GDPR Privacy Policy

for HMC Play Therapy

At HMC Play Therapy, I am deeply committed to protecting your privacy and maintaining the confidentiality of all personal data. This Privacy Policy outlines how I collect, process, store, and protect your personal data in full compliance with the General Data Protection Regulation (GDPR) and related legislation. I value your trust and strive to ensure your rights are respected throughout our therapeutic relationship.

1. Personal Data I Collect

I may collect and process the following types of personal data to provide high-quality therapeutic services:

Personal Identification Information: Names, dates of birth, gender, and contact details (e.g., phone number, email, home address).
Health and Therapy Records: Therapy notes, session summaries, mental health details, medical history, assessments, reports, and any other data relevant to therapeutic care.
Family or Guardian Information: Names, relationships, contact details, and legal documents such as guardianship or consent forms.
Sensitive Personal Data: Information related to emotional and mental health, behavioural concerns, and other sensitive data necessary for providing tailored therapy services.

2. Legal Basis for Processing Personal Data

I process your personal data under the following lawful bases as outlined by GDPR:

Consent: I will obtain explicit consent from you or your guardian (if the client is a minor) before processing any personal data.
Contractual Obligations: Processing is necessary to fulfil the terms of our therapeutic contract or to take steps to establish one.
Legal Obligations: In certain circumstances, processing may be required to comply with legal obligations, including safeguarding or child protection laws.
Legitimate Interests: I may process data based on my legitimate interests as a therapist, provided these do not outweigh your rights and freedoms.

3. How I Use Personal Data

I use personal data solely for the following purposes:

To provide personalised therapy services that meet the individual needs of each client.
To create and maintain accurate therapy records to ensure continuity of care and therapeutic effectiveness.
To communicate with clients, their families, and relevant professionals involved in their care.
To comply with any legal, regulatory, or contractual obligations.
To assess and improve the quality of therapy services and client experience.

4. How I Store and Protect Personal Data

I am committed to ensuring that your personal data is stored securely and protected from unauthorised access, alteration, or loss. Personal data is stored in the following ways:

Electronic Records: Stored on secure, password-protected systems with encrypted backups to ensure confidentiality.
Paper Records: Kept in locked, secure filing cabinets, accessible only to authorised personnel. I retain personal data only as long as necessary to fulfil the purposes outlined in this policy or as required by applicable law. Once this retention period has ended, I will securely destroy all personal data.

5. Sharing of Personal Data

I respect the confidentiality of your personal data and will only share it with third parties when necessary and with your explicit consent or as legally required. Data may be shared with:

Healthcare Professionals: With your consent, I may share relevant therapeutic information with other healthcare providers involved in your care (e.g., doctors, psychiatrists).
Educational Institutions: With consent, I may share therapy insights or recommendations with schools to support your child's academic and social development.
Regulatory Authorities: If required by law, I may disclose personal data to comply with safeguarding obligations or other legal duties.
Person of Trust: In the event of incapacity or emergency, I may disclose your information to a trusted person (designated in my GDPR policy) to inform you of any urgent matters.

Important: I do not sell, rent, or lease personal data to third parties under any circumstances.

6. Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Right to Access: You can request details of the personal data I hold about you or your child.
Right to Rectification: If any data is inaccurate or incomplete, you have the right to request corrections.
Right to Erasure: You can request that I delete your personal data when it is no longer necessary for the purposes for which it was collected.
Right to Restrict Processing: You may request that I limit the use of your personal data under certain circumstances.
Right to Data Portability: You can request that I provide your data in a structured, commonly used format to transfer to another service provider.
Right to Object: You have the right to object to processing under certain conditions, especially where data is being processed based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: If data processing is based on your consent, you can withdraw that consent at any time.

To exercise any of these rights or if you have any questions or concerns about your personal data, please contact me, Hannah Cracknell, at hannah@hmcplaytherapy.co.uk

7. Data Security

I take all necessary precautions to ensure the security of your personal data. These include:

Implementing encryption and secure storage methods for electronic records.
Conducting regular security audits and training to minimise the risk of unauthorised access or data breaches.
Maintaining confidentiality and ensuring that only authorised personnel have access to personal data.

8. Data Breaches

In the unlikely event of a data breach that may pose a risk to your rights and freedoms, I will notify you without undue delay, and where required, I will inform the relevant supervisory authority (the Information Commissioner’s Office) within the required timeframes as stipulated by GDPR.

9. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, best practices, or how I conduct business. Any updates will be posted on our website or communicated directly to you if significant changes are made. Please review this policy regularly to stay informed of how I am protecting your personal data.

10. Contact Information

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise any of your rights under GDPR, please contact me, Hannah Cracknell, at hannah@hmcplaytherapy.co.uk or by phone.

Last updated: March 2025

Child Protection Policy for HMC Play Therapy

At HMC Play Therapy, I am committed to providing a safe and nurturing environment for all children and young people, irrespective of their age, gender, disability, ethnicity, faith, identity, or sexual orientation. My primary goal is to create a therapeutic space where every child feels safe, respected, and valued.

I adhere to my own safeguarding policy and the guidelines set out by BAPT (British Association of Play Therapy).

Safeguarding Commitment

I am registered with the Enhanced DBS (Disclosure and Barring Service) system, and I regularly renew my safeguarding certification to ensure that I am up-to-date with current safeguarding practices.
I follow the child protection and safeguarding guidelines as outlined in the BAPT Child Protection & Safeguarding Policy [BAPT Policy Link].

Working with Schools

When working with children in schools or educational settings, I will also follow the school's specific child protection, data protection, and health and safety guidelines. In cases of any conflict between ethical principles, I will base my actions on the principle that most benefits the child.

Incapacity Provision

If I become unable to work due to illness, injury, or death, a person of trust will have access to my client list (including names and contact details). They will contact you to inform you of the situation and ensure that necessary steps are taken. This provision is detailed in my GDPR policy.

This policy has been designed to ensure transparency, protection, and respect for the privacy of my clients, as well as adherence to all applicable laws and best practices. I am committed to providing a safe, supportive environment for children and young people throughout their therapeutic journey with HMC Play Therapy.