CNS Privacy Statement 

Compass Neuropsychological Services (CNS) is a company offering psychological and neuropsychological assessment and intervention as well as court related work.  CNS (also referred to as ‘we’, ‘us’, ‘our’) are committed to protecting and respecting your privacy. This document, along with our Terms and Conditions, demonstrates how we use and protect your data and ensure GDPR compliance. This privacy notice provides information about the personal information CNS process about you as a data controller, in compliance with the GDPR. 

Our ICO registration number is ZA030086

Further policies on subject data requests and data breaches are available on request.

Why do we collect personal data?

We collect information as you are a client or patient of ours. You might also be a claimant who is part of a litigation process.

We have a number of lawful reasons to use / process your personal data. It is in our Legitimate Interests as a clinical psychologist or expert witness to collect this information. We need to use this information to carry out assessments, interventions and / or to provide our expert advice.

As a patient or client of CNS our lawful reason for processing ‘special category data’ is that it is necessary for the purposes of the Provision of Health or Social Care Treatment.

Another lawful reason for us to collect and process this information may be Legal Obligation. If we are process ‘special category data’ about you, this is our second lawful reason to do so. This is likely to apply if you are being assessed as part of a litigation claim.        

What data do we collect?

We collect information about you that might include personal or sensitive data, such as:-

·         Name, gender, address, telephone numbers, e mail, next of kin details and GP details

·         Communication data in text messages, e mails and voice mails. In order to minimise the risk of a data breach please do not put sensitive information in texts or e mails

·         Information about your current complaints / difficulties

·         History about your background, including medical history, relationships, education / occupation

·         Offences

·         CNS uses third party services (Pearson) to administer and score neuropsychological tests (Q Interactive) or provide computer based interventions (COGMED) but this provider is also GDPR compliant

This information may be provided by the patient / client, professionals involved in your care, Occupational Health providers, insurance companies or solicitors from whom we have received instruction. 

To make sure you receive a safe and evidenced assessment / treatment, we record the above data along with a log of contacts you have with CNS such as appointments, assessments results and letters / reports. Your data is kept confidential within the company at all times.

In the case of assessing clients for court reports we collect the information as required by the court or the solicitors.

In many cases the individual has consented to the transfer of their personal data to us. Where an individual has consented, they may withdraw their consent by contact the service / individual that recorded their consent.      

We also process personal data in relation to our legitimate interests in running CNS including:-

·         Invoices and receipts

·         Accounts, VAT and tax returns

What rights do I have in respect of my personal data?

You have the right to update and correct personal information. You have the right to request from CNS all personal information that we hold that relates to you (Subject Access Request). If your concern is related to a case with a solicitor we are instructed by, please refer the queries through them. We may not be able to comply with a request to correct information we hold about you when it pertains to a litigation claim and this would need to be discussed with your solicitor. You also have the right to object to the processing we carry out based on our legitimate interests. In addition, you have the right to request restriction of the processing of that data and to request that we delete the data (right to be forgotten). Again if the data collected is part of a ligation claim please direct your request to be forgotten to the solicitor who instructed us. Please be aware CNS may not be able to delete your information as some of my professional and ethical regulations may supersede or conflict with some of these rights. If that becomes an issue, I will discuss this directly with you, but be assured I take your rights very seriously.

How do we store your personal data?

We take your privacy very seriously and take all reasonable steps to protect any identifiable information that you provide to us. Once we receive your data, we make best efforts to ensure its security on our systems. 

CNS does not use handwritten notes. All notes are recorded electronically using Notability. However, no data is stored in Notability. Data is stored in Tresorit, which is an online storage cloud that uses end to end encryption to guarantee the safety of store data.  Any data on portable devices is password protected or on a hard drive that is stored securely.  Where possible, data on portable devices is protected by two factor authentication.  E mails will be sent and received to Proton Mail, which is a double encrypted service based in Europe. Where personal data is shared as part of an enquiry, and the client is not taken on, this will be deleted as soon as possible.  

When the data is held by a separate service, such as Pearson, this will be password protected. In addition, clients will be given a code and make all efforts to minimise your identifiable information to: date of birth and gender. Pearson’s Q Interactive terms and conditions indicate the following:

Pearson’s Q Interactive occasionally aggregate test data for research purposes etc, but they assure that no individuals can be identified when they do this. Pearson’s data is processed on Pearson Platforms which is hosted by Century Link in Canada where the law relating to the processing of personal data is regarded by the European Commission as adequate to protect the rights and freedoms of individuals located in the European Union.

How long do we keep the data for?

We do not keep your data for longer than is necessary.  Confidential paper records will be destroyed by means of confidential shredding when data is deemed no longer required for lawful processing and storage e.g. when a legal case has settled or a period of 7 years has elapsed since the completion of psychological assessment or intervention. Electronic data is permanently deleted from encrypted storage by the same standard as paper records.  

Who do we share information with?

Your information is kept confidential within CNS. We will never sell your data. Permission will be sought at the initial session to share any information with 3^rd parties, usually in the form of a report. The option to share information with a person’s GP will also be discussed at the initial session. There are certain circumstances in which we will need to breach confidentiality where there is sufficient evidence to raise concern about the safety of a) the client b) other people known to the client and c) the health, welfare or safety of children or vulnerable adults. If the client makes any threats towards a 3rd party which are relayed to us we will be duty bound to advise the appropriate authorities. CNS may also disclose information if legally required to do so.

As part of our professional conduct and compliancy with the Health Care Professionals Council, we are required to undertake supervision of clinical activity. All individuals involved in supervisory practices adhere to a strict code of professional conduct. Information discussed and recorded as part of this process is anonymised.   

What can you do if you have a concern or complaint?

If you have a compliant or concern about the way in which CNS uses your personal information you have the right to complain to Dr Katherine Maddox, Compass Neuropsychological Services Brooklands Therapy Services, 8A Framingham Road Brooklands, Sale, M33 3SH.

If you do not receive a response within 30 days you are not satisfied with the response you have the right to complain to the ICO whose address is Wycliffe House, Water Lane, Wilmslow, SK9 5AF. www.Ico.org.uk

Changes to this Privacy Policy

If this Privacy Policy changes in any way, we will put an updated version on the website. Regularly reviewing the website ensures you are always aware of what information we collect, how we use it and how we