Information Governance Policies and Procedures

Introduction

Data held by Holistic Health Hive will be held lawfully and for the retention periods set out in this policy document.

This document refers to:

• Written Documents
• Spreadsheets
• Hardcopy case notes and files
• Images
• Emails
• Text messages
• Supervision notes
• Visits to the organisation’s website
• Social media communication
• Databases

Aim and Purpose

The purpose of this document is to ensure that Holistic Health Hive has a framework that ensures the rights and freedom of individuals in relation to their personal data and adheres to best practice in the management of client information and business records.

Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;

• is the right information
• is in the right place
• at the right time
• with the right people
• for the right reasons

This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. Holistic Health Hive is fully committed to ensuring clients privacy and data protection rights.

For the purpose of this policy Louise Fletcher is the named Data Protection Officer/Controller and Head of Organisation.

Information Governance Framework Principles for Holistic Health Hive

1. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.
2. Any data collected is solely for the purpose of providing a person-centred service to an individual client.
3. The FHT's Codes of Conduct is used to provide guidance in best practice when handling personal data found at www.fht.org.uk/sites/default/files/inline-images/fht_code_of_conduct_2022.pdf
4. All technology used to store or facilitate information and communication is maintained according to the Data Retention Policy for Holistic Health Hive.
5. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.
6. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.
7. Any electronic devices where personal or sensitive, confidential information is held will be password protected.
8. Procedures have been put in place to ensure the General Data Protection Regulations are met. 
    

Privacy Notice: Use of information

In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.

• Personal information is collated and stored in hardcopy in a locked filing cabinet.

Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right not to be subject to automated decision-making including profiling.

Please note that Holistic Health Hive does not use automated decision-making tools, including profiling.

Website visitors

When an individual visits thsi website, I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Jayne Sarah Therapies will always be transparent when it comes to collecting personal data and will be clear about how that data is processed.

Following Covid-19 Lockdown

There will be an expectation that clients confirm before each session that:

1. They have not been in contact with anyone with Covid-19, in the last 14 days, to their knowledge
2. They have not had any symptoms: – dry cough, temp over 37.8°C, loss of smell and/or taste
3. Should the client contract the virus they must inform the therapist as soon as possible
4. Should the client contract the virus we are obliged to inform NHS Track & Trace 
5. The client’s temperature will be taken using a contactless thermometer and recorded in their appointment notes

There will also be confirmation from the therapist stating the same declaration

Date Protection and Record Keeping

• Data will be collected in line with the Data Protection Act 2018 and EU General Data Protection Regulation.
• Client records will be reviewed and updated at every appointment.
• Data obtained from clients will be relevent to the treatment.
• Client records will be destroyed after 2 years from their last appointment.
   

Data Breach

All personal and sensitive data held by Holistic Health Hive is held securely. Electronic data stored on a computer is stored on a password protected computer and password protected mobile phone. This supports the ability to retrieve data in the event of faults. Hardcopy data is held securely in a locked filing cabinet.

In the case of a data breach Holistic Health Hive shall comply with the regulations set out under Article 33 of the GDPR;

1. In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.
2. The notification referred to in paragraph 1 shall at least:

(a) describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;

(b) communicate the name and contact details of the data controller where more information can be obtained;

(c) describe the likely consequences of the personal data breach;

(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

1. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
2. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
3. In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.
4. If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.

Subject Access Request

A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.

A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.

A SAR request will include information we hold about you, Jayne Sarah Therapies will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

SAR requests should be put in writing to Holistic Health Hive. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Holistic Health Hive.

Right to Erasure

Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made.

Complaints

Holistic Health Hive hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Holistic Health Hive would welcome you raising any concerns you have.

These Information Governance Policy documents were created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Jayne Sarah Therapies.

If you feel you would like to make a complaint about how your personal and sensitive data is handled by Holistic Health Hives you can contact the Federation of Holistic Therapists on 023 8062 4350.

In the event of my death or sudden illness, my colleague will contact existing clients and archive any client files in accordance with General Data Protection Regulations.