and brief information about the session, and are used to aid memory and track progress. Any notes stored electronically are on my laptop which is password protected. My laptop is only used by me. I will retain session notes for seven years, in line with the guidelines of my professional liability Insurer Balens. Nobody else will have access to the session notes but some session content may be shared verbally with my Supervisor. Supervision allows me to gain support and guidance in my work and to check that I am working ethically and competently. If I discuss the work that I am doing with you, I will only refer to you by your first name; any other distinguishing details will be altered to ensure anonymity.  My supervisor is also bound by confidentiality and professional standards.

Payment information: I make a note of all payments in paper form; these client payments are identified by first name or initials, the amount received, the type of therapy and the date. By law, I am required to retain certain financial information, primarily for tax purposes. I keep financial information for seven years as advised by HMRC. Banking transactions can be viewed by employees of HSBC and other financial transactions can be viewed by HMRC Tax officials. When payments are made via BACS, your account name may be visible on my online or paper bank statements.

Confidentiality: There are some limits to confidentiality. I may need to share information if:

·       I believe there is a serious risk of harm to you or someone else

·       there is a safeguarding concern involving a child, vulnerable adult or person at risk

·       I am required to do so by law, court order or legal process

·       disclosure is necessary to prevent or detect a serious crime

·       there is a medical emergency, and information is needed to protect life

·       I need to consult my clinical supervisor, while protecting your identity as far as possible

Sharing your information:
I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

·       my clinical supervisor/consultant

·       professional advisers, such as an accountant, insurer or legal adviser

·       my professional body if required in relation to a complaint or ethical matter

·       safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern

·       a court or legal authority, if required by law

·       an appointed clinical executor if I die or become unable to contact clients and supervisees myself

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

How will I store your data?
The data on paper is kept in a locked filing cabinet. I transfer your name and a code to my password-protected laptop and your phone numbers may be kept on my mobile phone that is code protected and will be deleted from my phone when we stop working together. Your information may be stored in the following systems:

·       Website: Squarespace

·       Email: Gmail

·       Online sessions: Zoom

·       Cloud storage or backup: iCloud

·       Phone / messages: SMS and phone

·       Scheduling: Acuity

I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access and secure storage.

Online therapy:
If we work online, sessions will take place using Zoom. I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted. Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.

AI tools, transcription and recording
I do not record, transcribe or use AI tools to process therapy or supervision sessions. Neither do I use digital tools for writing, planning or education.

Website visitors and cookies
When you visit my website, some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools. You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.

Squarespace website hosting and visitor data

This website is hosted by Squarespace. When you visit it, Squarespace may collect information about your browser, network and device, the web pages you visited before arriving, the pages you view on this website and your IP address. Squarespace uses this information to operate the website and to protect and improve its platform and services.

Website analytics

To understand website traffic and activity, the site may collect analytics information including browser, network and device details, the web page visited before this website, IP address, clicks, internal links, pages visited, scrolling, searches and timestamps. This information is provided to Squarespace as the website analytics provider. This section covers Squarespace analytics only; any additional third-party analytics service would need to be described separately.

Cookies and similar technologies

The website uses cookies and similar technologies, which are small files or pieces of text downloaded to a device when a visitor accesses a website. Necessary cookies are used so that Squarespace can securely serve the website. Where analytics or performance cookies are enabled, they will be used only in accordance with the choices offered through the website cookie banner and applicable law. Third-party tools or embedded content may place their own cookies, which are not covered by this description of Squarespace cookies.

Website forms and enquiries

When you submit information through a website form, I collect the information requested in that form so that I can track and respond to your enquiry. The information is provided to Squarespace, as the website hosting provider, so that it can provide website services and help me manage my relationship with you. If form submissions are sent to or stored by another service, that service will also process the information for those purposes.

 Online appointment booking

When you book an appointment through Acuity Scheduling on this website, I may collect your name, email address, phone number, information relating to the appointment, such as how you were referred, and any files you choose to upload. This information is provided to Squarespace, as the online scheduling service provider, so that it can provide online booking services.

 Third-party website features and fonts

If the website includes third-party embedded content, share buttons or other connected services, those providers may receive information such as browser, network and device details, the page or content being viewed or shared, and your IP address. If the website uses Squarespace font integrations with Google Fonts or Adobe Fonts, those providers may receive browser, network, device, page and IP address information so that fonts can be displayed. Any such feature should be reflected in this notice when it is enabled on the website.

 Your rights:
Under UK data protection law, you have rights over your personal information. These may include the right to:

·       be informed about how your data is used

·       access a copy of your personal information

·       ask for inaccurate information to be corrected

·       ask for information to be deleted in some circumstances

·       restrict or object to certain processing

·       complain about how your information has been handled

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.

If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within 30 days. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.

Data protection concerns and complaints:
If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to without undue delay.

Please include: your name, what your concern is about, what you would like me to investigate and how you would prefer me to respond. I will investigate your complaint, keep you informed where necessary and contact you with the outcome as soon as I can. If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Website: www.ico.org.uk

Telephone: 0303 123 1113

In summary, I will process your data in a manner that ensures appropriate security and confidentiality as detailed above. However, no system can be completely secure. Therefore, although I take strict steps to secure your information, I do not promise that the personal data that you provide to me will always remain secure.