IT, Data Protection & Privacy Policy

1. Purpose

This policy ensures compliance with the General Data Protection Regulation (GDPR) under the Data Protection Act (2018) and outlines the guidelines for the appropriate use of IT resources, safeguarding client data, and ensuring confidentiality. It applies to all staff at TLC Space Ltd including temporary staff and volunteers and governs the handling of personal data and the use of IT systems.

2. Scope

This policy applies to all staff, contractors, and third parties using IT resources for work purposes, including:

• Computers, laptops, and mobile devices.
• Electronic client records and communication tools.
• Physical and electronic data storage.

3. Data Protection and Privacy

3.1 Use of Personal Information

• Client and family contact details.
• Appointment records, therapy notes, assessments, and reports.
• Photos or videos for clinical purposes (with explicit consent).
• Communication with other professionals involved in the client’s care.

3.2 Data Storage and Security

3.3 Sharing Information

• Data is only shared with other professionals involved in the client’s care, with prior consent.
• Staff must obtain explicit consent before liaising with external organisations or individuals.

3.4 Retention of Records

• Client records are retained until the client turns 25 (or 26 if they were 17 at the start of therapy).
• Data no longer required will be securely deleted in compliance with legal requirements.

4. IT and Technology Usage

4.1 Acceptable Use

• IT resources are for work-related purposes only.
• Personal use is permitted within reasonable limits and must not interfere with work responsibilities or compromise security.
• Staff are prohibited from accessing or distributing inappropriate content.

4.2 Email and Communication

• Work emails must be used for professional purposes only.
• Client data must not be shared via unsecured methods such as personal email accounts or unapproved messaging platforms.

4.3 Internet and Software

• Only authorised software and tools approved by the clinic may be installed on devices.
• Internet usage should remain professional and in line with clinic operations.

4.4 Security Measures

• All devices must be secured with strong passwords and, where possible, two-factor authentication.
• Anti-virus software and system updates must be maintained on all devices.
• Staff must report lost or stolen devices immediately to the Practice Manager.

5. Safeguarding and Personal Devices

• Photos and Videos: Personal devices must not be used to take client photos. Explicit consent must be obtained, and images transferred to secure systems immediately and deleted from personal devices.
• Data Breaches: Any breach involving personal data must be reported immediately to the Data Protection Officer.

6. Rights and Complaints

• Clients have the right to access their data and request corrections or deletions (subject to legal requirements).
• Concerns regarding data handling can be addressed to the clinic’s Data Protection Officer. If unresolved, clients may escalate complaints to the Information Commissioner’s Office (ICO).

7. Monitoring and Audits

• The clinic may monitor IT usage to ensure compliance with this policy, while respecting staff privacy within legal limits.
• Regular audits will ensure that data protection and IT security practices remain robust.

8. Training and Support

• All staff will receive training on GDPR, data protection, and IT security.
• Refresher training will be conducted annually or as required.

9. Policy Review