​

Privacy Notice

 

Rainbow Play Therapy takes the confidentiality of our clients extremely seriously. This page explains how we comply with the General Data Protection Regulation (GDPR) regarding what data we hold and how and why we store, process and dispose of it.

 

WHAT DATA DO WE HOLD?

• Clients’ personal details such as name, address, date of birth.

• Contact details for parents/guardians/advocates such as name, address, phone number and email address.

• Clients’ private therapeutic notes including background information, assessments and any paper or electronic correspondence relevant to the therapy. Private therapeutic notes will always be kept secure and separate from any contact details.

 

WHY DO WE HOLD IT?

We will use the above information ONLY in relation to the specific therapy programme that has been requested and the administration of the delivery of that therapy. We hold contact details securely and for the sole purpose of contacting you about the child’s therapy. 

 

DO WE SHARE IT?

We will under no circumstances share any personal details with any third party unless legally obliged to do so. Assessments will be shared if there is reasonable cause to do so in the therapeutic interests of the client, and then only with your explicit consent. In such cases the document will be sent directly and securely to the approved recipient and, where transmitted by email, will be protected by a password only accessed via a separate method of communication, such as a phone call or a text.

 

HOW DO WE STORE IT?

We store all client details in a locked filing cabinet, with personal contact details stored separately from private therapeutic notes.

For the protection of the therapist and client the child’s personal details and private therapeutic information will be retained for the life of therapist, after which it will be destroyed.

 

YOUR CONSENT FOR US TO HOLD YOUR DATA

All data detailed above is held and processed with the consent of the client/their advocate. From 25th May 2018, Rainbow Play Therapy is legally obliged to obtain consent to process data in the case of all its existing clients. If you do not think you have been asked for such consent please contact us as soon as possible. 

 

YOUR RIGHTS

Rainbow Play Therapy holds and processes personal details relating to a client’s therapy programme only as specified above in accordance with the General Data Protection Regulation.

 

Where there is lawful basis under the GDPR, clients/their advocates have the right to:

 

• Request a copy of this data;

• Request correction of any inaccurate or out-of-date data;

• Request erasure of this data when it is no longer necessary to hold it;

• Request the transfer of this data to another data controller;

• Withdraw consent to the processing of this data at any time.

​

All the above complies with the General Data Protection Regulation using contract as a lawful basis for processing the data we hold.

Rainbow Play Therapy is a member organisation of Play Therapy UK, whose own privacy notice is available to read here.