top of page
    Moray Psychology Services customer privacy notice

    This privacy notice tells you what to expect us to do with your personal information.

    ​​

    ​

    Contact details

    Email: audrey@moraypsychologyservices.com

    ​

    What information we collect, use, and why

    I may collect or use the following information to provide patient care:

    • Name, address and contact details

    • Pronoun preferences

    • Health information (including medical conditions, allergies, medical requirements and medical history)

    • Information about care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)

    • Payment details (including card or bank information for transfers and direct debits)

    • Records of meetings and decisions

    I may collect or use the following information for safeguarding or public protection reasons:

    • Name, address and contact details

    • Registered GP

    I collect or use the following personal information for dealing with queries, complaints or claims:

    • Names and contact details

    • Correspondence

    ​

    Lawful bases and data protection rights

    Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

    Which lawful basis I rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

    If you make a request, I must respond to you without undue delay and in any event within one month.

    To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

    ​

    My lawful bases for the collection and use of your data

    My lawful bases for collecting or using personal information to provide patient care are:

    • Consent - I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

    • Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

    • Legitimate interest:

      • As a registered practictioner with the Health and Care Professionals Council (HCPC) I have a professional responsibility to keep full, clear and accurate records for everyone I care for, treat or provide other services to. Full, clear, and accurate records support the process of formulation and treatment planning as a psychologist.

    My lawful bases for collecting or using personal information for safeguarding or public protection reasons are:

    • Consent - I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

    • Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

    • Legitimate interests – I am collecting or using your information because it benefits you, my organisation, or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

      • As a registered practitioner with the Health and Care Professionals Council (HCPC) I have a professional responsibility to report any concerns about the safety or wellbeing of service users or of children or vulnerable adults.

    My lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

    • Consent - I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

    • Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.​

    ​

    Where I might get personal information from

    • Directly from you

    • Family members or carers

    • Other health and care providers

    • Insurance companies

    ​

    How long I keep information

    Personal data that is collected and used during, or resulting in, the course of any theapeutic services I offer (i.e. clinical records) will be kept for 7 years, in line with professional guidelines set out by the British Psychological Society (BPS). These guidelines can be viewed here.

    Personal data that is collected during the process of an enquiry which does not result in therapeutic services, will be kept for 1 year.

    ​

    Who I share information with:
    Data processors

    Wix.com

    This data processor does the following activities for us: Wix.com hosts my website. 

     

    Microsoft 365

    This data processor does the following activities for us: Microsoft 365 is used to manage emails, bookings, and securely store client records.

     
    Others I may share personal information with:

    • Other health providers (eg GPs and consultants)

    • Organisations we’re legally obliged to share personal information with

    • Organisations we need to share information with for safeguarding reasons

    ​

    Duty of confidentiality

    I am subject to a common law duty of confidentiality. However, there are circumstances where I will share relevant health and care information. These are where:

    • you’ve provided consent (I have taken it as implied to provide you with care, or you have given it explicitly for other uses);

    • I have a legal requirement (including court orders) to collect, share or use the data;

    • on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime)

    • in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.

     
    Sharing information outside the UK

    Where necessary, my data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

    For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

     

    Organisation name: Microsoft 365

    Category of recipient: Data storage provider, email provider, appointment booking facilitator.

    Country the personal information is sent to: Microsoft may transfer Customer Data, Professional Services Data, and Personal Data to the United States or any other country in which Microsoft or its Subprocessors operate. Microsoft allow customers to limit where data is stored at rest. Moray Psychology Services has selected setting to restrict the storage of data at rest to within the EU data Boundary. You can find out more about the Microsoft's EU data boundary here. 

    How the transfer complies with UK data protection law: Microsoft implements and maintains the security measures set forth in Annex II of the 2021 Standard Contractual Clauses for the protection of Personal Data within the scope of the GDPR. This and other data protection measures is laid out in their Data Protection Addendum which can be viewed here.

    ​

    How to complain

    If you have any concerns about my use of your personal data, you can make a complaint to me using the contact details at the top of this privacy notice.

    If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO.

    The ICO’s address:           

    Information Commissioner’s Office
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF

    Helpline number: 0303 123 1113

    Website: https://www.ico.org.uk/make-a-complaint

    bottom of page