Wavelength Psychology is committed to storing, processing and controlling data in a sensitive and a secure way. It is our view that, as opposed to representing a barrier to our work, effective and ethical data handling is central to our practice. We are proud to work collaboratively and in a transparent way with children and young people, and key adults within their lives, to bring about positive change.
If we are all on the same wavelength, we can achieve so much more.
Our Data Protection and Privacy Policy is available below, and describes the ways in which we handle important information. We strongly advise that the Policy is read and understood by our clients and key individuals within the lives of the children and young people, with whom we work.
Data Protection & Privacy Policy: May 2018
This document and the actions specified therein are based on the General Data Protection Regulation (GDPR), enforced from 25 May 2018 onwards.
Wavelength Psychology is a service responsible for gathering and processing information relating to children and young people, and key individuals within their lives.
Why Do We Need to Store, Keep, Interpret, Process and Share Data?
In order to adhere to the British Psychological Society’s Practice Guidelines, Third Edition, (dated August 2017), and the Standards of Proficiency for Practitioner Psychologists stipulated by the Health and Care Professions Council, (dated 1st July 2015), it is necessary for Wavelength Psychology to store, interpret and share sensitive personal data and data which is described as “special category data” in Article 9 of the GDPR. Wavelength Psychology does so on the basis of legitimate interest, as described within Article 6(1)(f) of the GDPR:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
Wavelength Psychology also gathers, retains, processes, and shares special category data, which is more sensitive, and requires more protection, in conjunction with the following paragraphs within Article 9 of the GDPR:
2(b): processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.
2(d): processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
2(h): processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
What Types of Data Do We Process and Control, and Who Else May Have Access to It?
The following are examples of personal data and special category data processed by Wavelength Psychology:
- Names (personal data).
- Date of birth (personal data).
- Name(s) of parent(s) / guardians (special category data).
- Address (personal data).
- Telephone number of parent(s)/guardians (special category data).
- Names of other professionals, agencies and services, to whom children, young people and families are known or have been referred (special category data).
- Information relating to medical diagnoses and the findings and conclusions of other professionals, agencies, and services (special category data).
- Information relating to the development and personal experiences of children, young people, and families. Such information may be provided by children, young people, other professionals, school staff, and parents/guardians. (special category data).
- Information relating to school attainment and assessment (i.e. existing test scores, attainment or national curriculum levels, the observations of school staff) (special category data).
- Names of school staff, or staff within organisations, who work closely with individual children, young people and families (special category data).
- Information such as psychometric test scores and information recorded by practitioner psychologists working on behalf of Wavelength Psychology, during direct work with children and young people (special category data).
- Information relating to client financial transactions, invoicing, and payment (special category data).
- Information included within an initial contact form on www.wavelengthpsychology.co.uk , which reaches Wavelength Psychology via email (special category data).
- Information relating to queries and enquiries, which is included within telephone messages and SMS messages, which Wavelength Psychology receives (special category data).
Wavelength Psychology is committed to facilitating positive change within the lives of children and young people, central to which is clear communication and information-sharing. Sharing and triangulating key information is essential, in terms of helping us to identify risk factors (influences which may be detrimental to wellbeing and development) and protective factors (influences which may facilitate wellbeing and development) within the lives of children and young people. Gathering and processing the above types of special category data ensures that we are able to do so. In addition, Wavelength Psychology is able to use such information to inform the work and the approach taken by practitioner psychologists, in terms of their work with individual children, young people, and families. Wavelength Psychology also uses special category data to help to identify areas of strength and need exhibited by children and young people. Interpreting this information then helps us to identify the ways in which we are able to elicit positive change in the lives of children, young people, and their families. The above processes may involve receiving information from other professionals, and/or onward referral to other professionals and agencies, who may also use information provided by Wavelength Psychology in order to facilitate positive change. All of the above are examples of the ways in which we process special category data, on the basis of legitimate interest. Examples of professionals who may receive processed data from Wavelength Psychology are as follows:
- NHS Services such as Occupational Therapists, Paediatricians, Health Visitors, Physiotherapists, Speech and Language Therapists, the South of Tyne and Wear Children and Young People’s Service, and CAMHS community services.
- Services associated with the Local Authority, who are in a position to provide support and guidance, in relation to children and young people. For example, the Autism Outreach Team, the Behaviour Support Service, the Language and Learning Team, and Children’s Services/Social Services.
- Staff from client schools, in addition to school staff associated with a change in provision or a “new school.”
Typically, client schools and organisations take responsibility for referring children, young people and families to other agencies and services, and this often involves providing other professionals with copies of reports and written correspondence from Wavelength Psychology (in the majority of cases, after having sought the agreement of parents/guardians, as applicable). However, in the case of safeguarding concerns and disclosures of harm made by children and young people, Wavelength Psychology reserves the right to share data and to inform the designated person within school (or within the setting) without delay, and without requesting permission from parents/guardians. In accordance with local protocols, school staff may then make the decision to share information relating to safeguarding concerns with Children’s Services at the earliest opportunity.
How Do We Obtain, Store and Process Data?
Wavelength Psychology obtains, stores and processes data and information in the following forms:
- Written notes relating to observations and discussions with children, young people, and key adults.
- Completed referral forms signed by parents/guardians.
- Record forms relating to psychometric testing.
- Copies of reports and clinic letters provided by other professionals and agencies.
- Electronic documents relating to meetings, discussions, and supporting information (e.g. using MS Word files and pdfs).
- Electronic documents associated with psychometric test scores and analysis.
- Electronic copies of reports and records of involvement, produced by Wavelength Psychology.
- Emails which include information from prospective clients (i.e. sent via online website contact form).
- Emails which include information relating to children and young people, which are anonymised or initialled, so as to protect identity.
- Website cookies. Cookies are small text files which are stored on your computer or hard drive. Wavelength Psychology’s website uses cookies which do not do anything other than help to load the content of the website on your browser or device.
- Spoken information associated with telephone voicemail messages, and SMS messages received.
Wavelength Psychology therefore makes use of data which assumes the form of information presented on paper (i.e. hard copies), electronic information such as files produced using computer software, and spoken information.
How Long Do We Keep Data For?
Wavelength Psychology is a limited company, which operates independently of any local or national body or organisation (but, whose services may be commissioned by such organisations). To our knowledge, and at the time that this policy was written, we are unaware of any specific statutory regulations associated with the timescale within which data held by independent Educational and Child Psychology Services should be retained or destroyed.
In accordance with the Data Protection Act (1998), Wavelength Psychology acknowledges that data should not be kept longer than is necessary.
Based on our discussions with the Association of Educational Psychologists in May 2018, we consider it best practice to retain data relating to children, young people, families and schools until the child or young person who is the focus of the casework, reaches 26 years of age. This mirrors the existing guidelines which are applied to medical records and information. For example, the British Psychological Society’s Practice Guidelines, Third Edition (dated August 2017), states that:
“For independent practitioners general guidance is that many independent psychologists
keep records relating to contact with adults for 7 years, and follow NHS guidance
in relation to children.”
“Retention and destruction of health records, both paper and electronic, is covered in the
NHS code of practice for records management. Generally speaking, retention is until age
26 for people seen as children; 20 years after the last contact for adults, and 8 years after
death if the death occurred while the person was in the care of the NHS. There are specific
requirements for mental health services depending on the nature of the contact.”
Wavelength Psychology believes that the potential benefits to our data subjects (i.e. people about whom we hold data), as regards retaining data for long periods of time, outweigh the potential risks associated with the premature destruction of data. For example, it is possible that individuals may request information from us in the future, for the purposes of medical assessment and diagnostic processes, which are reliant upon information over the course of an individual’s development. However, as described within the preceding paragraphs, Wavelength Psychology stores and processes data in a number of different forms, and it is our policy to retain different types of special category data for varying periods of time, depending upon its expiration and practical use. The table below provides an overview of our practice, in relation to the retention of special category data.
| Special Category Data | Data Format | Data Retention Period | Why? |
| Reports and records of involvement produced by Wavelength Psychology in relation to work on a particular case. | Electronic information, typically an MS Word file or pdf. | Until child/young person reaches 26 | Reports and records of involvement provide a detailed description of the work undertaken by a practitioner psychologist, which includes: assessment, interpretation and conclusions. These documents also refer to important information provided by other professionals, agencies and services, available at the time at which the report was written. This information will have helped the psychologist to draw conclusions. Therefore, a report and record of involvement document represents an important synthesis of information and data, which describes the development and experiences of a child or young person, at a particular point in time. |
| Electronic documents relating to meetings, discussions and supporting information. | MS Word file or pdf | Up to the time at which a child or young person reaches 26 years of age. | Further information may be gathered, in relation to a child or young person after a report or record of involvement has been produced, and when it is also likely that Wavelength Psychology will become actively involved in their case again in the future. It is therefore prudent to keep a record of such information if this is likely to be the case. |
| Record forms relating to psychometric testing. | Paper copies | Record forms destroyed after a report and record of involvement has been produced. | It is impractical, and arguably unnecessary to retain hard copies of test forms, once the scores have been calculated, and once this information has been interpreted. Scores are quoted within reports and records of involvement (see above), and practitioner psychologists tend not to refer to the original record forms again, once these have been used for the purpose of scoring and reporting (i.e. their purpose has been served at the time). |
| Hand written notes relating to discussions with children and young people, and other key adults. | Paper copies | Data destroyed as soon as a report and record of involvement has been produced. | Key information is included within reports and records of involvement, which assume an electronic form. Hand written notes become unnecessary duplicate copies. |
| Special Category Data | Data Format | Data Retention Period | Why? |
| Hard copies of reports and information provided by other professionals, agencies, and services. | Paper copies, | Data destroyed as soon as a report and record of involvement has been produced. | Key information is included within reports and records of involvement, which assume an electronic form. Hard copies of information and data included within a report and record of involvement become obsolete and are destroyed immediately after a report and record of involvement is produced. |
| Referral forms. | Signed hard copies, which are then scanned to produce a pdf document. | Paper copies are destroyed immediately after the forms are scanned and converted to a pdf file. | Referral forms provide important information in relation to the initial understanding and agreement of parents, guardians, schools and other organisations, at the time of referral. Wavelength Psychology also provides information and signposting relating to this policy, and it is important to us that key adults within the lives of children and young people are able to indicate that they are aware of this. Similarly, parental views are recorded on referral forms, which provide psychologists with crucial information. |
| Information included in initial emails, received via website contact form. | Text, electronic content of email. | Email deleted as soon as Wavelength Psychology has responded. | Information from initial contact emails may be transferred to MS Word document, should it be the case that Wavelength Psychology agrees to undertake work relating to the initial enquiry. If it is decided that no further action should result from the initial enquiry, there is no basis upon which to retain associated data. |
| Information included in email correspondence. | Text, electronic content of email. | Email deleted as soon as important information has been extracted or actioned. | Wavelength Psychology employs every measure possible to ensure that the identify of individuals is protected within outgoing emails (i.e. in terms of using initials, anonymising information, and limiting the amount of specific information included, which may be suggestive of identity). Similarly, Wavelength Psychology includes a disclaimer message within body of emails sent, to inform the recipient of their responsibility to handle the data included with due diligence and care. |
| Special Category Data | Data Format | Data Retention Period | Why? |
| Telephone voicemail messages and SMS messages. | Voice recording/spoken information.
Text based information. Both accessed via mobile telephone. |
Voicemail message and SMS message deleted as soon as the relevant information has been extracted. | Wavelength Psychology sometimes receives brief messages via telephone to facilitate further communication. These are treated as transient and are eliminated as soon as their purpose has been served (i.e. Wavelength Psychology does not consciously use these methods as a means of storing data over any period of time). |
| Information relating to clients’ payment, service level agreements, and invoicing. | Electronic documents, pdfs. | Invoices and confirmation of payments kept over the relevant yearly accountancy period for the purposes of providing evidence of financial transactions to HMRC (after which, the electronic files are deleted). Signed copies of service level agreements are scanned and retained over the period of agreed service delivery. | The main purpose of a Service Level Agreement is to set out the terms of the service to be delivered, and the expectation of Wavelength Psychology and its clients. It is also important that there is a record of an agreement, in terms of service charges and the services to be delivered. Once these services have been delivered, payment has been completed, and the service level agreement has been fulfilled, there is no further reason to retain this data.
Similarly, data relating to payments due, and payments completed, is retained for HMRC purposes only, and other than that, has no further function. |
How Do We Store Data and Ensure That It Is Safe?
Wavelength Psychology adheres to the Data Protection Act (1998) by ensuring that data which is recorded in written form (i.e. paper copies) are stored in securely locked cabinets, within a secure environment, which are only accessible by practitioner psychologists working on behalf of Wavelength Psychology. Electronic files are stored on password protected computers, and are sent to clients in the form of encrypted and password protected files. Wavelength Psychology also makes use of the latest anti-virus software and malware protection, which is updated on a regular basis.
What are My Rights and the Rights of My Child?
Wavelength Psychology asks parents, guardians, schools and other referring organisations to complete and sign a referral form, when they wish to commission services in relation to an individual child and young person. This provides an important opportunity to gather and to document the views and concerns of parents and guardians at the time of referral. The referral form also provides parents, guardians, schools and referring organisations with important information, as regards assessing this policy and the information included within (ie. in relation to the ways in which special category data relating to their child is likely to be processed). It is crucial that parents and guardians are aware that Wavelength Psychology will gather, store and share information in ways which are deemed to be within the best interests of children and young people, and in keeping with the professional standards expected of practitioner psychologists (many of which are described within the preceding sections of this policy).
Children, young people, parents and guardians have the right to request and access the information which Wavelength Psychology holds in relation to themselves and their child or children. However, it is important to recognise the rights of children and young people in terms of confidentiality. Wavelength Psychology reserves the right not to share information, when children and young people have communicated their expressed wish for information or data to remain confidential (providing that the practitioner psychologist involved considers this course of action not to represent a threat or risk to the wellbeing of the child of young person in question, or if the psychologist deems that there is an ethical basis for doing so). This is in keeping with guidance relating to confidentiality, which is provided for qualified psychologists within the British Psychological Society’s Practice Guidelines, Third Edition, dated August 2017. Similarly, Wavelength Psychology has a responsibility to report disclosures and safeguarding concerns to the designated person within a school or organisation, and it is not necessary to seek permission from children, young people, or parents and guardians, when there are legitimate concerns that a child or young person may be at risk of harm
Children, young people, parents and guardians also have the right to request that data is erased, that data is rectified or amended, or, that the processing of their data is ceased or restricted. Wavelength Psychology will consider such requests in relation to whether there remains a basis for legitimate interest (i.e. the lawful reason associated with which Wavelength Psychology processes and controls personal and special category data). Wavelength Psychology reserves the right to refuse requests, should it be deemed that there is an overriding legitimate interest to continue to process and control data. Should requests be refused, Wavelength Psychology will provide clear reasons as to how a decision has been reached, and why no further action will be taken.
We are always more than happy to discuss or to provide further information in relation to the ways in which we handle personal and sensitive data, and welcome enquiries and queries. Parents, guardians, children, and other key individuals have the right to lodge complaints with the Health and Care Professions Council, in relation to concerns about professional practice (see http://www.hcpc-uk.co.uk/ ), and the Information Commissioner’s Office, should concerns arise in relation to data handling and processing (see https://ico.org.uk/ ).
What Happens If There Is a Problem?
Should a data breach occur, Wavelength Psychology will report this to the Information Commissioner’s Office at the earliest possible opportunity, in addition to contacting individuals who may be affected as soon as possible.
Wavelength Psychology is committed to storing, processing and controlling data in a sensitive and a secure way. It is our view that, as opposed to representing a barrier to our work, effective and ethical data handling is central to our practice. We are proud to work collaboratively and in a transparent way with children and young people, and key adults within their lives, to bring about positive change.
If we are all on the same wavelength, we can achieve so much more.
References:
- British Psychological Society (2017). Practice Guidelines: Third Edition.
- Health and Care Professions Council (2015). Standards of Proficiency: Practitioner Psychologists.
http://www.hpc-uk.org/assets/documents/10002963SOP_Practitioner_psychologists.pdf
- Data Protection Act (1998).