Data held by Jayne Sarah Therapies will be held lawfully and for the retention periods set out in section B of this policy document.
This document refers to:
The purpose of this document is to ensure that Jayne Sarah Therapies has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.
Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. Jayne Sarah Therapies is fully committed to ensuring clients privacy and data protection rights.
For the purpose of this policy Jayne Sarah Cockerill is the named Data Protection Officer/Controller and Head of Organisation.
In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisations website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
Please note that Jayne Sarah Therapies does not use automated decision-making tools, including profiling.
When an individual visits www.jaynesarah.co.uk, I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Jayne Sarah Therapies will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.
Design Twelve is a third-party service that hosts Jayne Sarah Therapies website and provides a GDPR Compliant, encrypted, online database and notekeeping service called Theranotes. Design Twelve and Jayne Sarah Therapies have a Data Sharing Agreement to ensure that all data acquired through the website and Theranotes are handled and stored confidentially and securely, within the guidelines of this policy and GDPR.
Rombourne Executive Services Ltd
Rombourne Executive Services Ltd is a third-party service that provides reception, cleaning and maintainance within Trym Lodge, our Westbury-on-Trym location. We have a data sharing agreement with Rombourne to ensure the security and safety of personal data within the building.
Following Covid-19 Lockdown
There will be an expectation that clients confirm before each session that:
There will also be confirmation from the therapist stating the same declaration
All first-time and follow-up consultations will be carried out either on the phone or via video conferencing rather than face to face
|Information Asset||Information Owner Asset||Retention||Trigger for Disposal|
|Email, Text Message and Whatsapp Message (including sent items)||Head of organisation||Annual review period every January, any remaining live data untouched until following review period.||End of retention period|
|Contact details held on mobile devices||Head of organisation||All entries to be deleted prior to decommissioning of mobile device||End of retention period|
|Promotional materials||Head of organisation||Until superseded – Consent to be rechecked prior to reissue||End of retention period|
|Policies||Head of organisation||Until new policy has been put into place||End of retention period|
|Client records including session notes, initial consultation notes, payments, invoices and treatment logs and trackers||Head of organisation||In accordance with CNHC regulation, 8 years after final treatment session has ended. Child records should be held until after 25th birthday, or 26th birthday if aged 17 when treatment ends.||End of retention period|
|Safeguarding records||Head of organisation||In accordance with the current organisations insurance policy, 5 years after final treatment session has ended, unless superseded by new insurance policy.||End of retention period|
|Sat Nav records||Head of organisation||All entries to be deleted prior to decommissioning of mobile device||End of retention period|
|Continual Professional Development Records||Head of organisation||To be retained when worker is in service and until 8 years afterwards.||End of retention period|
|Worker supervision records||Head of organisation and workers supervisor||To be retained when worker is in service and until 8 years afterwards.||End of retention period|
|Service evaluation records / Feedback forms||Head of organisation||Transfer to anonymised data within 6 months of collection.||End of retention period|
|Tax returns, Invoices and Payment data||Head of organisation||6 years from the end of the financial period to which they pertain to.||End of retention period|
|Incident/Accident reports||Head of organisation||40 years from date report was closed||End of retention period|
|Insurance policies||Head of organisation||40 years from date policy ended.||End of retention period|
|Complaints||Head of organisation||2 years from complaint being resolved||End of retention period|
|Right to Erasure Request||Head of Organisation||8 years from request being submitted and completed.||End of retention period|
|Subject Access Request||Head of organisation||8 years alongside session notes, or plus 2 years from case closure if request is made after 6 years of storing data.||End of retention period|
Hard copy data will be destroyed via a shredding machine owned by the organisation, electronic data will be permanently deleted.
What are the lawful basis for processing data at Jayne Sarah Therapies?
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
This means that Jayne Sarah Therapies does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.
Description of processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here.
Reasons/purposes for processing information
Jayne Sarah Therapies processes personal information to enable the provision of Massage Therapy Psychotherapy and Hypnotherapy, to advertise services and to maintain accounts and records.
Type/classes of information processed
Jayne Sarah Therapies processes information relevant to the above reasons/purposes. This information may include:
Jayne Sarah Therapies also processes sensitive classes of information that may include:
Jayne Sarah Therapies processes personal information about:
All personal and sensitive data held by Jayne Sarah Therapies is held securely. Electronic data stored on a computer is stored on a password protected computer and password protected mobile phone. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked filing cabinet behind a locked door, within a security alarmed building.
In the case of a data breach Jayne Sarah Therapies shall comply with the regulations set out under Article 33 of the GDPR;
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, Jayne Sarah Therapies will:
SAR requests should be put in writing to Jayne Sarah Therapies. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Jayne Sarah Therapies.
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made.
Jayne Sarah Therapies hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Jayne Sarah Therapies would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Jayne Sarah Therapies.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by Jayne Sarah Therapies you can contact Jayne Sarah Therapies directly. In the event that Jayne Sarah Therapies cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.
In the event of my death or sudden illness, my colleague will contact existing clients and archive any client files in accordance with General Data Protection Regulations.