Data protection, your privacy and control over your Personal Data are of highest priority to us. This notice explains how we collect, store and use Personal Data and other information, and your rights in this regard. It relates to all communications with and services offered by the Bath Couples Therapy Practice, including our website.
The notice is based on parts of the General Data Protection Regulation (GDPR, 2018) as applicable to UK law and specified by the Information Commissioner’s Office (ICO, an UK Independent authority) and Practice Guidelines of the British Psychological Society (BPS, 2017).
Personal Data is defined by the ICO as “information relating to natural persons who: can be identified or who are identifiable, directly from the information in question; or who can be indirectly identified from that information in combination with other information.”
Special Category Data is defined by the GDPR as personal data considered to be “sensitive,” which include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health-related data and information concerning a person’s sex life or sexual orientation.
Processing of Personal Data is explained by the European Commission in relation to the GDPR as covering “a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.”
Data Controller is defined by the ICO as a person who “determines the purposes and means of processing personal data.”
Throughout the document, “we” and “us” refer to the Bath Couples Therapy Practice and its owner, Dr Eric Ryden, who is the designated Data Controller. “You”, “your” and “clients” refer to individuals using the service and the website, and who choose(-s) to disclose personal data.
Our contact details
If you have any questions about this notice, please contact us:
Lawful basis for collecting and processing
The Bath Couples Therapy Practice and Dr Ryden as a Clinical Psychologist have a legitimate interest in collecting and processing Personal Data to provide psychological services. Data collection is also a requirement of the BPS Practice Guidelines in accordance with best practice. It is necessary to provide an efficient and safe service.
What information is collected and held
When communicating with us
When a person contacts us via telephone, email or by any other means, a bare minimum of information will be collected, such as name, date and time of communication, method of communication and an outline of the subject matter and our response. If relevant and agreeable to the person, we will also collect contact details.
When choosing to receive our services
If we have the pleasure of being of service to you, the lawful basis for collecting and processing Personal Data will be discussed and a written consent thereof will be sought before any service can be rendered. Any Personal Data stored as part of our service contract is only done for the purpose of carrying out the work requested by you.
A minimal set of Personal Data is stored to carry out the work effectively and safely. This includes: name, home address, your contact details (eg telephone number and e-mail address), contact details of your General Practitioner (GP), information about fee payments (see How is the information collected for further details) and an outline of the matters for which a service is sought and session-by-session progress notes about the process and content of assessment/therapy.
Please note that as an independent practitioner, we do not contact or disclose information to your GP or any other organisation, unless you ask us to or in the rare situation we are bound to do so by UK law or professional guidance, such as medical emergencies or duty of care (see Confidentiality for further information).
Information not collected
The Bath Couples Therapy Practice does not ask for or store payment card details.
Unless it is directly relevant to the contracted service agreed by you and you have given us your explicit consent to do so, we do not ask for, store or process Special Category Data. If you are unsure or it is not directly relevant to our work, we will kindly ask you not to disclose it.
We do not ask for, store or process information about criminal offences, unless there is a legal obligation to do so, such as in case divulged information gives us reason to believe that a person is at risk of serious harm.
We will not collect or accept any information submitted by a third party in writing or by any other means, unless required to do so for legal reasons (such as duty of care).
How is the information collected
Apart from exceptional circumstances, all information collected by us has been volunteered directly by you in face-to-face interviews, video calls, voice calls, e-mail, bank transfer, online payment or questionnaires/forms.
An exceptional circumstance refers to the rare occasion when a third-party individual or organisation discloses information to the Bath Couples Therapy Practice that we are legally obliged to store and process, such as safeguarding.
In order to maximise the security of financial Personal Data, the Bath Couples Therapy Practice does not store or handle any financial transactions. Client payments are made either online or via bank transfer. Online transactions are handled independently between clients, and two reputable and GDPR compliant organisations (10to8) and stripe, see Third Party Storage and processing for further information. From 10to8, stripe and our bank statements, we collect information about the amount paid to us, payment reference, name of payer and date of payment.
In accordance with best practice and the BPS Practice Guidelines, information shared with us is confidential unless a client (or both clients when Co-active Couples Therapy is provided) request(-s) disclosure to a third party, professional supervision requirement or in exceptional circumstances to comply with UK legislation. These limitations to confidentiality are further explained here:
- If a request is made by a client for their Personal Data to be shared with a third party, such as your GP or other professional, this will be discussed with you as part of a consultation to make sure we carry out your wishes as intended. You can decide what part of the information we store is to be disclosed and not to be disclosed. We will also ask for your written consent to share this information. If the data concerns more than one person, which would be the case for all therapy work carried out in Co-Active Couples Therapy, then we need written consent from both you. We may also ask for a written consent from the third party stating their willingness to receive the information before accepting the request. Please note that disclosure here only relates to information stored by us and our protection of the data thereof. Apart from any video or audio recordings of consultations, there are no restrictions set by us to your own acts of sharing information about our work together.
- In exceptional circumstances limitations to confidentiality apply, such as safeguarding, an order by a law court, and public protection. Before any disclosure is made and unless we are restricted by urgency, duty of care or other legal obligation, we will seek an opportunity to discuss it with you first and ask for your consent to disclose information. If we don’t have your permission to share information and we believe there is a serious and imminent risk to yourself or someone else then UK law and the BPS Practice Guidelines require that we inform an authority, such as a healthcare professional or the police, and share some Personal Data without your consent. In such an exceptional circumstance, only information relevant to managing the risk, or the issue to which a court order pertains, would be shared.
- In the exceptional circumstance the Bath Couples Therapy Practice or Dr Ryden needs to establish, exercise or defend our/his legal rights, we may have to disclose information to a legal entity.
- To ensure the adherence to professional standards and evidence-based practice, Dr Ryden (as is the same for all practitioner psychologists) has regular supervision with other qualified psychologists or therapists. In supervision, some of the work undertaken with clients is commonly discussed. If there is a necessity to disclose information that may fall under the category of Personal Data, this will be kept to a minimum, and will be anonymised as far as possible. Names will not be disclosed. Supervisors employed by the Bath Couples Therapy Practice are bound by their regulatory body’s rules of confidentiality and GDPR compliant.
Please note that for Co-active Couples Therapy to be conducted effectively and safely, the therapist cannot keep information disclosed by one partner hidden from their co-active partner, unless in the exceptional circumstance of serious and imminent risk of harm to someone. In Co-active Couples Therapy, confidentiality pertains to the non-divulgence of information shared in assessment and therapy to anyone outside the confidentiality group, namely the two partners and the therapist. Please note that this Privacy Notice only binds the therapist to confidentiality and we cannot be held responsible for breaches of confidentiality brought about by our clients about themselves.
How we store information
All data collected by the Bath Couples Therapy Practice are stored electronically and encrypted with a Strong AES-256 encryption. We do not store any Personal Data on paper or any other physical means of storage.
Third Party Storage and processing
Booking of appointments and all financial transactions are handled by 10to8, a reputable UK company. The transactions are carried out by stripe on behalf of 10to8. Stripe is a global online payment processor trusted by millions of small and large companies worldwide, including google, amazon and National Geographic. All common debit or credit cards can be used. The operations of 10to8 and stripe involve by their nature the collection, storage and processing of Personal Data. Both companies have their own Privacy Notices/Policies (10to8 and stripe), which we encourage you to read, and their data are fully encrypted with bank-rate security and compliant with GDPR.
As part of our service, there may be opportunities to benefit from supplementary third-party assessment and therapy tools and services. Those opportunities are optional. Some of those services may involve the collection and processing of Personal Data. The use of those services is at your own risk and we recommend that you read their Privacy Notices/Policies.
If you choose to communicate with us via electronic means, including voice/video phone and e-mail, you need to be aware that most of those third party services collect Personal Data. The safety, storage and processing of Personal Data collected by them are outside our control and not covered by this Privacy Notice. This also applies to use of optional third party links on our website. We endeavour only to make use of technologies and web links that offer high levels of data protection. However, we cannot accept any responsibility or liability for third party operations and encourage you to read their Privacy Polices/Notices before submitting any Personal Data, or if unsure, not use those third party services and links.
Security of information technologies
The Bath Couples Therapy Practice website
The Bath Couples Therapy Practice website is hosted by krystal, an award winning UK located company. In 2018, they won the Best Host "price for protecting their customers from emerging threats, including DDoS protection, but also for their charitable efforts.” The company is also “powered by 100% renewable energy.”
Data security of transmission
When working with us, we will aim to agree on the use of the most secure technology to which we have access, such as encrypted messaging. If you require a more secure service than Skype and Gmail, we can discuss the feasibility of using alternatives, such as ProtonMail.
Please note that any information disclosed by electronic means, such as e-mail and voice/video calls, are alas by their nature not completely secure. We cannot be held responsible for any breaches to data protection due to the use of electronic means of communication. We encourage you to not disclose any personal data via electronic means unless you are aware of the risks.
How long we store Personal Data
Information collected and stored as detailed in this notice are retained for a period of seven years as specified by the guidelines and requirements for record keeping by The British Psychological Society (BPS, 2017). After this time, the data is deleted.
Information collected and stored as part of general enquiries and not part of contracted therapy programme is not required to be kept for seven years and may be deleted earlier.
Under UK data protection law, you have the following rights:
- Access.You have the right to ask for a copy of your Personal Data stored by us. Please send us an e-mail with a request and stating your consent for it to be sent to you. You need to specify your preferred method of transmission and full details about where to send the copy. If the data in question have been collected from couples sessions as opposed to individual sessions, we need to have written consent from both partners to act on the request. The Personal Data collected in couples sessions pertain to both of you. To protect your data from any unintended or fraudulent dissemination, we reserve the right to check the authenticity of the request before acting on it, for example by contacting you first. When satisfied of the authenticity of the request, we have one month to respond to your request. You are not required to pay any charge for exercising this right. In accordance with the GDPR (2018), we reserve the right to ask for a clarification of the request or to refuse the request if it is manifestly unfounded or excessive.
- Rectification.You have the right to ask us to rectify Personal Data you think is inaccurate. You also have the right to ask us to complete Personal Data you think is incomplete.
- Erasure. You have the right to ask us to erase your Personal Data in certain circumstances. Please note we are bound by professional guidelines and requirements for record keeping to retain information collected for the purpose of carrying out psychological services for seven years.
- Restriction of processing.You have the right to ask us to restrict the processing of your Personal Data in certain circumstances.
- Object to processing. You have the right to object to the processing of your Personal Data in certain circumstances (we may decline to do this citing the lawful basis of legitimate interests).
- Data portability. You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you, in certain circumstances. If the data in question have been collected from couples sessions as opposed to individual sessions, we need to have written consent from both partners to transfer information. The Personal Data collected in couples sessions pertain to both of you.
If you have any questions or concerns about how we use your data, please do not hesitate to contact us by sending an e-mail to email@example.com. We will endeavour to resolve any concerns of yours as quickly as possible, and if relevant, make any reasonable changes that are legally and practically possible within our practice guidelines. If you are not content with our response, please contact Information Commissioner’s Office (ICO; Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF), helpline number: 0303 123 1113.
Changes to our Privacy Notice
The Bath Couples Therapy Practice may modify or update this Privacy Notice when necessary to reflect changes in our services, changes in applicable legislation, regulations or guidelines, or in response to feedback from you. Any changes we make will be posted on this page. Please return periodically to check for changes.