Appropriate Policy Document

1. Purpose and legal conditions

Mental-health information, assessments, clinical notes and treatment records are processed to assess suitability, plan and deliver CBT, monitor progress, manage risk and meet professional duties. The relevant condition is the provision or management of health care under Article 9(2)(h) UK GDPR and Schedule 1, Part 1 of the Data Protection Act 2018, alongside an applicable Article 6 basis.

2. Data-protection principles

I apply the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; security and accountability. Information is limited to what is relevant for safe clinical care and practice administration.

3. Safeguards

• Access is restricted to authorised use and protected by appropriate passwords, device controls and secure systems.
• Clinical supervision uses anonymised or minimised information wherever possible.
• Service providers are selected with privacy and security in mind and appropriate processing arrangements are used.
• New systems or material changes are assessed for privacy risk where required.
• Data incidents are documented, managed and reported where the legal threshold is met.
• Professional learning includes confidentiality, information governance and safe digital practice.

4. Retention and erasure

Information is kept only for the periods described in the data retention schedule, subject to legal, professional, safeguarding and insurance requirements. At the end of the relevant period it is securely deleted, destroyed or irreversibly anonymised.

5. Review and accountability

Shavaiz Khan is responsible for applying and reviewing this document. It is reviewed at least annually and when the purpose, legal basis, systems or relevant law changes.