Signed in as:
filler@godaddy.com
Signed in as:
filler@godaddy.com
Document Owner: Julie Jones
Review Date: Annually
Version: 1.0
1. Purpose
This retention schedule sets out how long personal information and clinical records are retained by the practice in accordance with:
The practice retains information only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, professional, insurance and safeguarding obligations.
2. Retention Schedule
Initial enquiry records (where therapy does not commence)
Name, email address, telephone number, enquiry details
12 months from last contact
Secure deletion
Client registration forms
Name, address, date of birth, emergency contact details, GP details
7 years after therapy ends
Secure deletion/shredding
Client personal data
Name, address, email, telephone number, date of birth, occupation
7 years after therapy ends
Secure deletion/shredding
Special category data
Health information, mental health history, medication details, risk information, safeguarding information
7 years after therapy ends
Secure deletion/shredding
Assessment records
Intake forms, assessment notes, risk assessments
7 years after therapy ends
Secure deletion/shredding
Adult client therapy notes
Session notes, treatment plans, interventions, progress notes
7 years after therapy ends
Secure deletion/shredding
Child and young person therapy notes
Session notes, assessments, parental consent records
Until age 25 or 7 years after therapy ends (whichever is later)
Secure deletion/shredding
Safeguarding records
Referrals, disclosures, communications with agencies
Until age 25 or 25 years from last contact for adults where significant safeguarding concerns exist
Secure deletion/shredding
Therapy agreements and consent forms
Contracts, privacy notices, consent records
7 years after therapy ends
Secure deletion/shredding
Clinical supervision records containing identifiable client information
Anonymised where possible; otherwise identifiable discussion notes
7 years after therapy ends
Secure deletion
Correspondence with clients
Letters, forms, secure messages
7 years after therapy ends
Secure deletion/shredding
Clinical emails
Emails containing therapeutic, health or risk information
7 years after therapy ends
Secure deletion
Administrative emails
Appointment scheduling, cancellations, payment arrangements
2 years after therapy ends
Secure deletion
Text messages / WhatsApp messages
Appointment reminders and client communications
2 years after therapy ends unless clinically relevant, then retain with clinical record for 7 years
Secure deletion
Online contact forms
Website enquiries and consultation requests
12 months from last contact
Secure deletion
Video consultation records
Session logs, meeting records
7 years after therapy ends
Secure deletion
Session recordings (if used and separately consented)
Audio or video recordings
Delete immediately after agreed purpose is fulfilled, normally within 3 months
Secure deletion
Complaints records
Complaints, investigations and outcomes
7 years after closure
Secure deletion/shredding
Professional indemnity claims records
Correspondence, evidence, reports
15 years after closure of claim
Secure deletion/shredding
Financial records
Invoices, receipts, accounting records
6 years plus current tax year
Secure deletion/shredding
Data breach records
Incident reports and investigations
6 years after closure
Secure deletion
Marketing consent records
Newsletter subscriptions and consent evidence
Until consent withdrawn plus 3 years
Secure deletion
Staff records (if applicable)
Employment records
6 years after employment ends
Secure deletion/shredding
3. Electronic Data Storage
The following electronic systems may contain personal data:
Clinical Records System
Contains:
Retention:
Email System
Emails may contain:
Retention:
Where clinically relevant, emails should be transferred to the client record and retained as part of that record.
Mobile Devices
May contain:
Requirements:
Cloud Storage Systems
May contain:
Requirements:
4. Secure Disposal
Electronic Records
Electronic records must be:
A destruction log should record:
Paper Records
Paper records must be:
A record of destruction should be maintained.
5. Retention Review Process
Client records due for destruction should be reviewed annually to determine whether:
Where any of the above apply, records may be retained longer with documented justification.
6. Lawful Basis for Retention
The practice retains personal data under: