Privacy Policy 

Bridges Through Sound Music Therapy Privacy Policy

Introduction
This Privacy Policy explains how Bridges Through Sound*(BTS) collects, uses, and protects your personal data when you use this site or services. BTS respects your privacy and is fully committed to protecting your data in accordance with GDPR. This policy will explain how and what data is collected, how it is used and how it is protected. It will also explain your rights in relation to storing and using your personal information. You are encouraged to read this policy carefully and should you wish to raise any concerns, contact BTS.

*BTS refers to the owner of the business, Sharon Francis

Data Control

BTS is registered as a data controller with the Information Commissioner’s Office (ICO), the UK supervisory authority for date protection issues (www.ico.org.uk). As data controller BTS is responsible for the security and use of any personal data. 

The data controller details are as follows:

Sharon Francis (Data Controller ID: ZB983125

Bridges Through Sound Music Therapy

Phone/Text: 07364 128965

@bridgesthroughsoundmusictherapy.co.uk

Securing data

Data is kept securely using double password protection within BTS IT’s system, using cloud storage.

Data we collect about you
We may collect the following types of information:

• Personal identification information (name, email, phone, address)
• Gender
• Medical history, current diagnosis and health
• Name, address and contact details for other professional involved in your care (where included on referral form)
• Sensitive data explaining the reason for referral to BTS services
• Session notes records
• Photos, videos or other images (if consent has been given)
• Other information that you, a family member or  carer shares
• Payment information (processed securely by third-party providers)
• Usage data (IP address, browser type, device, cookies)

Collecting personal data

Personal data is collected when you:

• contact BTS (phone or email)
• subscribe to emails
• have consented to be filmed or photographed in Music Therapy sessions

Collecting Sensitive data 

Sensitive data is collected when:

• you, or someone on your behalf completes a referral form for Music Therapy
• an assessment, progress or discharge report is written about music therapy sessions you have received
• we contact another health professional regarding care

Use of Data
We use personal data to:

• provide you with music therapy to meet your needs
• improve our services
• Process transactions relating to fees
• Communicate with you regarding music therapy services
• Comply with legal obligations
• Provide your or your referrer with written documentation or assessment reports
• Inform you of any upcoming events, news etc

Data sharing

BTS does not need your consent when your personal information is used in order to carry out our legal obligations. In accordance with the law BTS is obligated to disclose information in order to protect public safety or prevent harm to yourself and/or other people. This could involve sharing information with local authorities or police. This will be shared in accordance with BTS safeguarding policy.

If you are receiving music therapy with BTS your data may be shared with third party professionals as part of delivering and monitoring the services that we provide for you. This may include other health practitioners or legal representatives that you have consented to BTS contacting.

• Information shared with third parties will be limited to:
• Necessity of providing information
• You have consented and granted permission
• Only relevant information is disclosed
• The third party understands why the information is shared and their duty to maintain confidentiality

Sharing sensitive data

If sensitive data is required to be shared BTS may make you aware of the reasons for sharing and seek your consent. 

For consent to be valid, it must be voluntary and informed, and the person giving consent must have capacity to make the decision.

Consent for sharing data

Consent means that you understand and agree to:

• personal information being disclosed or shared with people or organisations as deemed necessary
• the reason for disclosure and how the information will be used

5. Cookies
Our Site uses cookies to improve user experience, analyse site traffic, and personalize content. You may disable cookies in your browser settings, but some features of the Site may not function properly.

6. Data Security
BTS implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. 

BTS complies with GDPR guidance UK GDPR guidance and resources | ICO

I, the sole trader at BTS am HCPC registered and therefore comply with its policies on data security and protection HCPC data protection policy and privacy notice | The HCPC

Data Storage

BTS uses Microsoft for storage of data which adheres to the following principles:

• Microsoft does not use BTS data without agreement
• Microsoft provides full access to BTS to modify, update or delete any data stored
• Microsoft does not share data from BTS with third parties. Its own policy is back by agreements and adoption of the international code of practice for cloud privacy, ISO-IEC 17018
• Microsoft is fully compliant with privacy laws such as GDPR and privacy standards
• Microsoft will only process data with consent.
• Microsoft ensures that data restrictions are in place for subcontractors deployed by Microsoft adheres to stringent security standards  and procedures requiring customer ID followed by additional authentication checks, automatic lock out of system after a short period of inactivity, 
• Microsoft ensure multiple layers of encryption to protect customer content.

Data Retention

Your data will only be retained for as long as it is needed for the purposes for which it was processed. The minimum time will be the duration of your contractual agreement with BTS. Usually your data will be kept for a period after you have ceased using BTS services in line with the law and with the guidance from HCPC. Occasionally data may be kept longer if there are legal requirements associated with the data. Once data is no longer needed it will be securely deleted or anonymised. 

By law BTS is required to keep basic information about clients (including contact, identity, financial and transaction data) for six years after they cease being customers for tax purposes. 

User Legal Rights
Under certain circumstances as client/service user, you have the right to:

• Be informed of how you data is used
• Access, correct, or delete your personal data
• Restrict or object to processing
• Request transfer of your personal data
• Right to withdraw consent
   

To exercise these rights, contact: sharon@bridgesthroughsoundmusictherapy.co.uk

Links to other websites/third parties

BTS does not take responsibility or endorse any information or content on linked third party websites.

Changes to This Policy
BTS may update this Privacy Policy from time to time. The most recent version will always be posted on our Site.

10. Contact
For any questions about this Privacy Policy, please contact me at:
Sharon Francis

Bridges Through Sound Music Therapy
12 Heath Close, Bury St Edmunds, Suffolk, IP30 9BL
Email: sharon@bridgesthroughsoundmusictherapy.co.uk
Phone: 07926 273496