RJT Psychology is the Trading Name of Dr Rachel Jane Toole. We aim to be as clear as possible about how and why we use information about you so that you can be confident that your privacy is protected. This Privacy Notice describes the information that RJT Psychology collects when you use our services. This information includes personal data, special category data and criminal offence data. When we do this we are subject to UK data protection law which includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (2018) and other relevant data protection legislation. This Privacy Notice describes how we manage your information when you use our services, if you contact us or when we contact you. As per these laws, RJT Psychology (Dr Rachel Toole) is the data controller.

​

If your questions are not fully answered by this Privacy Notice, please contact Dr Rachel Toole at rachel@rjtpsychology.co.uk. If you are not satisfied with the answers you can contact the Information Commissioner's Office (ICO) https://ico.org.uk.

​

In this Privacy Notice:

“Personal data” means any information relating to an identified or identifiable individual, for the purposes of this document this may include special category data and criminal offence data.

​

“Special category data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health (including mental health), sex life and sexual orientation.

​

“Criminal offence data” means data relating to criminal convictions and allegations of criminal activity.

​

1. Why do we need to collect your personal data?

​

We need to collect information about you so that we can:

·       Know who you are so that we can communicate with you in a personal way.

·       Deliver goods and services to you.

·       Process your payment for the services.

·       Verify your identity so that we can be sure we are dealing with right person.

​

You can read more about this in point 4.

​

2. What personal data do we collect and when do we collect it?

​

The personal data we collect from you is submitted directly by you via letter, email, text, contact forms  (on our website or other platform), when you provide information over the telephone, contact us via our website, when conducting an introductory telephone call following you enquiring about our services (this will be anonymised should you not engage with our services and kept in accordance with our usual practice, please see point 7 for further details), during consultations (in person or on-line), when you complete questionnaires and that which you will be asked to provide when completing documentation before your initial appointment and subsequently if applicable. You will be asked to submit this via the practice management software if possible.

​

We also collect information about you when you interact with our website – please see point 8 below for further details.

​

For us to provide you with services, we need to collect the following information:

·       Your full name

·       Your signature/e-signature

·       Your Date of Birth

·       Your contact details including a postal address, telephone number(s) and electronic contact such as email             address

·       Your Next of Kin/Emergency Contact

·       Your GP name, address and contact number

​

We may also collect information about you from the following third parties;

·       Your GP or other healthcare professionals;

·       Charities, organisations or healthcare providers who may be funding your treatment sessions.

·       If people call or otherwise contact us on your behalf.

​

Where accessing our services via a third-party website you may also be subject to that providers privacy policies, and you should review these in addition to the Privacy Notice of RJT Psychology.

​

We may collect information about your current and previous psychological and physical health, and where relevant sexual health, and your current and previous social and family circumstances. This sensitive personal information is defined as “Special category data” (please see above for full definition) and is collected in order provide our services to you. "Special categories" of particularly sensitive personal data require higher levels of protection. We need to have clear justification for collecting, storing and using this type of personal data - this is also the case for criminal offence data.

​

3. What is our lawful basis to process your personal data?

​

We have identified the following lawful basis for processing your data. Anything outside of this scope we will actively seek your permission prior to the activity. Most commonly, we will process your data on the following lawful grounds: 

·       Consent

We may gain your consent to share your data with other organisations, for example if we feel you would benefit from the support of another organisation, we will ask if it’s okay to share your data with them to get further support. We also only record our sessions with your consent.

·       Contractual Obligations

Before we begin working together you will be asked to agree to our Terms and Conditions and share some basic information with us. This is normal practice and lays out what we expect of one another. By entering into these terms, and sharing your information, we enter into a contract together.

·       Vital Interests

We may also use your data, typically in an emergency, where this is necessary to protect your life, or someone else’s life. In a small number of cases where other lawful bases do not apply, we will process your data on this basis and in your best interest. If our professional opinion is that there was an immediate and serious risk that you might harm yourself or someone else then we may have to share your personal data  with a third party such as your GP or the emergency services without first obtaining your consent.  This might be because it is not practically possible to obtain your consent or because attempting to do so might lead to a delay in accessing help and therefore endanger your life or that of another. In situations where we do have to share your personal data with third parties to protect you or another, we will only share your personal data in so far as it is relevant and necessary to protect you or someone else. We will inform you what personal data has been shared and to whom.

·        Legal Obligation

It is possible that your personal data may be requested by the Police, a Court of Law, Coroners Office or Professional Body in which circumstances we would have no option but to comply with the law. 

·       Legitimate interests

When you or a third party provide your personal data to us we use your information for our legitimate business interests to carry out our services in a way which might reasonably be expected as a Clinical Psychologist, for example, you may need to share information about your mental health in order for us to support you with therapy, therefore we have a legitimate interest to know and store this information about you. When we process special category data using our legitimate interest, we rely on further conditions from data protection legislation (UK GDPR Article 9 Substantial Public Interest, further supported by the Data Protection Act 2018 Schedule 1, Part 2, Paragraph 17 – Counselling).

 

Further legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same grounds as those identified for “Special categories” referred to above. We have an Appropriate Policy Document in place which sets out and explains our procedures for securing compliance with the data protection principles and policies regarding the retention and erasure of such personal data.

​

We have a duty to keep your personal data up to date and accurate so from time to time we will contact you to ask you to confirm that this is the case.  If there are any changes to your personal data (such as a change of address) please let us know as soon as possible.

​

We may anonymise your personal data (so that you can no longer be identified from such data) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

​

4. How do we use the information that we collect?

​

To provide you with effective and safe clinical services we will need to know personal data about you. Whenever any personal data is provided to us in connection to our service, legally we have to use it in accordance with the terms of various privacy laws, including UK GDPR, the Data Protection Act (2018) and other relevant data protection legislation.

​

We use the personal data we collect from you in the following ways:

·       To register you as a new client

·       To manage payment

·       To collect and recover monies owed to us

·       To manage our relationship with you

·       To communicate with you so that we can inform you about your appointments

·       To deliver the correct service to you

·       To create invoices for any organisation, charity or private healthcare provider that may be funding your sessions

·       To produce clinical notes and other documents such as, but not limited to, letters and reports

​

5. Where do we keep the information?

​

We take the security of your personal information very seriously. We have put in place security measures which are designed to protect the personal data we hold about you to prevent it from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also follow the strict security procedures that privacy laws require. These cover storing, using, transmitting and releasing any information you have provided, and preventing unauthorised access or use.

​

We keep your information stored as described below.

​

5.1  On our company computers

We use company devices including laptops, mobile phones and tablet devices to store and access your data:

​

·       Notes will be made on paper during your sessions. These will be typed up and stored electronically with your client records on our practice management software (which is a password protected and secure cloud-based practice management system) on a password protected device. Your client record will include information we hold about you – as outlined in point 2 above and other documents produced in relation to our contact with you such as letters and reports. The paper notes will be destroyed using a cross cutting shredder at the time of destruction. A cloud-powered productivity platform, Microsoft 365, on a password protected device is also utilised.

·       Our electronic equipment is regularly backed-up and is secured with up-to-date security software.

​

5.2 As a paper copy

Notes taken when we meet you are sometimes used to create letters and reports for relevant recipients, copies of which will be provided to you by hand where possible or by post. When posted to you or others these will be marked as 'private and confidential' and registered where appropriate.

​

Any further paper records of personal data are stored securely in a locked filing cabinet and a locked room at the offices of RJT Psychology.

​

6. Who do we share your information with?

​

6.1 Third Parties

We will ensure that any personal data you disclose to us shall not be disclosed to any person except as detailed below. Should we be required to disclose personal data, we will endeavour, where possible, to discuss this with you first. We will not record or allow anyone to listen to any part of a session unless with your explicit consent.

​

We may disclose confidential information relating to you in the following ways:-

·       When you give your consent for us to share your personal data

·       To our advisers who need to know such information for the purposes of carrying out our services to you for example, Clinical Supervisors and a Therapeutic Executor (This is another therapist who can access your personal data in order to contact you should anything happen that prevents your Psychologist from continuing with your therapy and contacting you themselves. The Therapeutic Executor will not access your file at any other time). The data will be shared with the Executor who will securely hold your records until their disposal which will be for a 7 year period following the last contact with you, in accordance with usual practice (Please see point 7 below for further details)

·       If we need to contact another professional or healthcare provider (for example, we may need to contact your GP, usually by letter, to inform them that you are being seen by the service, why and give them any other pertinent information and then to update them on closing your case) as part of your care

·       To a Third Party who is funding your sessions – private healthcare or other organisations/charities who may require details of the work undertaken with you such as updates and reports

·       To third parties who provide services to us, which allow us to operate our business and provide the Services, such as IT support, hosting and software providers (including videocall hosting providers), banking and payment processors and other professionals such as our accountants, insurers or lawyers

·       We may share or disclose information collected via our website or contained on our server logs or databases to third parties where necessary to protect the security or integrity of our website/server logs/databases (as applicable)

·       As may be required by law, a court of competent jurisdiction or any governmental or regulatory authority

·       For reasons of public interest in the area of public health

·       To HMRC and any other regulatory bodies to the extent necessary to comply with law

·       If information disclosed during a session is of such a serious nature that confidentiality cannot reasonably be expected to be maintained such as;  If we believe that you are at risk of harming yourself or others, or you or others are at serious risk of harm, in which case we will report this to the relevant organisation(s), Your GP and/or emergency contact/next of kin as necessary and, information such as that relating to Child Protection, Safeguarding, crime, fraud, acts of terrorism and drug trafficking.

​

Where your personal data is shared with a third party partner such as our professional advisers or someone providing IT support we will ensure that such persons operate under appropriate contractual restrictions to protect your confidentiality and security of your personal data.

​

We will not share your details with third parties for marketing purposes.

​

6.2 International transfers

​

Some of our third-party IT providers are businesses outside of the EEA in countries which do not always offer the same levels of protection for your personal data. Where this is the case we will ensure that such providers operate under contractual restrictions to protect the security of your data.

​

7. How long do we keep the information?

​

We will only keep your personal data for as long as is necessary to fulfil the purposes for which we collected it. RJT Psychology keeps all your personal data for a 7 year period following our last contact with you unless you and your therapist agrees otherwise. This arrangement allows us to comply with Professional Body Guidance, UK Tax Law and Indemnity Insurance Policies. Data may be kept for longer in exceptional circumstances such as those related to legal processes.  At RJT Psychology we will securely store your data for this period then all records of our contact, including any personal details, will be destroyed securely or deleted.

​

8. Data collected through our website

​

8.1 In addition to the above, we use technology to collect information about the use of our website. For example, our servers automatically log which pages of our website visitors view, IP addresses and which web browsers they use. This technology allows us to compile statistics about our visitors and their use of our website. The IP address of visitors is collected in line with legal requirement, but it is not used in any monitoring or statistics.

​

8.2 Our website may contain hyperlinks to other pages on our website. We may use technology to track how often these links are used and which pages on our website our visitors choose to view. This technology enables us to compile statistics about the use of these hyperlinks.

​

8.3 In order to collect the data through our website we may use 'cookies'. Please refer to our Cookie Policy at www.rjtpsychology.co.uk/cookie-policy. For more information about cookies, including how to set your browser to reject them, please go to www.allaboutcookies.org.

​

8.4 Your IP address may also be used by us to help diagnose problems or to administer our website. An IP address is an assigned number, similar to a telephone number that identifies your computer on a network. Your IP address is also used to gather broad demographic information. IP lookups may also be undertaken by us to identify the domain you are coming from in order that we can assess our users demographics.

​

8.5 Our website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third party websites or any association with their operators. We do not control these websites and are not responsible for their personal data practices. These other third party websites may also use cookies or similar technologies in accordance with their own separate policies. For privacy information relating to these other third party websites, please consult their policies as appropriate.

​

9. YOUR RIGHTS

​

You are able to exercise certain rights in relation to your personal data that we process. These are set out in more detail at https://ico.org.uk/for-organisations/guide-to-the-general-data-protectionregulation-gdpr/individual-rights/.

​

9.1 How can I see all the information you have about me? – Right of access

In relation to a Subject Access Request, you may request that we inform you of the data we hold about you, provide you with a copy of this data and tell you and how we process it. We will not charge a fee for responding to this request unless your request is clearly manifestly unfounded or excessive in which case we may charge a reasonable fee or decline to respond.

​

We will, in most cases, reply within one month of the date of the request unless your request is complex or you have made a large number of requests in which case we will notify you of any delay and will in any event reply within 3 months.

​

If you wish to make a Subject Access Request, please send the request to Dr Rachel Toole at rachel@rjtpsychology.co.uk. We may require additional verification that you are who you say you are to process this request. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to request such information. We may withhold such personal data to the extent permitted by law. In practice, this means that we may not provide information if we consider that providing the information will violate your vital interests.

​

9.2. What if my information is incorrect? – Right to Rectification

If you wish to have your information corrected, please contact Dr Rachel Toole. We will reply within one month of the date of the request.  We may require additional verification that you are who you say you are to process this request.  You must provide us with the correct data and after we have corrected the data in our systems we will send you a copy of the updated information in the same format as the Subject Access Request as detailed above.

​

9.3. How can I have my information removed? – Right to Erasure

You have the right to ask us to delete the personal data we hold about you in certain circumstances. We will reply within one month of the date of the request. If you want to have your data removed we have to determine if there is a reason for us to keep it, for example, if there is a legal obligation such as a contractual agreement or it is in our legitimate interest to keep your data. If we decide that we should delete the data, we will do so without undue delay.

​

9.4 Right to Object and right to withdraw consent

You have the right to object to our processing or use of your personal data. However, in some cases we are bound by law to process your data. Please note, if you object to the processing of your data we may not be able to support you. If you have given consent for us to collect and process your personal data, you have the right to change your mind at any time and to withdraw that consent. We will reply within one calendar month of the date of the request.

 

9.5. Right to be Informed

You have a right to be informed, to know what we are doing with your data and why. We will publish privacy notices wherever they may be required to clearly explain our reasons. 

 

9.6. Right to Restrict Processing

As an alternative to requests for erasure, you have the right to restrict our processing of your data in certain circumstances. This means we will still hold your data but not use it for a period of time. Please contact us for further details. We will reply within one calendar month of the date of the request.

 

9.7. Right to Data Portability

The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. You have to right to receive a copy of your personal data; and/or have your personal data transmitted from one organisation to another. If we hold information about you and you want us to ‘port’ it to you or send it to another organisation that provides a similar service, you can request us to do this. We will not charge a fee for responding to this request unless your request is manifestly unfounded or excessive in which case we may charge a reasonable fee or decline to comply.

​

We will, in most cases, respond without undue delay and within one month of the date of the request. We may require additional verification of identity to process this request.

​

10. Will we leave voicemails and send emails and text messages to you?

​

As part of this service, we need to send information to you in order to provide you a service, for example, relevant information when you are taken on as a new client, details of your appointments etc. We will use your telephone number and may leave a voicemail, email address or SMS (text messages); however, it is noted that this does increase the risk of someone intercepting the information. Additionally, we may contact you:

·       About information you have asked for, in order to answer your request

·       If you have chosen to receive further information from us

·       To invite you to take part in feedback surveys about our services (it is always up to you whether you want to take part)

·       If you have given us feedback, to discuss that feedback or ask your permission to publish it.

​

11. How do I opt out of receiving voicemails, emails and/or text messages from us?

​

If you are receiving text messages from us, you may unsubscribe at any time by responding to the text with the word “unsubscribe”. Similarly, if you are receiving emails from us, you may unsubscribe at any time by following the instructions included within the email. You may of course contact us directly about this. Please inform us directly if you do not wish a voicemail to be left. When you opt out of these communications, we will suppress your details on our systems to ensure we have a record of your decision to not be contacted in that particular manner. We will not use the email address or phone number for such messages again unless you opt back in.

​

12. How do we make changes to this Privacy Notice?

​

We may update this Privacy Notice from time to time. We will notify you of any changes by posting the new Privacy Notice on our website. You are advised to review this periodically for any changes. Changes to this Privacy Notice are effective when they are posted on our website -    https://www.rjtpsychology.co.uk/about-7. If you would like a copy please email your request to  rachel@rjtpsychology.co.uk.

This Privacy Notice was written on 4.5.18 and was last updated on 11.8.25.

​

13. Making a complaint

 

We are committed to protecting your personal data but if for some reason you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Contact details can be found at www.ico.org.uk. You can also contact them by phoning 0303 123 113. If you are based outside the UK, you have the right to complain to the relevant data protection supervisory authority in your country.

​

We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you. We can be contacted via email - rachel@rjtpsychology.co.uk, telephone – 07419 994522 or by writing to Dr Rachel Toole, Haling Dene Centre, Cannock Road, Penkridge, Stafford, ST19 5DT.

​

14. How to contact us about this Privacy Notice

​

If you have any questions or comments about this Privacy Notice or should you wish to exercise your Data Protection Rights we can be contacted via email - rachel@rjtpsychology.co.uk, telephone – 07419 994522 or by writing to Dr Rachel Toole, Haling Dene Centre, Cannock Road, Penkridge, Stafford, ST19 5DT.