Privacy Notice
I, Dr Laura Shepherd, am a sole trader offering Clinical Psychology services. This privacy notice explains how I use any personal information I collect about you, as a service user (client, patient or supervisee) or when you use my website.
I provide psychological assessment (including expert witness/medicolegal assessments), therapy and supervision services and am based at the Dronfield Health and Therapy Clinic, Dronfield, S18 1PY. This privacy notice provides information about the personal information I process about you as a data controller, in compliance with the General Data Protection Regulation (GDPR).
My ICO registration number is Z2083495.
Please contact me at enquiries@laurashepherd-psychologist.co.uk with any questions or requests about the personal information I process.
1. What are your rights?
I am committed to protecting your rights to privacy. They include:
• Right to be informed about what I do with your personal data
• Right to have a copy of all the personal information I process about you
• Right to rectification of any inaccurate factual data I process, and to add to the information I hold about you if it is incomplete
• Right to be forgotten and your personal data destroyed
• Right to restrict the processing of your personal data
• Right to object to the processing I carry out based on legitimate interest
2. Why do I collect information about you?
I will collect information about you if you are a client, patient or supervisee. This includes you if you are an individual I assess as part of a legal or litigation claim.
I process data because it is in the legitimate interests as a Clinical Psychologist or expert witness to do so. I need to see and analyse documents containing this information in order to provide an expert advice, to carry out an assessment or to deliver psychological interventions.
As a client or patient my lawful reason for processing “special category data” is that it is necessary for the purposes of the provision of health or social care or treatment.
Another lawful reason for me processing your data may be Legal Obligation. If I am processing “special category data” about you, this is my second lawful reason to do so. This is likely to apply if you are being assessed as part of a litigation claim.
3. What information do I collect about you?
I collect information about you that may include personal or sensitive information, such as:
• First name or given name
• Family name or surname
• Address
• Telephone numbers
• Date of birth
• Gender (or preferred identity)
• Age
• Date of Birth
• Relationships & children
• Occupation
• Telephone/SMS number
• Email address
To make sure that you are assessed and/or treated or supervised safely and appropriately, I record your personal information, such as your name, address, as well as details about all contacts you have with me such as appointments or supervision sessions and the results of assessments and letters relating to your care/report. Your data is kept secure at all times.
I also process personal data pursuant to legitimate interests in running my business such as:
• Invoices and receipts
• Accounts and tax returns
Patients/Clients (Assessment/Therapy)
When you are a patient or client of I record all details of your appointments and assessment/treatment so that I can plan and review your treatment correctly. In addition to the personal information above, I may also collect information regarding:
• Medical conditions
• Prescribed medication
• Psychological history and current difficulties
• Sexuality
• Offences (including alleged offences)
• Financial information (if you are a private patient/client)
I may collect some of this information from your insurance company if you have one, and some of this information will be collected directly from you.
Clients seen for Court reports
In the case of a court report I retain the information as required by the Court or your solicitor.
In addition to the personal information above, I may also collect information regarding:
• Medical conditions
• Prescribed medication
• Psychological history and current difficulties
• Sexuality
• Offences (including alleged offences)
I may be given some of this information from your solicitor or the party instructing me for the purposes of litigation, and some of this information will be collected directly from you. In many cases, an individual has consented to the transfer of their personal data to me. Where an individual has consented, he or she may easily withdraw it by notifying Dr Laura Shepherd at enquiries@laurashepherd-psychologist.co.uk.
Web access collection of information
I collect information about you when you contact me via my website. I always try to minimise the amount of personal information that I require in order to provide a specific service or feature.
4. How do I store the information about you?
I take your privacy very seriously.
I am committed to taking reasonable steps to protect any individual identifying information that you provide to me. Once I receive your data, I make best efforts to ensure its security on my systems. This includes storing hard copies of paperwork in locked filing cabinets with restricted access and storing electronic information on encrypted devices which are backed up. Please see my security policy for further details.
All personal information and special category information provided is stored in compliance with EU General Data Protection Regulations (GDPR) rules.
5. How long do I keep your information for?
I do not keep your data for longer than is necessary.
Administrative data is retained for up to six years as necessary, in the event there are queries from HMRC. Where it is not necessary to retain the data for six years, it is destroyed as soon as possible.
Personal data is retained, as necessary, for seven years in compliance with professional indemnity and legal obligations. In patients under the age of 18 years, data is retained for seven years after the age of 18 years.
6. Who do I share your personal information with?
Your information is kept confidential wherever possible.
However, if I become aware of your intent to cause harm to another person/organisation (e.g. terrorism), the law may require that I inform an authority without seeking your permission. In such a situation, the law may require that I share your personal information without your knowledge.
By contacting me, by email and/or using the address below, you can also get more details on:
• agreements I have with other organisations for sharing information;
• circumstances where I can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
• how I check that the information I hold is accurate and up to date.
Patients/Clients (Assessment/Therapy) and Supervisees
In most circumstances I will not disclose personal data without consent.
If I do need to share your information, I will always try and ask for your permission for this. I may not be able to ask your permission under special circumstances where I am professionally and/or legally required to do so.
Your information may be shared with outside organisations if they are directly involved in your care/case, for instance, your insurer if they are funding your treatment, your GP, or others involved in your care. I will discuss with you who I would discuss your care with, and what details I would share with them.
If I believe that you or others are at serious risk of harm, either from yourself or others, or if you are at risk of harming others, I will share your information with an appropriate professional (e.g. GP, mental health service, or emergency service).
If you are a supervisee, I will collect sensitive data related to your psychology practice. This data may be shared with a third party if I am legally or ethically obliged to do so (e.g. if instructed to by the Court or if we have concerns about malpractice and need to report to a professional body).
When investigating a complaint I may need to share personal information with other relevant bodies.
Clients seen for Court reports
In addition, I do not share personal data with anyone external, other than with:
• Those who have instructed me as an expert witness
• Outsourced service providers such as photocopying companies and digital dictation services, pursuant to GDPR compliant written contracts
• With others pursuant to a Court order
7. How you can access your information and correct it, if necessary?
I try to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if I hold any personal information by making a ‘subject access request’ or ‘Right of Access’ under the Data Protection Act and the General Data Protection Regulation. I will then supply to you:
• A description of all data I hold about you
• Inform you how it was obtained (if not supplied by you)
• Inform you why, what purposes, I am holding it
• What categories of personal data is concerned
• Inform you who it could be disclosed to
• Inform you of the retention periods of the data
• Inform you around any automated decision making including profiling
• Let you have a copy of the information in an intelligible electronic form unless otherwise requested.
You can make a request in any way, in writing or verbally. I want to make sure that your personal information is accurate and up to date. You may ask me to correct or remove information you think is inaccurate.
8. Right to erasure, otherwise known as the right to be forgotten
Under GDPR, you may have the right for information to be erased if this is within professional and legal parameters.
Clients seen for Court reports
If your concern is related to a case with a solicitor that I am working for, please refer queries through them. I may not be able to comply with a request to correct information I hold about you where it pertains to a litigation claim – this would need to be discussed with your solicitor.
9. Complaints or queries
I try to meet the highest standards when collecting and using personal information. For this reason, I take any complaints I receive about this very seriously. I encourage people to bring it to my attention if they think that my collection or use of information is unfair, misleading or inappropriate. I would also welcome any suggestions for improving procedures. If you do have a complaint, contact me.
If you are not satisfied with the response from me or believe I am not processing your personal data in accordance with the law you have the right to raise your complaint with the Information Commissioner’s Office (ICO)
Contact information ICO:
Website: https://ico.org.uk/concerns/
Email: casework@ico.org.uk
Telephone: +44 (0) 303 123 1113
10. Who am I and how to contact me
Dr Laura Shepherd is the company (sole trader) that you are supplying your personal information to. I can be contacted by:
Email: enquiries@laurashepherd-psychologist.co.uk
Post: Dronfield Health and Therapy Clinic, 24 High Street, Dronfield, Derbyshire, S18 1WD
11. Other related information
In addition to this Privacy Notice, I have a Data Protection Policy, Data Breach Policy, Data Subject Request Policy and Security Policy. These are available via the links or hard copies upon request.