GDPR Compliance Policy for Calm Mind Therapy Services
Introduction and Scope
Calm Mind Therapy Services is committed to the highest standards of data protection, confidentiality, and transparency in line with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This policy sets out in detail the principles and procedures by which we collect, process, store, share, and delete personal data in the course of our therapeutic, counselling, and coaching activities.
The scope of this policy covers all personal data processed by Calm Mind Therapy Services, whether in relation to clients, prospective clients, staff, associates, suppliers, or website visitors. It applies to all forms of data electronic, paper, audio, and any other medium handled by the business.
Lawful, Fair, and Transparent Processing
All personal data processed by Calm Mind Therapy Services is collected and handled in a manner that is lawful, fair, and transparent. We inform all individuals about the reasons for collecting their data and the ways in which it will be used, both at the point of data collection and throughout their engagement with our service. We only process personal data where we have a clearly defined lawful basis. This may include the necessity of processing for the performance of a contract, for compliance with a legal obligation, for the protection of vital interests, with the individual’s explicit consent, or for the legitimate interests pursued by Calm Mind Therapy Services or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Data Minimisation and Accuracy
We are committed to the principle of data minimisation, meaning that we only collect and retain personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. All personal data is collected directly from the data subject or, with their consent, from authorised third parties.
We take active steps to ensure the accuracy and currency of all personal data in our possession. Clients and other data subjects are encouraged to inform us promptly of any changes to their personal information to ensure that records remain up to date and accurate.
Purpose Limitation
We take active steps to ensure the accuracy and currency of all personal data in our possession. Clients and other data subjects are encouraged to inform us promptly of any changes to their personal information to ensure that records remain up to date and accurate.
Security and Confidentiality
We implement a range of technical and organisational measures to ensure the security of all personal data processed by the business. These measures include the use of encrypted, password-protected digital systems for the storage and transmission of electronic records, physical security controls for paper records, restricted access to personal data based on need and role, and ongoing data protection training for all staff and associates.
Our commitment to confidentiality means that all staff, associates, and contractors are bound by professional and contractual duties of confidentiality. Data is only accessed, processed, or shared as necessary for the fulfilment of professional duties and the delivery of safe and effective care.
Data Retention and Deletion
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, professional, and regulatory obligations. For client records, this generally means a period of seven years from the date of last contact, after which records are securely destroyed or deleted. Where data must be retained for a longer period due to ongoing legal or safeguarding requirements, individuals will be informed where possible.
The process for secure deletion or destruction of data is in line with industry best practices and ensures that all information is irretrievable after disposal.
Data Subject Rights
Individuals whose personal data is held by Calm Mind Therapy Services have a range of rights under the GDPR, which we fully respect and uphold. These include:
- The right to be informed about how their data is collected and used;
- The right of access to their personal data and to receive a copy of their records;
- The right to rectification of any inaccurate or incomplete data;
- The right to erasure of data where there is no compelling reason for its continued processing (subject to professional and legal obligations);
- The right to restrict or object to processing in certain circumstances;
- The right to data portability, allowing individuals to obtain and reuse their data for their own purposes across different services;
- The right to withdraw consent at any time for processing based on consent;
- The right to lodge a complaint with the Information Commissioner’s Office.
Data Breaches
We maintain robust procedures for identifying, reporting, and managing personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to the individual, we will also communicate the details of the breach to the data subjects concerned as soon as possible.
Data Sharing and International Transfers
Calm Mind Therapy Services does not routinely share personal data with third parties except where required for the provision of care (with your consent), for compliance with legal obligations, or in circumstances where disclosure is required to protect your vital interests or those of another person.
In rare cases where data must be transferred outside the UK or EEA, we ensure that appropriate legal safeguards are in place to protect your rights and the security of your data.
Data Protection Officer and Contact
While Calm Mind Therapy Services is a small business and not required by law to appoint a formal Data Protection Officer, responsibility for data protection and compliance rests with the lead practitioner or practice owner. Any questions, concerns, or requests regarding data protection, privacy, or the exercise of your rights can be directed to the contact details below.