Data held by Lesley Simpson-Gray Psychotherapy will be held lawfully and for the retention periods set out in section B of this policy document.
This document refers to:
Hardcopy case notes and files
Visits to the organisations website
Social media communication
Aim and Purpose
The purpose of this document is to ensure that Lesley Simpson-Gray Psychotherapy has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.
Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
is the right information
is in the right place
at the right time
with the right people
for the right reasons
This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. Lesley Simpson-Gray is fully committed to ensuring clients privacy and data protection rights.
For the purpose of this policy Lesley Simpson-Gray is the named Data Protection Officer/Controller and Head of Organisation.
Information Governance Framework Principles for Lesley Simpson-Gray Psychotherapy
1. Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75 minute GDPR CPD Course provided by the Clinical Hypnotherapy School (www.clinicalhypnotherapyschool.com) completed. Refresher training is completed every two years.
2. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised. e.g. you will write a risk assessment detailing how you will minimise the loss of data should you choose to change the way you hold your clients data, such as changing from using one electronic database software, to another.
3. Any data collected is solely for the purpose of providing a person-centred service to an individual client. If you collect data for any other purpose you will need to note it here e.g. for research purposes
4. The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. (
5. All technology used to store or facilitate information and communication is maintained according to the Data Retention Policy for Lesley Simpson-Gray Psychotherapy
6. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
7. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
9. Any electronic devices where personal or sensitive, confidential information is held will be password protected.
10. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.
Privacy Notice: Use of information
In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisations website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
Any document containing personal data will state “private and confidential” clearly.
All emails will contain a privacy statement.
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restrict processing;
the right to data portability;
the right to object; and
the right not to be subject to automated decision-making including profiling.
Please note that Lesley Simpson-Gray Psychotherapy does not use automated decision-making tools, including profiling.
If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing.
When an individual visits I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Lesley Simpson-Gray Psychotherapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed. Google analytics privacy notice can be found at: //policies.google.com/privacy/update?hl=en
Wix is a third-party service that hosts Lesley Simpson-Gray's website. Wix also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website. Wix privacy notice can be found here for further information:
Lesley Simpson-Gray uses a third-party provider, Hootsuite, to manage its social media interactions. Any messages sent to the inbox of social media accounts are stored by Hootsuite and permanently deleted after three months. Their Privacy notice can be found here: https://hootsuite.com/en-gb/legal/privacy#.
Virtual Sandtray is a tablet based virtual sandtray application which is used by Lesley Simpson-Gray as a new media interpretation of a physical sandtray.
Sharing trays: encrypted versions of them are stored on servers operated by Virtual Sandtray in order to facilitate them being utilized by the colleague you specified when sharing. The trays are sent through encrypted communications. The share life span is 7 days on the server, they are forever deleted after the expiry period. Lesley Simpson-Gray will be responsible for the removal of identifying information from the saved tray before sending, such as the client's name being in the filename. Before clients download a shared tray onto their device, they are given the opprotunity to rename it to any valid filename of your choosing or accept the tray's name as sent. It is up to the sender of the tray to utilize a filename that reflects and satisfies both of your requirements for privacy and security before being sent. Virtual Sandtray's privacy notice can be found here:https://www.sandtrayplay.com/Pages/privacy.html#gsc.tab=0
Simply Sand Play is a cloud-based or installable sandtray, made by and for counsellors. The carefully curated asset library is conveniently organised, promoting imaginative expression without overwhelming the user. Simply Sand Play does not collect any personal health information therefore there is no data to be HIPAA compliant. Simply Sand Play does require the therapist with a subscription to log in. The login credentials are only used to verify that the user has an active subscription. Simply Sand Play'sprivacy notice can be found here:
Chrome Music Lab
Chrome Music Lab is a website that makes learning music more accessible through hands-on experiments. All experiments are built with freely accessible web technology such as Web Audio, API, WebMIDI, Tone.js and more. These tools make it easier for coders to build interactive music experiences. You can get the open-source code to lots of these experiments.
Patatap is an interactive instrument that lets you create compositions (animations and melodies together) with your computer keyboard or tablet device. It is a portable animation and sound kit which allows users to create melodies charged with moving shapes. Patatap invites creators of all ages to engage the mind and senses in a different type of creation process. The motivation behind Patatap is to introduce the medium of Visual Music to a broad audience.
Patatap does not collect personal information, e.g: name, phone number, address, email address, etc.
Patatap tracks which buttons are pressed for the sole purpose of understanding how people use Patatap in aggregate
For any further questions contact email@example.com
Incredibox is a music app for creating your own music with the help of a team of beatboxers. It is part game, part tool, Incredibox is an audio and visual experience that introduces kids and adults to rhythm and melody. Clients will use an ad-free app version of the software.
The app is designed by SO FAR SO GOOD - whose data policy states that data is kept as long as is necessary to provide you with the Incredibox experience. Data can be deleted from our servers when it is no longer needed within a reasonable time limit. On your request, we can delete your personal data so that it no longer identifies you, but keep in mind that this will prevent you from accessing some Incredibox features, such as saving, replaying, and sharing your mixes. So if you have decided to not use our service anymore, or if you just want to delete some information, please contact us.
ProReal is an avatar-based, virtual-world software platform which helps people communicate by accelerating insight and change. The software is used by Lesley Simpson-Gray, who is a trained ProReal facilitator, with online or face-to-face, clients use a PC, laptop or tablet to enter a secure, virtual landscape. ProReal is used to manipulate avatars and props to create visual representations of real-world scenarios.
How ProReal handle your data when you use the ProReal software
ProReal may need to keep a record of your name and email address so that you can sign into the software. They do not use this data for any other purposes.
ProReal collect data about how you use the software. This includes the time accessed, which link was used to start ProReal, and what version is used. This is used for aggregated reporting and technical support. They do not use this data for any other purposes.
ProReal ‘World’ data
Data which you create using the ProReal software is usually stored on your device. You can remove this by deleting it.
If you share data using ProReal, it is stored on ProReal's server so that the other participant(s) can see it. You can remove this by deleting it, or by asking ProReal to delete it for you. Any data you don’t access for more than 90 days is deleted by ProReal.
ProReal don’t read any data you store on their servers, except where you ask them to do so (e.g. for technical support). They do not use this data for any other purposes.
When ProReal store your data, they do so only on EU-based servers. They will not knowingly transfer your data outside the EU unless they have your explicit consent.
ProReal's privacy statement can be found here:https://www.proreal.world/privacy/ or by emailing
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
Click here for Lesley Simpson-Gray's Retention Schedule
What are the lawful basis for processing data at Lesley Simpson-Gray?
In relation to communicating with my clients: The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
Processing is necessary for your legitimate interests as specified in Article 9 of the GDPR;
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
This means that Lesley Simpson-Gray Psychotherapy does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
Lesley Simpson-Gray processes personal information to enable the provision of Psychotherapy, to enable the provision of Professional Training services, to advertise services and to maintain accounts and records.
Psychotherapy - Type/classes of information processed
Lesley Simpson-Gray processes information relevant to the above reasons/purposes. This information may include:
family, lifestyle and social circumstances
goods and services
employment and education details
Lesley Simpson-Gray Psychotherapy also processes sensitive classes of information that may include:
physical or mental health details
racial or ethnic origin
religious or other beliefs of a similar nature
offences and alleged offences
Lesley Simpson-Gray processes personal information about:
Professional Training - Types / processes of Information processed:
Personal contact details
Practitioner’s professional information credentials
Relevant life data which may help to inform how best we may support you or guide you to appropriate services
Any enquiries / emails which may be exchanged between us in the course of our communications with each other
Reasons why we collect this information from practitioners:
To maintain contact during the course of our communications
To enable those who have requested it to receive information about our training programmes and services
To be able to provide you with appropriate support where requested and/or recommend alternative services
All personal and sensitive data held by Lesley Simpson-Gray is held securely. Electronic data stored on a computer is stored on a password protected computer, in password protected documents held on the C: Drive of the computer. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked cabinet behind a locked door.
In the case of a data breach Lesley Simpson-Gray Psychotherapy shall comply with the regulations set out under Article 33 of the GDPR stated below;
1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
6. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
7. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.
Subject Access Request
A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after eight years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, Lesley Simpson-Gray Psychotherapy will:
• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.
SAR requests should be put in writing to Lesley Simpson-Gray Psychotherapy. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Lesley Simpson-Gray Psychotherapy.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made. In some instances my supervisory body or insurance company may require me to lawfully hold your files until the end of their retention period. If this arises I will notify you at my earliest opportunity.
Lesley Simpson-Gray Psychotherapy hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Lesley Simpson-Gray Psychotherapy would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Lesley Simpson-Gray Psychotherapy.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by Lesley Simpson-Gray Psychotherapy you can contact Lesley Simpson-Gray Psychotherapy directly. In the event that Lesley Simpson-Gray Psychotherapy cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.
Safeguarding your privacy
In the event of my death or sudden illness, my practice executor will contact existing clients and archive any client files in accordance with General Data Protection Regulations.
This may mean shredding any hardcopy documents, and having any electronic documents saved on a hard drive professionally wiped or destroyed by a GDPR complaint technician.