This policy sets out how Jo Pang collects and processes client’s personal data.  Jo is a registered data protection officer with the Information Commissioner's Office, number ZB230079.

 

Service provided

 

Jo Pang provides private counselling, psychotherapy, supervision and training to individuals and organisations.  Agreements are usually between Jo and the individual client or supervisee.  On occasion, a third party is involved for example, when a health care company or organisation are funding the therapy or supervision.

 

How data is gathered

 

There are various ways that clients make enquiries with Jo.  You may provide her with information by emailing  directly or via the website www.jopangtherapy.com or via counselling and therapy directories (BACP, Psychology Today, Association for Counsellors & Therapists Online), or by telephone to request further information about her services.  Initial enquiries often contain some personal information such as names, emails and phone numbers.  Other data is collected during completion of the Therapy Agreement, in initial meetings and following each therapy or supervision session.  Data is processed for the proper and necessary administration of the above service on the basis of consent.

 

The type of information gathered includes clients’ name, address, date of birth, phone number, email address, GP name and address, emergency contact details (where relevant).  Brief electronic session notes are kept following each appointment.  Emails and text messages from clients are also processed on a PIN protected work phone or password protected computer.  Jo Pang’s website is hosted by WIX, this means that information submitted this way will be shared with ECC&T via the Wix tools.  More information about why and how Wix process users-of-users information can be found at https://www.wix.com/about/privacy  Any messages sent via the website will be deleted from WIX as soon as Jo has responded from her email account.  Should it be necessary to send highly sensitive information via email, this will be done either via Protonmail or be encrypted/protected by another suitable means.

 

Data storage, retention & disposal

 

Jo Pang stores all data in encrypted secure cloud-based practice management software called Power Diary; any completed paperwork is scanned then shredded and online forms are saved directly to this software.  Online therapy is conducted using the securely encrypted telehealth portal in Power Diary.  Other secure platforms such as Zoom (compliant with the EU-US Privacy Shield Agreement) can be considered when broadband requirements are not met for Power Diary.  Zoom has an option to record video calls but Jo Pang will never use this function during client meetings.  Invoicing and card payments are administered through Power Diary.  Payment details are processed via either PayPal, Stripe or Jo Pang’s business bank account.  All steps are taken that are reasonably necessary to ensure that client data is treated securely and in accordance with this policy.

 

Client records are held for 6 years following the termination of therapy or supervision.  This is in line with Common Law practices and indemnity insurance purposes after which time data is securely deleted.  Should you make an enquiry by email and/or phone consultation to Jo Pang but do not go on to sign an agreement for services, your data will be securely deleted after 3 months.

 

Third party sharing

 

Client data is not shared with third parties without explicit prior consent.  For example, if Jo Pang is requested to provide information to an insurance provider or GP.  Sometimes specific information will be shared with private health care providers i.e when clients access therapy via an employee assistance scheme.  The details of such an arrangement will be written in the relevant client agreement and consent requested.  In situations where there are real concerns about a person's safety or an act of terrorism, a therapist is required to share those concerns with appropriate persons or agencies.  Such disclosures will usually be discussed with clients.

 

Jo discusses her client work in an anonymous fashion with a professional supervisor who is also subject to GDPR.

 

In the event of Jo Pang’s incapacity or death, clients’ personal contact information will be disclosed to the clinical executor of my clinical will in order for them to notify you and if necessary, to securely destroy your data.  Personal information may also be disclosed if Jo Pang is under a legal duty to share data for example, if subpoenaed to court or as a legal requirement such as safeguarding children or vulnerable adults, terrorism or money laundering.

 

Agreements and rights

 

All clients and supervisees are required to consent to the bounds of the psychotherapy/supervision agreement and to data collection as per this policy.  Clients will be notified of any changes to this policy and have the right to withdraw their consent at any time.  Clients also have the right to ask for their data to be deleted or amended.  You can ask for a copy of your data in a subject access request and Jo Pang will provide you with this, free of charge, within 30 days. 

 

Data breaches

 

In the event of the discovery of a data breech, Jo Pang will report the breech to the ICO within 72 hours.

​

​

Last updated January 2023