Privacy Policy

PRIVACY NOTICE — RAINBOW FAMILY THERAPY

1. INTRODUCTION
This privacy notice provides you with details of how we collect and process your personal data through your use of our site www.rainbowfamilytherapy.co.uk and through the provision of our therapy services.

By providing us with your data, you warrant to us that you are over 16 years of age, or that you are the parent or legal guardian providing consent on behalf of a child receiving our services.

Rainbow Family Therapy is the data controller and we are responsible for your personal data (referred to as "we", "us" or "our" in this privacy notice).

Contact Details
Full name of legal entity: Rainbow Family Therapy
Email address: enquiries@rainbowfamilytherapy.co.uk

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us.

2. WHAT DATA DO WE COLLECT ABOUT YOU, FOR WHAT PURPOSE AND ON WHAT GROUND WE PROCESS IT

Personal data means any information capable of identifying an individual. It does not include anonymised data.

Under the UK General Data Protection Regulation (UK GDPR), we are only legally able to process your personal data if we have a lawful ground for doing so.

We may process the following categories of personal data about you:

Communication Data that includes any communication you send us through the contact form on our website, by email, text, social media messaging, or any other means. We process this data for the purposes of communicating with you, for record keeping, and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests, namely to reply to communications, keep records, and establish, pursue or defend legal claims.

Client Data that includes information relating to the therapy services you engage us for, such as your name, title, address, email address, phone number, contact details, emergency contact details, GP details, appointment details, and payment details. We process this data to provide the therapy services you have requested and to keep records of those services. Our lawful ground for this processing is the performance of a contract between you and us and/or taking steps at your request to enter into such a contract.

Special Category (Health) Data that includes information about your physical or mental health, wellbeing, family circumstances, and any other sensitive personal information shared with us in the course of providing therapy. As a therapy service, processing this information is a necessary and integral part of our work with you. Our lawful ground for processing this data under Article 6 is the performance of our contract with you, and our additional condition for processing special category data under Article 9 is that processing is necessary for the provision of health or social care or treatment (Article 9(2)(h)), and/or your explicit consent. We treat this information with the highest level of confidentiality and care, in line with our professional and ethical obligations.

User Data that includes data about how you use our website and any data you post for publication on our website. We process this data to operate our website, ensure relevant content is provided to you, ensure the security of our website, maintain backups, and enable administration of our website and business. Our lawful ground is our legitimate interests, namely to properly administer our website and business.

Technical Data that includes data about your use of our website such as your IP address, login data, browser details, length of visit, page views, navigation paths, time zone settings and other technology on the devices you use. The source of this data is our analytics tracking system. We process this data to analyse use of our website, administer and protect our business, and understand the effectiveness of any advertising. Our lawful ground is our legitimate interests.

Marketing Data that includes data about your preferences in receiving marketing from us and your communication preferences. We process this data to deliver relevant content to you and to measure the effectiveness of our communications. Our lawful ground is your consent or our legitimate interests, namely to grow our business.

Confidentiality and its limits

The therapeutic relationship is built on confidentiality. Information you share within therapy will be kept confidential and will not be disclosed without your consent, with the following exceptions: where there is a risk of serious harm to you or another person (including a child); where we are required to disclose information by law or court order; or where disclosure is necessary to comply with our safeguarding obligations. As a UKCP-accredited practitioner, we work within the UKCP Code of Ethics and applicable safeguarding legislation, including Working Together to Safeguard Children. Where it is safe and appropriate to do so, we will always seek to discuss any disclosure with you first.

We attend regular clinical supervision as part of our professional practice. Where client material is discussed in supervision, it is anonymised wherever possible and our supervisor is also bound by confidentiality.

Where we are required to collect personal data by law, or under the terms of our contract with you, and you do not provide that data when requested, we may not be able to provide our services to you.

We will only use your personal data for the purpose it was collected for, or a reasonably compatible purpose. We do not carry out automated decision making or profiling.

3. HOW WE COLLECT YOUR PERSONAL DATA
We may collect data about you when you provide it directly to us (for example, by filling in forms on our site, sending us emails, or during the course of therapy sessions, consent forms). We may automatically collect certain data as you use our website through cookies and similar technologies. We may also receive data from third parties such as analytics providers (e.g. Google), and, with your consent, from referrers such as your GP or another professional involved in your care.

4. MARKETING COMMUNICATIONS
Our lawful ground for sending you marketing communications is either your consent or our legitimate interests.
Under the Privacy and Electronic Communications Regulations, we may send you marketing communications if you have engaged us for services or requested information about our services, and you have not opted out. We will never use your Special Category (Health) Data for marketing purposes.

You can ask us to stop sending you marketing messages at any time by following the opt-out links in any marketing message or by emailing us.

5. DISCLOSURES OF YOUR PERSONAL DATA
We may share your personal data with:

Service providers who provide IT and system administration services.
Professional advisers including lawyers, accountants, and insurers.
Our clinical supervisor (anonymised wherever possible).
Government or regulatory bodies, or safeguarding authorities, where we are required to report.
Other professionals involved in your care, but only with your consent or where required for safeguarding or by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

6. DATA SECURITY
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. Clinical records are stored securely and access is limited to those with a genuine need. We have procedures to deal with any suspected data breach and will notify you and the ICO where legally required.

7. DATA RETENTION
We will only retain your personal data for as long as necessary. For therapy clients, we are professionally and ethically required to retain clinical records for a defined period after the therapeutic work ends. In line with professional guidance, we typically retain adult client records for seven years after the end of therapy. For records relating to children and young people, we retain records until the young person reaches the age of 25 (or 26 if they were 17 at the end of treatment). For tax purposes we keep basic financial information for six years.

8. YOUR LEGAL RIGHTS
Under data protection laws you have rights including the right to request access, correction, erasure, restriction, transfer, to object to processing, and (where the lawful ground is consent) to withdraw consent. Please note that our professional obligation to retain clinical records may affect our ability to erase certain data.

You can see more about your rights at the ICO website. To exercise any of these rights, please email us.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (www.ico.org.uk). We would be grateful if you would contact us first so we can try to resolve it.

9. THIRD-PARTY LINKS
This website may include links to third-party websites. We do not control these and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.

10. COOKIES
You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable cookies, some parts of this website may not function properly.