Privacy Notice | Shane Joshua

Privacy Notice & Records Retention Policy

1. Introduction

At Shane Joshua Counselling, I am committed to protecting and respecting your privacy. This notice explains how I collect, use, store, and protect your personal data and clinical records when you use my services, visit my website, or contact me.

For the purposes of the UK General Data Protection Regulation (UK GDPR), I, Shane Joshua, am the Data Controller for your personal and sensitive data. I am registered with the Information Commissioner’s Office (ICO) under registration number [Insert Your ICO Number].

2. The Information I Collect

To provide safe and effective psychotherapeutic counselling, I need to collect two types of data from you:

Personal Data: Your name, date of birth, address, phone number, email address, emergency contact details, and GP practice details.
Special Category Data: As a therapist, I process sensitive data regarding your physical and mental health, including intake assessments, clinical session notes, and any relevant medical or psychological history.

3. Lawful Bases for Processing Data

Under the UK GDPR, I rely on the following legal grounds to handle your data:

Contractual Necessity: To provide the therapy services you have requested and agreed to engage in.
Legitimate Interests: To run my practice day-to-day (e.g., booking appointments, responding to enquiries, or managing billing).
Health and Social Care (Special Category Data): I process your health data under Article 9(2)(h) of the UK GDPR, which allows for the provision of health or social care treatment, bound by professional confidentiality.

4. How I Store and Protect Your Data

Your privacy and security are paramount. I employ strict security measures to protect your information:

Digital Records: I store any digital documentation, communication, or invoices on encrypted, password-protected devices or secure, GDPR-compliant cloud servers.
Paper Records: Any physical documents or handwritten session notes are stored securely in a locked filing cabinet.
Anonymisation: To add an extra layer of privacy, I pseudonymise your clinical notes, meaning I mark them with a unique code or your initials rather than your full name.

5. Records Retention: How Long I Keep Your Data

I do not keep your information longer than is necessary. My retention periods align with UK legal and professional indemnity insurance requirements:

Adult Client Records: I retain clinical notes, intake forms, and correspondence for 7 years after your final therapy session. After this period, I securely destroy them.
Young Person Records: If you are under 18 when therapy ends, your records are retained until you turn 25 (or 26 if you were 17 at conclusion).
Enquiries and Contact Forms: If you contact me via my website or phone but do not begin therapy, your contact details and message will be permanently deleted after 12 months.
Financial Records: I keep invoices and payment receipts for 6 years from the end of the financial year to comply with HMRC tax requirements.

6. Sharing Your Information (Limits to Confidentiality)

All communication between us remains strictly confidential. However, there are a few legal and professional exceptions where I may be required to share your data:

Clinical Supervision: In line with professional ethical requirements, I regularly discuss my clinical work with a qualified supervisor. Your identity is always kept anonymous during these consultations.
Safeguarding & Risk of Harm: If I believe there is a serious and immediate risk of significant harm to yourself or someone else, I may need to contact external services (such as your GP or emergency services). I will always endeavour to discuss this with you first.
Legal Obligation: I may be legally required to disclose information if ordered to do so by a court of law, or under specific statutory obligations such as terrorism or money laundering legislation.

7. Your Data Rights

Under data protection laws, you have specific rights regarding your personal information. You have the right to:

Access: Request a copy of the personal data and clinical notes I hold about you (a Subject Access Request).
Rectification: Ask me to correct any information you believe is inaccurate or incomplete.
Erasure: Request that I delete your personal data (please note this right does not override my legal and insurance obligations to retain clinical records for 7 years).
Restrict Processing: Ask me to restrict how your data is used under certain circumstances.

8. Contact & Complaints

If you have any questions about this policy, or if you wish to exercise any of your data rights, please contact me directly:

Name: Shane Joshua.
Phone: 07766108280
Email: [Insert Your Professional Email Address]

If you are unhappy with how I have handled your data, please voice your concern with me first so I can try to resolve it. If you remain dissatisfied, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.