Data Control and Processing

I, Lauren Jacobs, am the Data Controller and Processor of Lauren Jacobs Therapy.

Your privacy is very important to me. I keep client data on the basis of “Legitimate Interests”. This means that the data is necessary for me to fulfil the contract that we have together (i.e. for me to provide therapy to you) and that it is data that you would reasonably expect me to hold and use.

If you enquire about therapy with me, the data I hold includes any information you have sent me by email, text, webform or voicemail message.

If you book and attend at least one session, the data I hold includes:

• Basic information such as name, email address, phone number

• Information that you give me as part of the work we do together

• Records of what interventions I use (or potentially do not use) in our sessions

• Emails, texts and/or messages that are sent between us

• Information sent from any third party, e.g. GP, insurance company, EAP, occupational health provider.

Some of the information you give me may meet the definition of special category of data as defined by the General Data Protection Regulation. The condition for processing this category of data is “processing is necessary for medical diagnosis, the provision of health care or treatment pursuant to contract with a health professional”.

Data is not shared with anyone, except possibly your GP in very limited circumstances and usually with your prior consent. Or for any reasons other than those set out in my Client Consent Form, which includes circumstances under which I am required by law to make disclosures, such as the Money Laundering regulations.

The data is primarily used to enable me to provide therapy for you. It may also be used for statistical and accounting purposes.

Details of where data is held

Any emails sent between us are held on my computer’s hard drive or exchange server or, if archived, in Dropbox, which is secure cloud-based storage which is itself GDPR compliant. Any emails held on my mobile phone, or accessible via it, are passcode protected.

Any texts, WhatsApp messages or Messenger messages sent between us are held on my mobile phone, which is passcode protected.

Any handwritten notes of our sessions are kept in a locked filing system. An anonymised method of coding enables me to know whose notes are whose, while ensuring that a stranger seeing the notes would not be able to identify who they related to.

If you use online banking or payment systems such as PayPal, Stripe or Revolut, these systems will hold your data. I download information from these systems for accounting purposes and these reports are held securely on my computer and in Dropbox.

If you see me via the Wellbeing Centre London, dates of our sessions will be shared with the owner of the centre for reporting and billing purposes, but no other data is shared to the centre by me after the point of referral other.

Your data is kept for 7 years. After this time any paper records are shredded and computer records permanently deleted.

I take the security of your data seriously

• All data is held securely (see details above)

• Any data transmitted is sent encrypted where possible

• For accounting purposes password-protected Excel spreadsheets are used

However:

• I am not in control of data (including emails and texts) which you send me

• Apps such as Facebook routinely access any information held and this is beyond my control

If there is any breach of data security, I will provide full details to the Information Commissioners Office and any person affected within 72 hours of the breach and do everything possible to minimise any potential impact.

You have rights over the data I hold

• The right of access. I will provide you with all data I hold on you as soon as I can following a request (and no longer than 30 days, unless this is impossible due to holidays or illness).

• The right to rectification. If any data I hold is incorrect, you can ask me to correct it and I will do so as soon as I can following a request (and no longer than 30 days, unless this is impossible due to holidays or illness).

• The right to erasure. If you wish me to erase your data I will delete any computer records and shred any paper records as soon as I can following a request from you (no longer than 30 days, unless this is impossible due to holidays or illness). NB: data may be retained for scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing but this would never include case notes or data such as address/email/phone.

• The right to restrict processing. This would usually be an interim measure before correction of any errors or before erasure.

• The right to data portability. This might apply if you want your notes sent to another therapist for example, but it is likely that in most circumstances this would be handled under the right to access, i.e. I would send the data to you.

• The right to object to:

  • Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling). This does not apply to the services I offer.

  • Direct marketing.

  • Processing for purposes of scientific/historical research and statistics. For this, you must provide grounds for your objection.

  • Automated decision making and profiling. I do not engage in automated decision making or profiling.

Use of cookies

My website, like many, uses cookies. A cookie is a small amount of data that is sent to your computer or mobile phone browser from a website and is stored on your device’s hard drive.

Cookies record information about your online preferences. They help you navigate my site more easily if you have visited before and help me understand how visitors engage with my site, so I can provide you with an optimal online experience. I do not use cookies to collect personally identifiable information about you.

Each website you visit can send cookies to your browser if your browser’s preferences allow it. To protect your privacy, your browser only allows a website to access the cookies it has already sent to you, not any cookies sent to you by other websites.

Controlling cookies

You can restrict or block cookies from my website, or any other website, through your browser settings. You can also ask your browser to alert you when a cookie is issued.

I use Google Analytics to understand how visitors engage with my website. It collects information anonymously and reports aggregate data without identifying individual visitors. For more information refer to Google Analytics privacy and security information.

© 2024 Lauren Jacobs Therapy