My website address is: http://teresabliss.com.

GDPR Privacy Policy May 2019

The General Data Protection Regulation (GDPR) 2016 and the subsequent UK Data Protection Bill, 2018 requires all those using data, personal information, to safeguard it in a responsible way and to have a policy about how to do it. This policy describes the information that is collected when you use my services. My intention is that you understand why I collect and use information about you and/or your child.

The policy describes how I manage your information when you use my service, if you contact me or when I contact you. It also provides extra details to accompany specific statements about privacy that you may see when you use my website (such as cookies). If you visit my website, information can be found regarding the use of cookies in the Cookie Policy. This outlines information about the type of cookies that my website uses and how you may disable those cookies, if you choose to do so.

I use the information I collect in accordance with all laws concerning the protection of personal data, indicated above.  As per these laws, I am the data controller for the information that you give to me. My contact details can be found on my website teresa.bliss@btinternet.com

If another person has requested access to your data I will ask for your consent to share information and outline who they are, what they will do with your data and why I need to provide them with the information. There are two legal reasons where I do not need to ask for your consent to share the data with a third party: if there is a risk to your child’s vital interests or if I have a legal obligation to share the data.

The GDPR requires that I identify the legal basis upon which I process your personal data. I shall provide psychological services and all associated activities on the basis of:

  1. My contract with you
  2. My legitimate interest to hold and process your personal data so that I can determine whether it is appropriate for me to provide services to you.

What is meant by ‘The contract’?

When an assessment or consultation is requested, the client is asked to read, complete and sign my pre-assessment form. That document describes the work that I will undertake and, by completing the document, you enter into a contract with me to do the work. I will process all personal data that you share with me for the purpose of completing an assessment or consultation, lawfully, fairly and in a transparent manner. It will be necessary for me to process your personal data in order to fulfil the contract with you.

What are my ‘legitimate interests’?

The reason that I need to process your personal data is to fulfil a request that I provide psychological services to you/your child. I do not seek work but only respond to commissions from parents or school staff. Educational psychology assessments and consultations involve the processing of special category data. This include a variety of information. For example, about your child’s health, cognitive functioning, social and emotional issues and family history. There is a legitimate interest to collect such personal data for the purpose of forming a well-informed professional, psychological opinion. I will only collect information from you that is relevant for the process of providing you with the psychological services that you have requested.

  1. Why do I need to collect your personal data?

In order to carry out an effective assessment or consultation, I need to collect information about you and/or your child so that I may:

Communicate with you by email or phone. The legal basis for this is a legitimate interest.

Deliver services to you and your child, for example by preparing a relevant assessment and providing the requested, well informed psychological advice for your child. The legal basis for this is the contract with you.

2. What personal information do I collect and when do I collect it?

To provide helpful psychological services to you and your child, it is important for me to know your child’s situation and what the concerns are, that led to psychological support being requested. This data is usually collected by the parent or primary carer completing a Parental Pre-assessment Form, which this is. Some parents may choose to provide additional information in writing or verbally. Information requested on the Pre-assessment form includes:

In order to gain a holistic picture of the child it is helpful to receive information from the child’s school and other professionals that have been involved. This information includes:

When you make the request for an assessment, I send you two form one for you and one for you to ask the school to complete.

I will not request data or information from your child’s school or from other professionals without permission from you as parents or carers. This permission is given by you asking the school to complete the pre-assessment form that I send to you.

Information is usually requested from the SENCo, Head of Learning Support and/or class or subject teachers. You can indicate the best person/s to contact on the parent form.

3. How do I use the information that I collect?

The information collected is used in the following ways:

To communicate with you so that I can arrange appointments with you, discuss your concerns and arrange an appropriate course of action.

To prepare a relevant assessment for your child. I need the personal data to help me to decide what assessments to use and what approaches I should take with the child. Background information about the child’s situation is important so that I am aware if the child has experienced trauma or other experiences that may affect their emotional well-being or ability to learn. It is helpful for me to see previous reports from other professionals, in order to put my work in context with the child’s development over time.

Information provided by you and others such as the school, other professionals, when relevant to the assessment, will be integrated into the written report. The report will only be sent to commissioners of the child or young person. In some circumstances, when permission is given by parents to share the report with school, (which they can do in the preassessment form) the report will be sent to both. It might be that parents give permission for the report to be shared with someone else who is acting on their behalf and/or supporting them with the process. For example, the Head of Learning Support or Pastoral Care at a boarding school, or when the parent cannot read or has other significant challenges. The report is only ever sent password protected.

If reports are proof read by a proof reader, then the reports will be transmitted to and from the psychologist by email, password protected.

Immediately after the assessment, feedback can be shared in a meeting with parents and/or relevant involved teachers at school, following parents’ permission to share results with school staff.

4. Where do I keep the information?

Data is usually received by post or by email.

Paper records will be filed and kept in a locked filing cabinet.

When data is received by email, attachments will be saved in the pupil’s electronic file and then the email will be deleted. If any personal data is included in the body of the email, a copy will be saved in the pupil file and then the original deleted from my inbox. Parents and schools are advised to send personal data password protected or by using an encrypted email service, such as Egress.

Electronic information will be stored on a PC at the home of Teresa Bliss, which is password protected. The report itself is also password protected.

All personal data relating to pupils or their parents will be backed up by being stored on an external hard drive which is GDPR compliant.

When pupil paper files are being used/worked on they will be locked in a filing cabinet and these files will be destroyed at the end of each term, within the 6-term academic year.

When the information is carried to conduct an assessment, the paper file will be kept in a travel bag. This bag will not be left overnight in a vehicle. If left out of sight in a vehicle for a short period during the day, the car will be locked secure. During school visits, I will keep the paper file on my person, or have it locked in a room.

If a data breach occurs, and the breech is deemed to be a high risk for the rights and freedoms of the data subject, the ICO and all affected clients will be notified within 72 hours. The nature of the breech will be explained along with the steps I am taking to deal with it. More information is outlined in the Data Breech Procedure Policy.

5. How long do we keep the information?

The report will provide a detailed summary of my involvement. Once a report has been completed, any handwritten notes will be securely destroyed by using a shredder. Paper record forms, writing samples and other assessment materials may be kept for up to two months in case questions are raised about the process of the assessment. They will then be securely destroyed by shredding.

Electronic files (including pupil reports) will be retained for a period of two years. This is so that a record of the report remains, if parents lose the copy that was sent to them. Also, the report may be referred to, if the pupil is reassessed in the future.

Electronic versions of the parental consent form may be kept in the pupil’s electronic file on the PC, password protected, for up to two years. This is due to it being part of the parental information form. Paper versions of the parent booking form version will be shredded at the end of every 6-term year.

After a period of two years all remaining records will be securely destroyed, unless I continue to be directly involved with the case and there are strong reasons for retaining historical data, e.g. to track strategies and interventions over time, or in some legal cases.

Please note it is the parents’ responsibility to retain copies of the report, because I will only retain the data for two years.

6. Who do we send the information to?

Where parents have agreed for me to contact the pupil’s school, or if the school have commissioned the report, the date of the appointment will be suggested by me but arranged through parents and the school to ensure it is a mutually convenient date.

School staff are may be invited to join a feedback meeting with parents where the assessment is discussed, with parental permission.

Assessment reports are typically only sent to the parents, unless the school has commissioned (i.e. paid for) the assessment, in which case a password protected copy is sent to the school.

Reports will be sent out electronically by email to the pupil’s parents. If the parents are happy to share the report, unless decided otherwise it is their responsibility to forward it to the child’s school and any other relevant professionals.

All reports will be in ‘read only’ PDF format so no changes may be made.

7. Will emails and text messages be sent to you?

You will only be contacted if you have made a request for psychological services that has been initiated either by you or the school. This would usually include emails or phone calls to discuss your current concerns and arrange appointments. I will also email invoice/payment details to you and the assessment report.

8. Access Arrangements for exams

In order for schools to apply for students’ access arrangements for public exams eg for extra time, as appropriate and from Year 9, they are required by the Joint Council for Qualifications (JCQ) to complete sections A and B which contain background information, of a Form 8 and email it securely to me prior to the assessment. Following the assessment, I am then required to complete Section C with relevant test scores and return it to school by email, password protected so that school can then process the application. The completed form 8 can also be sent to you on request.

9. What happens to your data if I were to die?

In the event of my unexpected death all pupil data will be confidentially destroyed by the appointed executor.

10. Your rights

As I process your personal data, you have certain rights. These are a right of access, a right of rectification, a right of erasure, a right to data portability and a right to restrict processing.

If your questions are not fully answered by this policy, please contact me directly in my role as Data Protection Officer for Teresa Bliss Educational Psychologist. If you are not satisfied with the answers I provide, you may contact the Information Commissioner’s Office (ICO) https://ico.org.uk.