GDPR

General Data Protection Regulation (GDPR)                                                      

Introduction

I aim to be as clear as possible about how and why I use information about you/your child, so that you can be confident that your privacy is protected. This policy describes how I collect and manage your information when you use my services.

This information includes personal information (data) as defined in the General Data Protection Regulation (GDPR) 2016 and the subsequent UK Data Protection Bill, 2018. I use the information I collect in accordance with all laws concerning the protection of personal data, including the Data Protection Act 1998 and the GDPR 2016.  I am the data controller for the information that you give to me as per these laws.

The GDPR requires that I identify the legal basis upon which I process your personal data. I shall provide psychological services and all associated activities on the basis of:

  1. My contract with you
  2. My legitimate interest to hold and process your personal data.

What is meant by ‘The contract’?

When an assessment or consultation is requested, the client is asked to read and sign my Terms and Conditions. That document describes the work that I will undertake and, by signing the document, you enter into a contract with me to do the work. I will process all personal data that you share with me (for the purpose of completing an assessment or consultation) lawfully, fairly and in a transparent manner. It will be necessary for me to process your personal data in order to fulfill the contract with you.

What is meant by ‘Legitimate Interest’?

I need to process your personal data to provide psychological services to you/your child. Educational psychology assessments/consultations involve the processing of special category data, including information, for example, about your child’s health, cognitive functioning, social and emotional issues and family history. I have a ‘legitimate interest’ to collect such personal data for the purpose of forming a well-informed professional opinion. I will only collect information from you that is relevant for the process of providing the psychological services that you have requested.

Why do I need to collect your personal data?

In order to carry out an effective assessment or consultation, I need to collect information about you and / or your child so that I may:

  • Communicate with you in a personal way. The legal basis for this is a legitimate interest.
  • Deliver services to you/your child, for example by preparing a relevant assessment and providing well informed psychological advice for your child. The legal basis for this is the contract with you.

What personal information do I collect and when do I collect it?

To provide a helpful psychological service I need to know your child’s situation and the concerns that led to the request for psychological support. This data is usually collected by the parents completing a  Pre-assessment questionnaire. Some parents may choose to provide additional information in writing or verbally. Information requested on the consent form includes:

  • Name and contact details of parents
  • Name, date of birth and school of the child
  • A summary of the child’s current strengths and difficulties
  • What strategies / interventions have already been tried with the pupil
  • Why psychological services have been requested
  • Information about other factors that may impact on the child’s situation including family history of learning difficulties and/or challenges, early development, medical issues, home life, social & emotional skills and behavioural observations.

In order to gain a holistic picture of the child it is also helpful to receive information from the child’s school and other professionals that have been involved. This information can include:

  • Child’s name, date of birth and school .
  • A summary of the child’s current strengths and difficulties
  • Strategies / interventions already been tried with the pupil
  • Why psychological services have been requested
  • Educational information and attainments
  • Social, emotional and behavioural observations
  • For pupils approaching GCSEs or other public exams where it is thought that the pupil may need Access Arrangements (e.g. additional time) agreed by the Joint Council for Qualifications (JCQ), the school may need to send a completed Form 8 as devised by the JCQ.

No data will be requested from school or other professionals without written permission from parents.

How do I use the information that I collect?

  • To communicate with you, to arrange appointments, discuss your concerns and arrange an appropriate course of action.
  • To prepare a relevant assessment / consultation for your child. It will help me to decide what assessments to use and what approaches I should take with the child. Background information about the child’s situation is important so that I am aware if the child has experienced trauma or other issues that may affect their emotional well-being or ability to learn. It is helpful for me to see previous reports from other professionals, in order to put my work in context with the child’s development over time.
  • Where relevant, information provided by others (e.g. parents, school, health professionals etc.) will be included with the data I collect during assessment and I will write a report summarising pertinent information.

Where do I keep the information?

  • Data is usually received by post or by email. Paper records will be filed and kept in a locked filing cabinet.
  • When data is received by email, attachments will be saved in the pupil’s electronic file and then the email will be deleted. If any personal data is included in the body of the email, a copy will be saved in the pupil file and then the original deleted from my inbox. Parents and schools are advised to send personal data password protected.
  • Electronic information will be stored on an encrypted PC  which is password protected. All personal data relating to pupils or their parents will be stored on the C Drive and so will only be able to be accessed from the PC.  At the end of each session, a copy of any current work will be saved  in a password protected folder.
  • Each week, all pupil files will be backed up on a separate memory stick, in a password protected folder. This will be locked in a filing cabinet.
  • When the information is needed to conduct an assessment, my laptop and paper files will be kept in a travel bag. This will be locked with a combination padlock whenever the case is left unattended e.g. in a school office. This bag will not be left overnight in a vehicle.
  • Should your personal data that I control be lost, stolen or otherwise breached, where this constitutes a high risk to your rights and freedoms, I will contact you without delay. I will explain to you the nature of the breach and the steps I am taking to deal with it

How long do we keep the information?

  • The report will provide a detailed summary of my involvement. Once a report has been completed, any handwritten notes will be securely destroyed by using a shredder. Paper record forms, writing samples and other assessment materials may be kept for up to three months in case questions are raised about the process of the assessment. They will then be securely destroyed by shredding.
  • Parent consent forms and electronic files (including pupil reports) will be retained for a period of seven years so the report may be referred to if the pupil is reassessed in the future. Parental consent forms are kept, so that I have a record of the parents’ agreement for me to have worked with their child. After a period of seven years all remaining records will be securely destroyed, unless I continue to be directly involved with the case and there are strong reasons for retaining historical data. E.g. to track strategies and interventions over time.
  • Please note it is the parents’ responsibility to retain copies of the report, because I will only retain the data for seven years.

Who do we send the information to?

  • Where parents have given their agreement I will  contact the pupil’s school to arrange appointments. School staff are typically invited to join a feedback meeting where the assessment is discussed, again with parental permission.
  • Assessment reports are typically only sent to the parents, unless the school has commissioned (i.e. paid for) the assessment, in which case a copy will also be sent to the school.
  • Reports will be sent out by email using EGRESS to the commissioning parent(s).  If the parent(s) are happy to share the report, it is their responsibility to forward it to the child’s school and any other relevant professionals.
  • All reports will be in ‘read only’ PDF format so no changes may be made. They will not be password protected as EGRESS encrypts the reports. Parent will need to download a free copy of EGRESS to open the email.

Will we send emails and text messages to you?

  • I will only contact you in response to a request for psychological services that has been initiated either by you or the school. This would usually include emails or phone calls to discuss your current concerns and arrange appointments. I will also email an invoice to you and the assessment reports.

What happens to your data if I were to die?

  • In the event of my unexpected death all pupil data will be confidentially destroyed by the executors of my will.

Your rights

As I process your personal data, you have certain rights. These are a right of access, a right of rectification, a right of erasure and a right to restrict processing.

  • You may request a copy of your data at any time. Please make such a request in writing or by email to me, Tonia Robinson, the Data Protection Officer. Please provide the following information: your name, address, telephone number, email address and details of the information you require.
  • If you believe any of the personal data I hold on you/your child is inaccurate or incomplete, please contact me directly and any necessary corrections to your data will be made without undue delay.
  • If you believe I should erase your data, please contact me, Tonia Robinson
  • If you wish me to stop storing or using your data, please contact me.
  • Where you have provided explicit consent for me to use your data, you have a right to withdraw this consent at any time.

If your questions are not fully answered by this policy, please contact me directly in my role as Data Protection Officer for Psychology Solutions.  If you are not satisfied with the answers I provide, you may contact the Information Commissioner’s Office (ICO) https://ico.org.uk

Click here for further information, costs and fees.