Please also see my General Terms & Conditions page
These terms and conditions should be read in conjunction with my General Terms & Conditions. These terms and conditions are currently active, effective from: 25 May 2018 (revision 3 completed 08 August 2020).
Contents
Section A
Terms Used
Introduction
Aim and Purpose
Information Governance Framework Principles for HCube
Section B
Privacy Notice: Use of Information
Cookies
Website Usage
Retention Schedule
Data Processing
Section C
Data Breach
Subject Access Request
Right to Erasure Complaints
Section A
Terms Used
Throughout this document the term HCube refers to the company registered as H Cube Consulting Limited (Company number 09997092) and includes Lorraine Groves trading as HCube, Helping your Health & Happiness, Health & Happiness with Hypnotherapy and Wellness in the Workplace.
Introduction
Data held by HCube will be held lawfully and for the retention periods set out in section B of this policy document. This document refers to:
- Written Documents
- Spreadsheets
- Hardcopy client case notes and files
- Database entries
- Images
- Recordings
- Emails
- Text messages
- Supervision notes
- Visits to the organisations website
- Social media communication
Aim and Purpose
The purpose of this document is to ensure that HCube has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.
Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
- is the right information
- is in the right place
- at the right time
- with the right people
- for the right reasons
This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any such updates.
HCube is fully committed to ensuring clients privacy and data protection rights.
For the purpose of this policy Lorraine Groves is the named Data Protection Officer/Controller and Head of Organisation.
Information Governance Framework Principles for HCube
Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75 minute GDPR CPD Course provided by the Clinical Hypnotherapy School (www.clinicalhypnotherapyschool.com) completed. Refresher training is completed as required in response to any major changes in regulation.
Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.
1. Any data collected is solely for the purpose of providing a person-centred service to an individual client.
2. The Caldicott Principles are used to provide guidance in best practice when handling personal data, alongside the ICO’s Office Codes of Practice. https://www.igt.hscic.gov.uk/Caldicott2Principles.aspx
3. All technology used to store or facilitate information and communication is maintained according to the Data Retention Policy for HCube.
4. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
5. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
6. Any electronic devices where personal or sensitive, confidential information is held will be password protected.
7. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.
Section B
Privacy Notice: Use of Information
In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.
On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisations website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
- Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
- Any document containing personal data will state “Official-sensitive, private and confidential” clearly.
- All emails will contain a privacy statement.
Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability;
- the right to object; and
- the right not to be subject to automated decision-making including profiling.
Please note that HCube does not use automated decision-making tools, including profiling.
If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing.
1. Google Analytics
When an individual visits LorraineGroves.com, Google analytics are used, who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. HCube will always be transparent when it comes to collecting personal data and will be clear about how that data is processed. Google analytics privacy notice can be found here: https://policies.google.com/privacy/update?hl=en
2. WordPress
WordPress is a third-party service that hosts HCube’s websites. WordPress also uses anonymised data to collect visitor information such as how long an individual remains on a page of a website. WordPress’ privacy notice can be found here for further information: https://automattic.com/privacy/
3. Social Media
HCube may choose to use a third-party provider, Hootsuite, to manage its social media interactions. Any messages sent to the inbox of social media accounts are stored by Hootsuite and permanently deleted after three months. Hootsuite’s rivacy notice can be found here: https://hootsuite.com/en-gb/legal/privacy#.
4. MailChimp
HCube uses MailChimp to contact opted in contacts, with information that may be of interest to you, including, but not exhaustive: details of workshops, new venues, special offers and news. MailChimp’s privacy notice can be found here: https://mailchimp.com/legal/privacy/
Cookies
HCube uses cookies on the sites LorraineGroves.com and www.HealthHappinessHypnotherapy.co.uk (the “Service”). Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows the Service or a third-party to recognise you and make your next visit easier and the Service more useful to you. When you use and access the Service, we may place a number of cookies files in your web browser. We use cookies for the following purposes: to enable certain functions of the Service, to provide analytics, to store your preferences, to enable advertisements delivery, including behavioural advertising.
1. Third-party cookies
In addition to our own cookies, we may also use various third-parties cookies to report usage statistics of the Service, deliver advertisements on and through the Service, and so on.
2. What are your choices regarding cookies
If you’d like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser.
Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.
Website Usage
By browsing this website (LorraineGroves,com) you agree to comply with and be bound by the following terms and conditions. If you do not agree to these terms and conditions please do not use this site. Updates may be made to this policy at any time and your continued use of this site following the posting of changes to these terms will mean you accept those changes.
1. Site Contents
All material made available in this site, including material in websites that are linked directly or indirectly, are provided “AS IS”, without warranties of any kind, either express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, title, or non-infringement. No guarantee can be given that the material will be error free, nor free of viruses, defamatory, offensive or other harmful matter. You are responsible for cost of any necessary service, repair or correction. This site may also include pages or publications with technical inaccuracies or typographical errors that will be corrected as they are discovered by HCube at their discretion. HCube reserves the right to add, delete or modify any information included in this site at any time. Material included in this site does not constitute a contract or part of a contract other than that involved in the booking of a session. Prices may be altered at any time without notice.
2. Site Links
The materials that can be accessed from linked sites are not written or maintained by HCube and HCube is not responsible for the contents thereof. Any reference to a linked site or any specific third party product or service by name does not constitute or imply its endorsement by HCube, and you assume all risk with respect to its use.
3. Liability
Under no circumstances will HCube be liable for any damages, including without limitation, direct, indirect, incidental, special, punitive, consequential, or other damages (including without limitation lost profits, lost revenues, or similar economic loss), whether in contract, tort, or otherwise, arising out of the use or inability to use the materials available in this site or any linked site, even if HCube is advised of the possibility thereof, nor for any claim by a third party. Any material printed from this site is covered by these terms and conditions.
4. Indemnity
You agree to defend, indemnify, and hold HCube harmless from and against any and all claims, losses, liabilities, damages and expenses (including legal fees) arising out of your use of this site or use of the information included herein.
5. Personal Use
You agree to use this site for lawful purposes only. You shall not exploit copyrighted or proprietary materials available in this site, except as expressly permitted by HCube. Any software or materials available for downloading from this site or any directly linked site is governed by the terms of the applicable license agreement accompanying or included with the software.
6. Terms of Use
The terms of use shall be governed in accordance with the laws of United Kingdom and HCube reserves the right to add, delete, or modify any or all terms of use at any time with or without notice. If any of the terms and conditions are found to be unenforceable all other terms and conditions included herein shall remain in place.
7. Links to other sites (“public areas”)
When you are browsing this website, you could be directed to other sites that are beyond HCube’s control. There are links to other sites from these website pages that take you outside of his service. These other sites may send their own cookies, collect their own data or solicit personal information. The privacy policies of these other sites may significantly differ from that of HCube’s. HCube is not responsible for the privacy practices of any other sites and cannot guarantee the security of any of your personal information collected there.
8. Security
Protecting the security of all personally-identifiable information associated with prospective clients or clients is of the utmost importance to HCube. Once any data transmission is received HCube will take reasonable precautions to ensure its security. Unfortunately, no data transmission over the Internet can be guaranteed to be completely secure. As a result, while HCube takes all reasonable steps to ensure the security of users’ personal information and maintain their privacy, HCube cannot guarantee or warrant the security of any information you disclose or transmit online and therefore cannot be held responsible for the theft, destruction, or inadvertent disclosure of such personal information.
9. Access by Minors
HCube does not knowingly collect information from children. If you are under the age of 18, please do not provide any personal information. Ask your parents or a legal guardian to visit this website and enquire on your behalf.
Retention Schedule
| Information Asset | Information Owner Asset | Retention | Trigger for Disposal |
| Email (including sent items) | Head of organisation | Annual review period every January, any remaining live data untouched until following review period. | End of retention period |
| Text messages including Facebook Messenger & WhatsApp | Head of organisation | Annual review period every January, any remaining live data untouched until following review period. | End of retention period |
| Contact details held on mobile devices | Head of organisation | All entries to be deleted prior to decommissioning of mobile device or reissue of device | End of retention period |
| Recordings | Head of organisation | 5 years or earlier if consent is withdrawn | End of retention period |
| Images taken | Head of organisation | 5 years or earlier if consent is withdrawn | End of retention period |
| Promotional materials | Head of organisation | Until superseded – Consent to be rechecked prior to reissue | End of retention period |
| Policies | Head of organisation | Until new policy has been put into place | End of retention period |
| Client records, including initial consultation /session notes, consent forms | Head of organisation | In accordance with CNHC regulation, 8 years after final treatment session has ended. Child records should be held until after 25th birthday, or 26th birthday if aged 17 when treatment ends. | End of retention period |
| Safeguarding records | Head of organisation | In accordance with the current organisations insurance policy, 5 years after final treatment session has ended, unless superseded by new insurance policy. | End of retention period |
| Sat Nav records | Head of organisation | All entries to be deleted prior to decommissioning of mobile device or reissue of device | End of retention period |
| Continual Professional Development Records | Head of organisation | To be retained when worker is in service and until 8 years afterwards. | End of retention period |
| Worker supervision records | Head of organisation and workers supervisor | To be retained when worker is in service and until 8 years afterwards. | End of retention period |
| Tax returns and Accounts records | Head of organisation | 6 years from the end of the financial period to which they pertain to. | End of retention period |
| Incident/Accident reports | Head of organisation | 40 years from date report was closed | End of retention period |
| Insurance policies | Head of organisation | 40 years from date policy ended. | End of retention period |
| Complaints | Head of organisation | 2 years from complaint being resolved | End of retention period |
| Right to Erasure Request | Head of Organisation | 8 years from request being submitted and completed. | End of retention period |
| Subject Access Request | Head of organisation | 8 years alongside session notes, or plus 2 years from case closure if request is made after 6 years of storing data. | End of retention period |
Hard copy data will be destroyed via a cross shredding machine owned by the organisation, electronic data will be permanently deleted.
Data Processing
What are the lawful basis for processing data at HCube
- In relation to communicating with my clients: The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
- Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
- Processing is necessary for your legitimate interests as specified in Article 9 of the GDPR.
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited
2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
This means that HCube does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms & Conditions provided to you at the commencement of service delivery.
Description of Processing
The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may also choose to read the GDPR Policies and Procedures (available by request) / General Terms & Conditions document, which compliments the policies detailed here.
Reasons/purposes for processing information
HCube processes personal information to enable the provision of Psychotherapy and Hypnotherapy including EMDR (Eye Movement Desensitisation and Reprocessing), to advertise services and to maintain accounts and records.
Type/classes of information processed
HCube processes information relevant to the above reasons/purposes. This information may include:
- personal details
- family, lifestyle and social circumstances
- goods and services
- financial details
- employment and education details
HCube also processes sensitive classes of information that may include:
- physical or mental health details
- racial or ethnic origin
- religious or other beliefs of a similar nature
- offences and alleged offences
HCube processes personal information about:
- clients
- suppliers
- business contacts
- professional advisers
- supervisors
Section C
Data Breach
All personal and sensitive data held by HCube is held securely. Electronic data stored on a computer is stored on an external hard drive and/or a password protected computer, in password protected documents held on the C: Drive of the computer. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked cabinet behind a locked door.
In the case of a data breach HCube shall comply with the regulations set out under Article 33 of the GDPR stated below;
1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:
(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;
(b) communicate the name and contact details of the data controller where more information can be obtained;
(c) describe the likely consequences of the personal data breach;
(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
3. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
4. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
5. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
6. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.
Subject Access Request
A Subject Access Request (SAR) permits individuals to request a copy of their personal information.
A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after eight years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.
A SAR request will include information we hold about you, HCube will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
SAR requests should be put in writing to HCube. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to HCube who’s contact address is: H Cube Consulting Limited, 20-22 Wenlock Road, London N1 7GU.
Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made. In some instances my supervisory body or insurance company may require me to lawfully hold your files until the end of their retention period. If this arises I will notify you at my earliest opportunity.
Complaints
HCube hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore HCube would welcome you raising any concerns you have.
These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact HCube.
If you feel you would like to make a complaint about how your personal and sensitive data is handled by HCube you can contact HCube directly. In the event that HCube cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113
Last reviewed August 2020