Coram Creative Therapy
Customer Privacy Notice

For adults, therapy sessions are confidential unless there is a legal or safeguarding duty to share information. For children and young people, therapy also respects the child’s right to an age-appropriate level of privacy. This is not the same as secrecy. Parents and carers will receive appropriate updates about therapeutic progress while respecting the child’s therapeutic relationship and privacy.

There are occasions when confidentiality cannot be maintained. We may need to share information without consent if we believe there is a risk of serious harm to you, your child or another person, or where we are required to do so by law. Wherever it is safe and appropriate, we will discuss this with you before sharing information.

We collect or use the following information to provide therapeutic services;

• Parents/carers and children’s names and contact details, addresses
• Gender and pronoun preferences
• Date of birth
• Ethnicity
• Next of kin details
• Service user history
• Information about support requirements
• Information from your referrals and that you share with us such as the reason for referral and context related to that.
• Records of therapeutic sessions, meetings and therapy planning decisions
• Information relating to compliments or complaints
• Information about diagnosis, disability or health that is disclosed to us through the referral.

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Coram Creative Therapy are the data controllers for the information collected and processed when providing our services. This means that we are responsible for, and control the processing of, your personal information. Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third party referrals are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. All our therapeutic work is carried out only with parent consent, or/and young person consent over 13yrs. This includes our adoption therapeutic work (ASGSF) and our Camden Creative Therapy Service.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.  This applies to all our services.

• Recognised legitimate interests – our pre-approved purpose for collecting or using personal information to provide services and goods, including delivery and third party referrals.

• Special category data – In the course of your referral, we collect special category data about you including health and ethnicity information. We process this information under the legal bases mentioned above and the additional Article 9(2)(h) special category condition for the provision of therapy services. Where appropriate, processing may also fall within the substantial public interest condition relating to counselling (Art 9 Schedule 1 Paragraph 17) (for example, if you share other sensitive information with us when engaging in our therapy services).

• Directly from you
• Family members or carers
• The referrer
• We only collect information from other health and care providers and schools with direct permission unless there are safeguarding concerns.

Children/young people’s clinical records are kept securely on our encrypted practice management software until the child is 25 or 28 years old and then are securely deleted. In alignment with guidance from HCPC standards and the Records Management Code of Practice 2021, clinical notes are kept for 7 years after adulthood (18 years old or 21 years old for adopted/SGO or disabled young people).

We may ask you, your child and, where appropriate and with your consent, your child’s school to complete outcome measures before and after therapy. Anonymous statistical information may be used by our service for service evaluation, research, quality improvement and funding purposes. No individual client is identifiable in any published reports or statistical analysis.

Where directly relevant we share anonymised statistical outcome data and demographic information with our commissioners and funders, such as Camden Children’s Commissioners. For our adoption and SGO work we may share anonymised outcome and demographic data as directly relevant with our Coram Regional Adoption Agencies, Coram Voluntary Adoption Agency and the ASGSF funding organizations such as Adoption England and Department of Education.

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Online: complaints@coram.org.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint