At Stepping Stones, we take GDPR and confidentiality very seriously indeed.

At your first session, your therapist will provide you with more information around both areas, however here are some answers to commonly asked questions:

​

​

What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?

 

The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange.

 

How long will you hold my information for?

 

Our therapists are regulated by either the BACP, NCS, UKCP and UPCA and the business is insured by Oxygen, although individual therapists also hold their own insurance too. We are consequently regulatory bound to hold your data for 10 years* after your final session. This is unless you are a child, in which case we must hold your data until your 25th birthday. If you are 17 when treatment ends we must keep your data until your 26th birthday. All records will be deleted in the January after the above retention scales. This is in line with wider NHS regulations for holding data.

​

What if I don’t want my records to be held for that long?

 

Under the GDPR you can make a request in writing to your therapist, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. We would have to save the request for deletion you made but would not save any other data.

 

In some circumstances our insurance companies legal team may want to verify information we process.

 

Why do you need to record this information?

 

We collect information about; why you are using the service, a small amount of medical information and a small amount of information about your important others, alongside brief session notes. This information enables us to provide a high quality service to you, ensuring we are equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and other details will only be used with your explicit consent. Please see the consent form you are provided with by your therapist.

We also have some third party services that collect information that cannot identify you, when you visit this website. This lets our leadership team know how many visitors visit the website, what country they are from, and how long they spend visiting our website.

 

What lengths are made to ensure my information is held securely?

 

Hardcopy documents – Are all stored in a locked cabinet in a locked room.

Online 'cloud' storage - All documents are password protected, and stored within a password protected and encrypted 'cloud' server.

Text messages – All work phones are secured with a pin code.

Emails – Our email accounts requires a user name and password.

Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via separate message.

 

Is what we discuss kept confidential?

 

Everything you and your therapist talk about during sessions is strictly confidential between you and your therapist. To ensure we are all doing our jobs effectively and that we have the right support, your therapist may discuss elements of your sessions with their supervisor. During these discussions therapists do not disclose any details that may identify you to their supervisor, and their supervisor also adheres to the GDPR framework.

 

What if I see you outside of the session?

 

If you see your therapist outside of a session our ethos is that the therapist may smile at you but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but we are obligated by GDPR law to ensure your confidentiality is protected. We also ask that you do not disclose the identities of any other clients, should you happen to see another client on our premises.

 

We would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with your therapist outside of your sessions.

 

What about other Health and Social Care Professionals?

 

As we adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. e.g. If your therapist were to write to your GP to notify them of your treatment with them, and then notify them of the treatment ending, they would only do this if you were to sign the specific consent for this at the end of this document. Your therapist will also ask you to sign a copy of the document to confirm that you agree to the details contained in the document, before it is then shared.

 

Exceptions:

 

In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under your therapists “Duty of Care” they are obligated by law to inform the relevant authorities. This is to support you to live well, and your therapist would always aim to discuss this with you prior to contacting anyone.

 

If your therapist, or the service, was issued with a police warrant or court order for your information, by law we would also have to provide them with your information. 

 

DPO - Data Protection Officers

 

Our Directors act as our Data Protection Officers, oversee our GDPR compliance to ensure that we adhere to the highest standards of GDPR here at Stepping Stones Counselling and Psychotherapy Limited.