Privacy Policy
Our contact details
Name: Elsali CBT LTD
Registered Address: 20-22 Wenlock Road. Old Street, London, N1 7GU
Trading Address: 7 Paynes Park, Hitchin SG5 1EH
Phone Number: 01462 506078
E-mail: info@elsalicbt.co.uk
Website: www.elsalicbt.co.uk
The type of personal information we collect
We currently collect and process the following information through electronic records and some paper records:
- Personal identifiers, contacts and characteristics (for example, name and contact details)
- Sensitive information (such as GP or other Health Service providers, scores, reports related to your mental and physical health)
- Information about protected characteristics (such as race, religion, sexual orientation)
- Financial information (such as card payment information, or bank account details)
- Any other information that may be discussed in treatment sessions.
How we get the personal information and why we have it
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- To provide you with an effective therapy service.
- To ensure continuity of your care throughout your time with us.
- To access historical care records in the unlikely event that there is a concern about the service we have delivered to you.
We also receive personal information indirectly, from the following sources in the following scenarios:
- GPs or other health service where you have agreed to them contacting us or us contacting them.
- Social services or other public authorities where you have agreed to us communicating with them or they have made a lawful request to us.
We use the information that you have given us in order to assess your need for therapeutic intervention, provide you with any service we offer, take payment for contracted services, meet our contractual and legal obligations to you.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
(b) We have a contractual obligation.
(f) We have a legitimate interest.
Circumstances where we would deliberately share your information
We may share certain information with your GP (if you consent for us to do so). We may also need to share certain information with other external services as outlined in our Confidentiality Statement which can be found in our Terms of Service. We would usually ask for your consent to share information but this may not always be possible. The confidentiality statement outlines instances where we may need to share information without consent.
If our services are being paid for by a third party who is not the client. Then we may need to share minimal information in order to receive payment from them. This would likely include the number of sessions needed and whether you are attending those sessions. We would not share the content of your sessions without permission or a lawful reason.
How we store your information
We care about protecting your personal information and we take steps to ensure that your information is securely stored. Please be aware that we use third party software to do this and in order to provide you with the most helpful service.
We use BACPAC or Power Diary secure software to store your personal and sensitive information including information related to your healthcare records, healthcare providers, other authorities and anything detailed in your session notes. Please see our terms of service for more information about our software providers.
With your permission we may keep financial information used for payment of services such as card details, and or bank account details. We use card merchants to securely process your payments. Our current merchants are STRIPE, PAYPAL and MONZO.
We keep personal identifiers, sensitive information and other information about you for 7 years from the last session date. We will then dispose your information by deleting data from all electronic records and paper records would be shredded and destroyed.
We keep financial information about the billpayer including name, address and card information for up to 7 years from the last session date. We will then dispose your information by deleting data from all electronic records and paper records would be shredded and destroyed.
Data protection rights (Adults, Young People and Children)
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. However, if this would interfere with our ability to provide you with a service we may decline or terminate our contract with you.
Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at our trading address, or by phone or email (as above) if you wish to make a request. We may take advise from the ICO if meeting any request is likely to break any contractual obligation we hold with you. Where it is not possible to meet a request we will advise you in writing of why we are unable to do this.
If you have a complaint or concern about our data storing, processing and recording practices then please visit our problems & complaints page.
Date of last review 06/11/2024
