Privacy | Bristol CBT and Psychotherapy

At Bristol CBT and Psychotherapy, we are committed to protecting and respecting your privacy. This Privacy Notice explains the type of personal data which may be collected about you when you interact with us or our website, and how we store and handle that data and keep it safe.

We hope the following sections answer any questions you have, but if not, please get in touch. We may need to update this Privacy Notice from time to time and you will be notified of any significant changes. When you use the Bristol CBT and Psychotherapy website, Emma Pye and Vanessa Shaw are the data controllers and are responsible for your personal data.

Contact Details

Emma Pye and Vanessa Shaw trading as Bristol CBT and Psychotherapy.

Website: https://www.bristolcbtandpsychotherapy.co.uk

Email: bristolcbtandpsychotherapy@gmail.com

It is very important that the information held about you is accurate and up to date. Please let us know if your personal information changes. By providing us with your data, you warrant that you are over 13 years of age.

Legal Bases We Rely On

Data protection law sets out reasons for which an organisation may collect and process personal data.

Consent

In specific situations, we can collect and process your data with your consent. For example, this may apply when you complete a client contract. When collecting personal data, we will make clear which data is necessary in connection with a particular service.

Contractual Obligations

In certain circumstances, your personal data is required to comply with contractual obligations. For example, when you have an assessment we will collect your address, phone number, email address and GP details. These will be kept on a secure client notes system accessible to us. If appropriate, and with your consent, we may share information with BABCP accredited colleagues who practise from our premises to offer you treatment.

Legitimate Interest

In specific situations, your data may be required to pursue our legitimate interests in a way which might reasonably be expected as part of running Bristol CBT and Psychotherapy and which does not materially impact your rights, freedom or interests.

What Personal Data We Collect

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may ask for, or hold, confidential client information about you which will be used to support delivery of appropriate, safe and effective treatments. We may process the following categories of personal data about you.

Communication Data

Communication data may include:

Details of your interactions with us through the contact form on our website
Interactions through email or text
Your comments and reviews
Information shared during an appointment

We process this data for communicating with you, record keeping, and matters related to legal claims. Our lawful ground for this processing is legitimate interests.

Customer Data

Customer data may include:

Details of treatments booked
Your name, title, home address, email address, phone number, next of kin and other contact details
Payment history information
Contact we have had over time with you, such as appointments and home visits
Details and notes about treatment and care, including notes and reports about your health

We process this data to carry out treatments, provide services, and keep records of those transactions. Our lawful ground for this processing is consent and the performance of a contract between you and us.

User and Technical Data

User and technical data may include how you use our website and online services, your IP address, browser details, length of visit, page views, navigation paths, and details about the number of times you use our website.

We process this data to operate our website, provide relevant content, ensure security, maintain backups, administer our website and business, analyse website use, and understand the effectiveness of our communications. Our lawful ground for this processing is legitimate interests.

Marketing Data

Marketing data includes information about your preferences in receiving marketing from us and details of your communication preferences.

Sensitive Data

We may also need to collect more sensitive information, defined in UK GDPR as special category data, such as whether you have any disabilities, allergies, health conditions or take prescription medication. This information helps therapists deliver appropriate treatment and meet your needs. We require explicit consent for processing sensitive data.

Where we are required to collect personal data by law or under the terms of a contract, and you do not provide that data when requested, we may not be able to deliver treatments to you. We will only use your personal data for the purpose it was collected for, or a reasonably compatible purpose if necessary. We may process your personal data without your knowledge or consent where this is required or permitted by law. We do not carry out automated decision making or automated profiling.

When and How We Collect Personal Data

Information may be collected:

Verbally when you are with a member of Bristol CBT and Psychotherapy
When you fill in client consultation cards and other documents
Via our website when you fill out the online enquiry form
Directly from carers, relatives or friends over the phone or in person
When you contact us with queries
When you book an appointment or event
When you choose to complete surveys we send you
When you comment on or review our services

How We Use Personal Data

We may use your personal data:

To help inform decisions about your care
To ensure treatment is safe and effective
To review care provided and ensure it is of the highest possible standard
For clinical supervision
To send communications you have requested and that may be of interest
To notify you of changes to our services
To seek your views or comments on our services
To remind you of upcoming appointments
To improve our products and services

Marketing Communications

Our lawful basis for processing personal data to send marketing communications is either your consent or our legitimate interests. Under the Privacy and Electronic Communications Regulations, we may send marketing communications if you have booked a treatment, asked for information about our services, or agreed to receive marketing communications, and you have not opted out.

You can ask us to stop sending marketing messages at any time by emailing bristolcbtandpsychotherapy@gmail.com. If you opt out of marketing communications, this opt-out does not apply to personal data provided as a result of other interactions with us, such as treatments booked.

Disclosures of Personal Data

We sometimes share personal data with trusted third parties. We require all third parties to respect the security of your data and treat it in accordance with the law. We only allow third parties to process personal data for specified purposes and in accordance with our instructions.

Our policy is that:

We provide only the information needed to perform specific services
Third parties may only use data for the exact purposes we specify
We work with third parties to ensure privacy is respected and protected
If we stop using their services, any data they hold will be deleted or rendered anonymous

Examples of third parties may include IT companies supporting our website and business systems, online booking providers, email marketing services, and relevant professional colleagues involved in treatment or complaints.

Some third-party providers may be based outside the UK or European Economic Area. Where this happens, we take steps to ensure appropriate safeguards are in place.

How We Store Information and Keep It Safe

Personal data is kept safe and secure to protect your privacy and confidentiality. We have security measures in place to prevent personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We allow access to personal data only to those who have a business need to know it.

Information is retained in secure electronic and paper records. Paper records are kept securely locked away when not in use. Access is restricted to Emma Pye and Vanessa Shaw using the equipment, passwords and security devices needed to ensure that only those who need to see personal data can do so.

We have procedures in place to deal with suspected personal data breaches and will notify you and any applicable regulator where legally required.

How Long We Keep Data

We keep personal data only for as long as is necessary for the purpose for which it was collected. When deciding how long to keep data, we consider its amount, nature, sensitivity, the potential risk of harm from unauthorised use or disclosure, processing purposes, and legal requirements. Patient records are kept for the length of time required for complying with our business insurance code of practice.

For tax purposes, the law requires us to keep basic information about clients, including contact, identity, financial and transaction data, for seven years after they stop being clients. At the end of the retention period, data will either be deleted or anonymised.

Your Legal Rights

Under data protection laws you have rights in relation to your personal data. These include the right to request access, correction, erasure, restriction, transfer, objection to processing, portability of data and, where consent is the lawful ground of processing, withdrawal of consent.

If you wish to exercise any of these rights, please email bristolcbtandpsychotherapy@gmail.com. We may need to request specific information from you to confirm your identity and ensure your right to access personal data. We try to respond to legitimate requests within one month.

If you are not happy with how we collect and use your data, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection issues: https://www.ico.org.uk

We would be grateful if you contact us first if you have a complaint so that we can try to resolve it.

Third-Party Links

The Bristol CBT and Psychotherapy website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Privacy Policy