Privacy Policy

The River Psychology Group is dedicated to protecting your privacy and personal data. This privacy policy will outline the types of personal data we collect, including how it is processed and stored. The River Psychology Group is registered with the Information Commissioners Office (ICO [No. ZB734769 ]) and endeavours to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act (2018). Dr Lucy Fitton is the data controller and responsible for processing your personal data. 

It is assumed that by engaging in services with the River Psychology Group that you consent to records being kept. Record keeping is an essential part of the work we complete as it ensures we can offer the best possible service and care. 

General Principles for Data Processing at the River Psychology Group

·  We will only collect personal data for legitimate specified purposes. They will not collect data beyond what is necessary for these purposes.

·  We will take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and against all other unlawful forms of processing.

·  We will not sell or lease personal data to third parties.

·  Personal data will not be transferred to third parties, except as stated herein, unless prior consent is obtained.

·  Personal data will not be used for reasons other than for those that it was collected, except as stated herein, unless prior consent is obtained.

·  We will endeavour to ensure personal data is up to date by encouraging periodical verifications. You can request to update your personal data at any point. 

·  Personal data will not be kept for longer than is necessary. The length of time will vary depending on the type of information it is. Details obtained from initial enquiries where no further action or contact is made within two months will be deleted. Personal data relating to the psychological services are kept and processed for a period of seven (7) years from the last date of service, unless there is a legitimate reason where it is considered necessary to hold this for longer, such as pursuing legal claims. 

Personal Data We Collect and Process

The personal data that the we will collect may vary case by case but generally will include: 

·  Identity data – such as full name, date of birth, gender, title.

·  Contact data – including email address, postal address (if required), contact number, emergency contact details such as the details of GP or a family member.

·  Transaction data – including details about payments and purchases of services and insurance company details in cases where insurance payments need to be arranged.

·  Health data – including answers provided on questionnaires that might measure mental health or psychological traits. 

The allocated psychologist will keep brief notes on what is discussed in appointments. These notes do not constitute part of a health record. These notes will not be disclosed to anyone unless ordered by a court of law. You have the right to request a copy of records kept by us. A small administration fee may be charged for this if the request is considered excessive or a significant administrative task.

Personal data may be collected through information that you provide to us via email, SMS, in face-to-face, or other verbal contact (online, telephone). Where applicable, your personal data may be provided to us by a referrer or other professionals involved in your care.

Technical data may be collected, this includes the Internet Protocol (IP) address used to connect your computer to the internet, time zone settings, operating systems, and browser type. Behaviour information is collected via use of cookies to remember website preferences and understand how our website is being used. You are able to refuse and restrict the use of Cookies, for more information see the ICO https://ico.org.uk/for-the-public/online/cookies/

We may engage third parties to perform service-related requests or help us understand how our services are being used. This might include analytic providers or specialists in payment and technical services. In these cases, we may receive data about you from these third parties or they may have access to personal data required to perform specific tasks. In these cases, third parties are not permitted to disclose or use data for any other purposes. 

Financial data, such as card payment details, will not be collected. 

Personal data may be used to facilitate or improve our services. We might contact you for feedback on their services or use existing non-identifiable anonymised data for this purpose.

How We Store Personal Data

We take the security of personal data seriously. It is important to note, however, that no method of electronic storage and transmission over the Internet is 100% secure. We strive to protect your personal information and will make attempts to do so, but cannot guarantee absolute security.

Your personal data will be kept within your client record which will predominantly be electronic, however, in some instances paper notes may be kept. Any identifiable written information will be stored in a locked cabinet. Identifiable electronic information will be stored on a secure cloud service and documents with personal data will be password protected. 

All electronic devices used to access stored information will be password protected

For video and audio calls, only secure and encrypted servers will be used. The transmission of information via the internet cannot be guaranteed as completely secure and use of video platforms is at your own risk. Video sessions are not recorded, unless otherwise agreed and consented to for a justifiable reason such as training purposes.

The exchange of emails may not be secure. If a psychologist shares personal or sensitive information with you via email, appropriate steps will be taken to ensure security such as encryption or password protection. It is recommended that if you send the psychologist information of a similar nature that you adopt additional security measures also. 

We may provide links and resources from other sites that are not operated by us. We strongly suggest that you review the Privacy Policies of each site you visit, as we have no control over, and assume no responsibility for the content, privacy, or practices of third party sites or services. 

Sharing of Personal Data

Personal information may be shared for clinical reasons with other third parties, such as a GP, however your consent will be sought for this first, unless in circumstances where there are significant concerns of risk to yourself or others. 

Personal Information may be shared with third parties in order to establish, exercise, or defend our legal rights. 

Your information may be shared with other third parties subject to your consent.

Your Rights 

You have the right to request for their personal information to be deleted under the right for erasure. They can request this in person or in writing. Please note that as a consequence of erasure of your data we may no longer be able to meet future requests or provide a service. 

If you would like to complain about a privacy breach, please contact us in writing via email. We will endeavour to resolve it as quickly as possible and let you know the anticipated time-frame for this. You have the right to make a complaint to the UK supervisory authority for data protection, the ICO www.ico.org.uk