Supervision Privacy Notice
Last updated: 12 November 2026
This notice explains how I collect, use and protect personal information in my private supervision practice. Please read it alongside our Clinical Supervision Agreement. It covers your information as a supervisee and any personal information about clients or other people that is necessary for our work.
Who is responsible for your information
I am Sam Driscoll, trading as Sam Driscoll Therapy, and I am the data controller for the supervision records I hold. This means I decide why and how that information is used. You can contact me at info@samdriscolltherapy.com or 10 Station Parade, Eastbourne, BN21 1BE.
Your own practice or employing organisation remains responsible for its client records and for sharing information lawfully. I am responsible for information I receive and use in my supervisory role. Our respective responsibilities are separate; your clients do not become my therapy clients through supervision.
What I collect and where it comes from
I collect only what is reasonably needed. This may include your name and contact details; qualifications, professional membership and insurance information; working context, client groups and learning needs; access needs; our agreement; attendance, payment and invoice records; and relevant emails or text messages.
I keep brief supervision notes about significant themes, decisions, agreed actions and concerns. I may also hold agreed reports, relationship feedback and records of complaints or safeguarding action. Information about health, disability, ethnicity, religion, sexuality or other protected personal matters may arise. Some of this is special category data, which has additional legal protection.
Most information comes directly from you, including through sessions, correspondence and the optional feedback form. I also create records through our work. Where relevant, information may come from a training provider, placement, employer, another agreed professional or someone raising a serious concern. I will explain significant information received from elsewhere where safe and lawful.
Protecting your clients and other people
Please only use client's first names or pseudonyms wherever possible and avoid unnecessary identifying details. A first name or pseudonym does not necessarily make someone anonymous: their circumstances may still identify them. Please do not send client files, recordings or identifiable case material without discussing the purpose and a suitable method with me first.
You should explain supervision to your clients through your own agreements and privacy information. Where I need identifiable client information, we will consider the lawful basis, confidentiality and how the client will receive the relevant privacy information, unless a lawful exception applies. I will not routinely contact your clients.
Why I use information and the legal basis
I use information to arrange and provide supervision, support responsible client care, keep proportionate records, review our relationship, complete agreed reporting and manage payments. Under the UK GDPR and Data Protection Act 2018, the legal basis depends on the purpose.
Our supervision agreement under Article 6(1)(b). I use your details to respond to enquiries, take steps you request before we begin, arrange sessions and fulfil our agreement, including agreed reports. If an organisation contracts with me, legitimate interests may instead apply to the necessary use of your information.
Legitimate interests under Article 6(1)(f). I use relevant information to maintain a safe, accountable practice, receive supervision of my work, review feedback and address complaints. For client information, the interests include supporting safe and effective care through supervision. I balance these purposes against the rights and interests of the people concerned.
Legal obligations under Article 6(1)(c). This applies to necessary tax and accounting records and disclosures required by law.
Vital interests, Article 6(1)(d), may apply in exceptional circumstances where information is necessary to protect life.
Consent under Article 6(1)(a). Where a genuinely optional use relies on consent, I will ask separately and explain the purpose. You can withdraw consent by contacting me. This does not undo lawful use before withdrawal or require deletion of information I must retain on another lawful basis.
Sensitive information needs an additional condition
Where sensitive information is necessary to support the provision or management of client care through confidential clinical supervision, I rely on Article 9(2)(h), with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 and the applicable duty of confidentiality. This condition does not automatically cover every personal disclosure you make.
For optional sensitive information about you, such as details you want recorded to support access needs, I will seek explicit consent under Article 9(2)(a) where that is the appropriate condition. You may withdraw it, and we will discuss how to meet your needs with less information. Where necessary, legal claims may engage Article 9(2)(f); safeguarding may engage Article 9(2)(g) with the relevant statutory condition and safeguards. Vital interests under Article 9(2)(c) apply only where the person is physically or legally incapable of consent.
Information about alleged or actual criminal offences has separate protection under Article 10. If it is necessary to use it, I must identify an applicable Data Protection Act condition, for example one relating to health or social care, safeguarding or legal claims, and meet its safeguards. I do not collect it simply because it might be useful.
Information needed for our work
Basic contact, professional, appointment and payment information is needed to arrange and provide supervision. Relevant risk information may be necessary for responsible practice. If necessary information is withheld, we will discuss whether I can provide the service safely. Optional feedback and permission for other optional uses are not conditions of receiving supervision.
Confidentiality and who may receive information
Our supervision agreement sets the confidentiality boundaries. This notice does not create a wider permission to disclose what you bring. My duty of confidentiality continues after our work ends.
My own supervisor. I discuss my supervisory work in confidential supervision, limiting identifying details about you and your clients as far as reasonably possible. My supervisor is professionally bound by confidentiality.
Agreed reporting. A training provider, placement, employer or other agreed recipient may receive a report or confirmation of attendance. We agree the purpose, recipients and scope beforehand. Paying for supervision does not itself entitle a funder or employer to session content.
Serious risk or legal requirements. Disclosure without consent is limited to legal requirements or the serious-risk provision in our agreement: someone is at serious risk of harm, we have been unable to resolve the situation together, and disclosure is necessary and proportionate to protect them. Immediate action may leave insufficient time to resolve matters together safely. Where safe and lawful, I will discuss disclosure with you first and share only what is necessary. A mistake, difficult feeling or disagreement does not itself lead to a report.
Advice and complaints. I may seek advice from an insurer, legal adviser or professional body using anonymised information wherever possible. Any identifiable confidential disclosure must fit our agreement’s consent, legal or serious-risk provisions; seeking advice is not a blanket exception.
My clinical will. If I die or become seriously unable to practise and cannot contact you, a nominated professional colleague may access the limited contact information needed to notify you and help you consider alternative supervision. They are bound by confidentiality.
Services and security
I use Google Workspace for practice email and documents, Google Forms for optional supervision relationship feedback, and paper agreements. Telephone and text providers, an agreed video platform, and banking or accounting services also process information needed for their functions. These providers may have authorised staff or subprocessors supporting their services. Payment records do not need clinical content.
Electronic information is protected using password-protected devices, access controls and the security features of the services used. Paper records are stored securely. I restrict access and avoid unnecessary client identifiers. Please keep client-identifying information out of routine emails, texts, payment references and feedback responses.
Neither of us will record sessions or use automated transcription or note-taking without explicit prior agreement and appropriate client safeguards. Identifiable material will not be used in teaching, writing, publicity or research without a separate, genuinely optional agreement and any necessary client consent. I do not sell personal information or use supervision information for advertising.
Feedback and how long information is kept
The supervision relationship feedback form is optional. I use responses to understand your experience and adjust our work. Treat the form as confidential feedback, not as a promise of anonymity: wording or circumstances may identify you. Relevant feedback and agreed changes may become part of the supervision record. The form is not monitored as an urgent support route.
I retain supervision records while we work together and afterwards for the period required by my professional indemnity insurer for this work, taking account of any applicable legal requirements. When the file closes, I record the relevant retention deadline. You may ask what period applies and when your record is due for deletion.
Enquiries that do not lead to supervision and routine administrative messages are deleted when no longer needed to respond, manage the enquiry or record a significant decision. Necessary information is transferred to the relevant record before routine correspondence is removed. Financial records are kept for the period required by tax and accounting law.
Relevant records may need to be retained longer for an unresolved complaint, safeguarding matter or legal claim. I review that need and securely delete or destroy information when it is no longer required. Copies in service backups may remain until those backups are replaced or expire under the provider’s retention arrangements.
Your rights
You can ask to see the personal information I hold about you and request correction of inaccuracies. Depending on the circumstances and legal basis, you can also request deletion, restriction of use or a portable copy of information you have supplied. These rights are subject to legal limits, including protection of other people’s information and necessary record retention.
Your right to object. You can object at any time to uses based on legitimate interests, explaining your particular circumstances. I will consider the objection and stop that use unless there are overriding compelling grounds or information is needed for legal claims.
Where I rely on consent, you can withdraw it by emailing or telling me. An acknowledgement of this notice is not consent to every use of information. I do not make decisions with legal or similarly significant effects on you solely through automated processing, including profiling.
Contact info@samdriscolltherapy.com to exercise your rights. I may need to confirm your identity. I will normally respond within one calendar month; if the law allows extra time or clarification is needed, I will explain this. Access to your information does not automatically include confidential information about someone else.
Questions and concerns
Please contact me if anything is unclear or you have a concern about how information is handled. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint. You do not have to obtain my agreement to do so.
I will review this notice as my practice or the law changes and tell you about material changes affecting your information. The current version is available from me. Our supervision agreement records receipt of the notice, so a separate signature here is not required.