Data Protection Policy Guide

PRIVACY & DATA PROTECTION POLICY (GDPR)

Date: 04.11.2025

Shining Gems Child Therapy

Data Protection Policy

This notice is in regard to data protection laws, and is regarding information that is both requested by {shining gems child therapy} and that which emerges as a result of the therapy service that we provide to yourself and the child / young person you have parental responsibility for.

WHO WE ARE

Shining Gems Child Therapy provides children & young people (ages 5-17),

and their parents or carers with trauma-informed support and/or therapy through; Play & Creative Therapy; Trauma Informed Stabilization Treatment (T.I.S.T) for Young Children with Developmental Trauma and Dissociative Symptoms; Holistic / Alternative Therapies (Reiki & Aromatherapy); Parenting and DDP-informed support for Foster Carers and Parents of Adopted Young People and Trauma Focused CBT & Trauma Processing.

Gemma Byass is the clinical director and sole employee of shining gems child therapy and is in control of data processing. Gemma Byass is a trained creative psychotherapist, registered accredited play therapist with PTUK and member of BACP.

WHAT INFORMATION DO WE COLLECT FROM YOU / ABOUT YOU?

Contact details (referrer / parents / carers / guardians / DSL / safeguarding lead)

Contact details (child or young person where relevant e.g. if their contact details are different to parents/ they’re over 16 and arrange therapy independently)

Relevant life data for both child and parent which may help to inform the therapy treatment plan e.g. medical history, developmental history, details of any trauma, previous and current family set up, school history, bereavements or losses, personal and emotional challenges etc.

Psychotherapist’s notes throughout treatment and in relation to research / further referencing undertaken to aid and enhance the work

Video and/or audio recordings of DDP informed sessions to share with the therapist's supervisor or for learning and/or research purposes.

When & where relevant, information may be requested from other professionals who have experience of your child / young person and the challenges they are facing e.g. teachers, SENCos, educational psychologists, speech therapists, GPs etc. Reasonable attempts will be made to seek parent/guardian permission to share information, even when information is required due to a safeguarding issue.

REASONS WHY WE COLLECT THIS INFORMATION FROM YOU

Information collected by Shining Gems Child Therapy: This information is used to inform the type and duration of therapy, to keep in contact with the relevant parents/carers/guardians and authorities that have commissioned the therapy work, to give feedback on progress where required and provide information on therapeutic outcomes where required. This information will also be shared during clinical supervision with the therapist’s registered clinical supervisor to support therapeutic outcomes, safeguarding and learning.

To establish and fulfil a contract with you, for example, if you make a purchase, enter into an agreement to receive services. This may include verifying your identity, taking payments, communicating with you, providing customer services and arranging the delivery or other provision of products or services. We require this information in order to enter into a contract with you and are unable to do so without it.

To comply with applicable law and the requirements of the Professional Standards Authority in the accreditation of the ‘Register of Play and Creative Arts Therapists’.

In accordance with our legitimate interests in protecting PTUK’s legitimate professional interests and legal rights, including but not limited to, use in connection with legal claims, compliance, regulatory and investigative

purposes (including disclosure of such information in connection with legal process or litigation).

With your express consent to respond to any comments or complaints we may receive from you, and/or in accordance with our legitimate interests including to investigate any complaints received from you or from others, about our web site or our products or services;

If you make payment for services with a credit or debit card, we may use third parties (such as Stripe/POS payment providers) to check the validity of the sort code, account number and card number you submit in order to prevent fraud, in accordance with our legitimate interests.

WHO WE MIGHT SHARE THIS INFORMATION WITH & WHY

Due to the confidential nature of the therapy service, sharing any information given is kept to an absolute minimum. Circumstances where sharing might / will be necessary are as follows:

During clinical supervision (as in previous paragraph).
Sharing information anonymously as an example of a case study or to share treatment effectiveness.
As part of a safeguarding concern / child protection issue - the child will be told that all information shared in therapy remains safe and confidential, unless there is a safeguarding concern and then we would agree who any safeguarding concerns would be shared with and how, for example - telling them together or myself informing them. All reasonable attempts will be made to share any safeguarding information with parents and/or carers, whereby it is safe to do so and does not create a further safeguarding issue for the child or young person. Children aged 16 years and over can decide whether or not this information is shared with a parent/carer/guardian beforehand.
As part of a legal duty with a reasonable line of enquiry or by court order/subpoena with a reasonable line of enquiry.

Some information may be shared with an accountant in order to process accounts - information of this nature will be minimised by the use of anonymised client codes.

IS THE INFORMATION USED FOR ANY OTHER REASONS THAN DETAILED ABOVE?

Your information will never be used without permission for anything other than a vital supplementary aid to the therapy work and as a means of contacting you when necessary. Information gathered by Shining Gems Child Therapy is the property of the client, their guardian/parent/carer and Shining Gems Child Therapy and is not to be shared to any third parties without permission from all parties involved.

The therapist’s contact number, name and address details must not be shared with third parties without permission from the therapist. This includes any pictures of the therapy room, or details of the therapy undertaken. This is to protect the therapist’s and client’s privacy and autonomy.

Play Therapy United Kingdom (PTUK)

How we will use your details

a. Your personal contact details (your name, address, phone number and email address)

We will only use this information to contact you or for reporting the progress and results of the therapy for quality assurance purposes. We will only share these details outside of our organisation for medical or legal purposes or, if it is relevant, when our computer systems are being repaired.

b. Your child’s age, sex, ethnic background and why they have been referred for creative counselling

We will use this information in reports circulated within our organisation. We use it to assess how effective and efficient the service is for different types of

children. If the details contain your or your child’s name, we will mark them as ‘confidential’ and store them securely. If we send this information outside

our organisation, we will make it anonymous so that neither you nor your child can be traced.

c. Measures based on the results of questionnaires (e.g. SDQs)

You or the person who referred your child for play therapy will fill in these questionnaires. We will use the questionnaires to assess how severe any emotional well-being, behaviour or mental-health issues are so that we can decide how many sessions your child needs and who they should see. We may also use the questionnaires after therapy has started and definitely at the end of therapy to see what changes have happened. If any reports contain your child’s name, we will mark them as ‘confidential’ and store them securely. If we send the reports outside the organisation, we will make the information in them anonymous so that it can’t be linked to you or your child.

d. The activities your child does during the sessions

We use this information to review your child’s progress. We also use it to see which activities help improve children’s emotional well-being and mental health so that we can improve the quality of our therapists’ practice, including their training. If any reports contain your child’s name, we will mark them as confidential and store them securely. If we send reports outside the organisation, we will make the information in them anonymous so that it can’t be linked to you or your child.

2 Supervision and quality assurance

All practitioners on the Register of Play and Creative Arts Therapists, managed by PTUK and accredited by the Professional Standards Authority, must have a set number of hours of clinical supervision. The therapist makes a verbal report on each child to a clinical supervisor who is very experienced in working in therapy with children. The child’s progress, including their problems, what they do in the sessions, any significant themes in their play and anything else that is relevant, is discussed. The clinical supervisor

assesses and reviews a therapist by providing support and advice, identifying any problem areas and, if necessary, suggesting action to be taken.

Notes may be taken during the discussions between the therapist and supervisor. If these notes contain your or your child’s name, we will mark them as confidential and store them securely. If we send any part of these notes to anyone else or another organisation, we will make your or your child’s personal details anonymous so that you can’t be traced.

3 Play Therapy UK

Play Therapy UK is my professional organisation. It uses information about your child and their play therapy activities to check the quality of therapists’ service, and to update the clinical evidence base (see below) and other research projects which are aimed at improving the quality of therapists’ practice for the benefit of the children they work with.

The clinical evidence base is kept in a secure computer database managed by us. It is used to compare the results of therapy with a child’s characteristics (such as their age, sex, ethnic background and the condition they have been referred with), the number and type of sessions and the therapy activities that have taken place. Doing this helps us to set guidelines of good practice, and to identify any areas of risk or where further investigation (through research) is needed. I make all the information anonymous so that a child cannot be identified in any lists or reports that are produced. When we analyse and report on information, it is based on groups of a minimum number of 200 cases and does not identify any child.

PTUK therapists have to re-register each year. They do this by providing the following information.

· Your child’s age, sex, ethnic background and the condition they were referred to us with

· Measures they have taken based on information from questionnaires

· The therapy activities carried out by the child during the sessions

We may also share your personal data with the below third parties:

Our professional advisors such as our auditors and external legal and financial advisors;

Other registrants and other Professional Standards Authority Accredited Registers;

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if needed for the legal protection of our legitimate interests in compliance with applicable laws;

Personal data may also be shared with third party service providers who will process it on behalf of PTUK for the purposes above. Such third parties include, but are not limited to, providers of PTUK hosting, email services, maintenance, call centre operation and identity checking;

In the unlikely event that our organisation or any part of it is sold or integrated with another organisation, your details will be disclosed to our advisers and those of any prospective purchaser and will be passed to the new owners of the organisation.
In the event of Gemma Byass becoming critically ill or in the event of her death the clinical executor will have access to her client information to be able to contact and inform clients, including passwords and sensitive personal data. The name clinical executor is:

Use of Google Workspace

Shining Gems Child Therapy uses Google Workspace to manage client information securely. This includes Gmail, Google Drive, Google Docs, Google Sheets, and Google Forms. Google Workspace provides encrypted, UK-GDPR-compliant cloud storage and communication tools for organisations.

All client-related data within Google Workspace is:

Stored securely in password-protected accounts with two-factor authentication.

Hosted on Google’s UK or EU data centres, under Shining Gems Child Therapy’s control

Accessible only to the therapist (and, where necessary, the clinical supervisor)

Not shared with any third party without consent or legal safeguarding duty

Google acts as a data processor on behalf of Rubix Therapy Ltd. A Data Processing Agreement (DPA) is in place ensuring all personal data is handled in accordance with UK GDPR and the Data Protection Act 2018.

Shining Gems Child Therapy uses Google Workspace to:

• Send and receive encrypted emails

• Store client files, session notes, and reports

• Collect and manage referral and consent forms

• Hold online sessions via Google Meet (when appropriate and agreed)

No client data is shared publicly or stored on personal devices. Data is reviewed and deleted in line with our retention schedule.

HOW & WHERE IS THIS INFORMATION STORED?

All sensitive information gathered will be stored on a password protected and encrypted USB that is locked in a home safe. The keys to the safe will be kept in a lock box away from the safe when the USB is in storage and the USB will not travel outside of the therapy space unless in a locked, password protected box.

All session recordings will be put on to an external hard drive and for sharing purposes be placed onto a CD for sharing. The CD will then be either handed to the client and parent/carer/guardian whose information it holds, to keep safe, or the CD will be destroyed via a CD shredding machine. The external hard drive will be stored in a locked home safe and the keys will be stored in a separate lock box away from the safe. The hard drive will not leave the therapy space.

Any hand written notes from sessions will be shredded and are not kept on file. Information from play therapy sessions will be imputed into a secure PTUK data system (Fortuna) for the purpose of ethical recording of therapy and research purposes. Any personal information stored will have a client code for anonymity.

Process boxes and artwork will be stored in a locked cupboard in the therapy room until the client expresses wanting to destroy the work or takes it away with them at the end of therapy.

Fortuna

Fortuna is a highly secure system provided by PTUK for me to record your and your child’s information. Your and your child’s name and address are only processed by me (your therapist), for communication purposes. They are not processed by PTUK except, if relevant, when our computer system is being repaired. Neither are they released by PTUK to any other organisation or person.

HOW CAN I ACCESS THIS INFORMATION YOU HOLD ABOUT ME?

You have the right to access any information held about you personally and when a formal written request has been made by e-mail to Shining Gems Child Therapy. For details of information I, your service provider, or a clinical supervisor holds, please contact: (gemmabyass@shininggemschildtherapy.co.uk) we will allow you access to this within 30 days of the request. Please note, due to child privacy laws we cannot share information held about your child with you as a parent/carer/guardian. Your child or young person can make their own personal request for information from age 16+ if they are gillick competent and understand how to keep that information safe. Children have the right to confidentiality, and sharing their information without their consent is only permissible in specific situations, such as when there is a risk of harm, and even then, the child should be informed if it is safe to do so. A therapist's duty of care requires them to keep information confidential unless a legal or ethical justification for sharing exists as detailed above.

If your child/young person is having play therapy sessions then please contact Play Therapy UK for any details held by them, please contact:

PTUK Data Protection Officer, Radek Kwietniewski, at dataprotection@ptukorg.com. You can also contact them through the general contact email contact@ptukorg.com or by phone at +44 (0)1825 761143

Play Therapy UK

The Coach House

Belmont Road

Uckfield TN25 1BP.

Registrant’s UK Data Protection ICO Register number: A8941440

Play Therapy UK Data Protection Register number: ZA107748

For further information on your individual rights please go to https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

HOW LONG DO WE KEEP HOLD OF THIS INFORMATION?

Information relevant to therapy and outcomes will be kept throughout the duration of therapy and whilst creating any ending reports. In private therapy, the therapist will retain information relevant to the child, until the child reaches 25, or 26 if they were 17 at the end of treatment, or for at least 7 years after they turn 18.

PTUK - We will not keep your personal information for any purpose for longer than is necessary and will only retain the personal information that is

necessary in relation to the purpose. We are also required to retain certain information as required by law or for as long as is reasonably necessary to meet regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions.

In the case of any contact you may have with our support services team, we will retain those details for as long as is necessary to resolve your query and for two years after the query is closed. We will retain your data for a short time beyond the specified retention period, to allow for information to be reviewed and any deletion to take place. In some instances, laws may require PTUK to hold certain information for specific periods other than those listed above.

HOW & WHEN WILL WE DISPOSE OF THE INFORMATION?

Any hand written session notes will be shredded as these are only required for the purposes of supervision and to inform ongoing therapy and client processing must remain private.

Any process boxes, art work, or photos of artwork will be kept for six weeks after therapy has ended to give time to collect these or have them securely posted (at the client’s cost). If not collected, they will then be destroyed by

the furnace. Unless permission is given to share these anonymously on the website or in training.

Any electronic data on the child or young person will be stored on external hard drives and be kept according to GDPR until the child reaches 25, or 26

if they were 17 at the end of treatment, or for at least 7 years after they turn 18. Any information held about the parent/carer/guardian can be requested by them at any point and will be held according to GDPR for 7 years post therapy. These cannot be requested by any third party unless for a reasonable line of enquiry by the court or police.

PTUK store data for as long as is needed on their secure Fortuna platform.

WHAT HAPPENS IN THE EVENT OF A DATA BREACH?

In the unlikely event of a data breach, we have a duty to inform you and the ICO within 72 hours of it occurring. Shining Gems Child Therapy is a member of the ICO and a complaint can be raised via the ICO website - https://ico.org.uk/make-a-complaint/#:~:text=Need%20help%3F,their%20office%20by%20the%20public. Or by telephone on 0303 123 113.

CHILDREN & YOUNG PEOPLE’S CONSENT

Guidelines for child and adolescent consent are ever changing and parents/carers/guardians will be kept up to date of any relevant changes that may impact their child or young person.

Where possible I like to gain consent from children and young people by gauging their understanding of their involvement in therapy and in setting some of their own goals, wishes or aspirations from therapy. I ensure they have informed consent by providing as much information on the process as I can in child friendly language and by doing a check-in at each session, informing them of any changes or disruptions and of involving them in reviews. I like to ensure children and young people are involved at every stage, from assessment to ending reports, so they are aware of the information being stored or shared about them and to whom. End reports and notes are also written in a child friendly language, to the child where possible.

ICO

Gemma Byass is registered with the Information Commissioner’s Office www.ico.org.uk/register as the data controller for Shining Gems Child

Therapy (reference: A8941440). If you have any concerns about how we are handling your data, then please contact the ICO quoting this reference for further advice on how to query or complain.

STATEMENT OF CONSENT

I, the undersigned, acknowledge that I understand and accept all of the above points of (Shining Gems Child Therapy) data protection privacy notice and that I give my consent for (Gemma Byass and PTUK) to hold and store personal information relating to both myself and the child / young person I hold parental responsibility for, for the purposes described above. I understand that I can withdraw this consent at any time by notifying (Gemma Byass and/or PTUK) by phone or by email.