Document Control

Data Protection & Information Governance Policy

Contents

1. Purpose
2. Scope
3. Legislative Framework
4. Definitions
5. Information Governance Framework
6. Roles and Responsibilities
7. Accountability

1. Purpose

The purpose of this Policy is to establish the framework through which Trinaya Limited manages personal information, confidential information and information assets in accordance with applicable legal, regulatory and professional requirements.

This Policy supports Trinaya Limited's commitment to protecting the privacy, confidentiality, integrity and availability of information processed in connection with the delivery of psychological services and independent psychological expert witness services.

The Policy establishes the standards, responsibilities and governance arrangements that apply throughout Trinaya Limited.

It is intended to demonstrate compliance with the accountability principle contained within Article 5(2) UK GDPR.

2. Scope

This Policy applies to all personal information processed by or on behalf of Trinaya Limited.

It applies to:

• Directors;
• Employees;
• Associate Psychologists;
• Contractors;
• Consultants;
• Temporary staff;
• Students and trainees (where applicable);
• Volunteers (where applicable);
• Any third party processing information on behalf of Trinaya Limited.

The Policy applies irrespective of the format in which information is held, including:

• Electronic records;
• Clinical records;
• Medico-legal records;
• Paper records;
• Email;
• Audio recordings;
• Digital images;
• Website information;
• Portable devices;
• Cloud-hosted information.

This Policy applies to all business activities undertaken by Trinaya Limited.

3. Legislative Framework

This Policy has been prepared having regard to applicable legislation, regulatory requirements and professional standards, including:

Primary Legislation

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR), where applicable
• Human Rights Act 1998 (Article 8 – Right to Respect for Private and Family Life)
• Common Law Duty of Confidentiality

Professional Standards

• Health and Care Professions Council (HCPC) Standards of Conduct, Performance and Ethics
• HCPC Standards of Proficiency
• British Psychological Society (BPS) Code of Ethics and Conduct (where applicable)

Medico-Legal Practice

Where Trinaya Limited provides independent expert witness services, relevant legal obligations include:

• Civil Procedure Rules (CPR)
• Part 35 of the Civil Procedure Rules
• Applicable Practice Directions relating to expert evidence

This Policy will be reviewed periodically to reflect changes in legislation, regulatory guidance and professional standards.

4. Definitions

For the purposes of this Policy:

Personal Data

Information relating to an identified or identifiable living individual.

Special Category Personal Data

Personal information requiring additional protection under Article 9 UK GDPR, including information relating to health.

Processing

Any operation performed upon personal information including collection, recording, organisation, storage, retrieval, use, disclosure, restriction, deletion or destruction.

Data Controller

The organisation that determines the purposes and means of processing personal information.

For the purposes of this Policy, Trinaya Limited is the Data Controller unless otherwise stated.

Data Processor

A natural or legal person that processes personal information on behalf of the Data Controller.

Information Asset

Any information, system, database, document or electronic resource owned or controlled by Trinaya Limited that has business, legal, clinical or operational value.

Confidential Information

Information provided in confidence or information that is subject to a legal or professional duty of confidentiality.

Information Governance

The framework of policies, procedures, responsibilities and controls used to ensure that information is handled lawfully, securely and effectively throughout its lifecycle.

5. Information Governance Framework

Trinaya Limited is committed to maintaining an effective Information Governance Framework that promotes lawful, secure and accountable processing of personal information.

The framework is designed to:

• protect the rights and freedoms of individuals;
• support high standards of clinical practice;
• ensure confidentiality;
• maintain information security;
• comply with applicable legislation;
• manage information risks;
• support business continuity;
• demonstrate organisational accountability.

The framework incorporates:

• data protection;
• confidentiality;
• information security;
• records management;
• cyber security;
• business continuity;
• incident management;
• staff awareness and training;
• regular policy review.

6. Roles and Responsibilities

Director

The Director has overall responsibility for ensuring that Trinaya Limited maintains appropriate arrangements for information governance and data protection.

Responsibilities include:

• approving information governance policies;
• allocating appropriate resources;
• promoting a culture of confidentiality and information security;
• ensuring legal compliance;
• overseeing significant information governance risks.

Privacy Officer

The Privacy Officer is responsible for overseeing the implementation and maintenance of Trinaya Limited's data protection framework.

Responsibilities include:

• monitoring compliance with this Policy;
• responding to privacy enquiries;
• overseeing Subject Access Requests;
• supporting data protection impact assessments;
• coordinating responses to personal data breaches;
• maintaining information governance documentation;
• reviewing this Policy.

All Personnel

Everyone working for or on behalf of Trinaya Limited must:

• comply with this Policy;
• maintain confidentiality;
• protect personal information;
• report suspected data breaches promptly;
• complete required information governance training;
• follow security procedures;
• use information only for authorised purposes.

Failure to comply with this Policy may result in disciplinary action, termination of contractual arrangements or other appropriate action.

7. Accountability

Trinaya Limited recognises that compliance with UK GDPR requires not only adherence to the data protection principles but also the ability to demonstrate that compliance.

To support accountability, Trinaya Limited will maintain appropriate governance arrangements, which may include:

• documented policies and procedures;
• a Record of Processing Activities (ROPA), where required;
• contracts with Data Processors;
• Data Protection Impact Assessments (DPIAs), where applicable;
• information security controls;
• staff training and awareness;
• procedures for handling Subject Access Requests;
• procedures for managing personal data breaches;
• records retention and secure disposal arrangements;
• periodic review of information governance practices.

Information governance arrangements will be reviewed regularly and updated where necessary to reflect changes in legislation, regulatory guidance, technology or business operations.

8. Data Protection Principles

Trinaya Limited processes all personal information in accordance with the data protection principles set out in Article 5 of the UK General Data Protection Regulation (UK GDPR).

These principles apply to every processing activity undertaken by or on behalf of Trinaya Limited.

8.1 Lawfulness, Fairness and Transparency

Personal information will only be processed where there is a lawful basis under Article 6 UK GDPR and, where applicable, a condition under Article 9 UK GDPR for Special Category Personal Data.

Trinaya Limited will ensure that individuals are provided with clear and accessible privacy information explaining how their personal information is processed.

8.2 Purpose Limitation

Personal information will be collected only for specified, explicit and legitimate purposes.

Information will not be processed in a manner that is incompatible with the original purpose unless permitted by law.

8.3 Data Minimisation

Only the minimum amount of personal information necessary to achieve the intended purpose will be collected, accessed and processed.

Staff and contractors must not collect or retain unnecessary personal information.

8.4 Accuracy

Trinaya Limited will take reasonable steps to ensure that personal information is accurate and, where necessary, kept up to date.

Individuals are encouraged to notify Trinaya Limited promptly if their personal information changes or is inaccurate.

Where inaccurate information is identified, appropriate steps will be taken to correct or update the record without undue delay.

8.5 Storage Limitation

Personal information will be retained only for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, professional or regulatory obligations.

Detailed retention periods are contained within the Records Management and Retention Policy.

8.6 Integrity and Confidentiality

Appropriate technical and organisational measures will be implemented to protect personal information against:

• Accidental loss;
• Destruction;
• Unauthorised disclosure;
• Unauthorised access;
• Unlawful processing;
• Alteration.

Information security measures are described further within this Policy and the Information Security Policy.

8.7 Accountability

Trinaya Limited will maintain appropriate documentation and governance arrangements to demonstrate compliance with UK GDPR.

This includes maintaining policies, procedures, training records, contracts with Data Processors, and other documentation where appropriate.

9. Lawful Processing

Every processing activity undertaken by Trinaya Limited must have an identified lawful basis under Article 6 UK GDPR.

Where Special Category Personal Data is processed, an additional condition under Article 9 UK GDPR must also apply.

The lawful basis should be identified before processing begins and recorded where appropriate.

9.1 Common Lawful Bases

Depending upon the activity, Trinaya Limited may rely upon:

• Contract;
• Legal Obligation;
• Legitimate Interests;
• Vital Interests;
• Consent (where appropriate).

Consent will not be relied upon where another more appropriate lawful basis exists.

9.2 Special Category Personal Data

Where health or psychological information is processed, Trinaya Limited will identify an appropriate Article 9 UK GDPR condition.

Common conditions include:

• Health or social care purposes;
• Establishment, exercise or defence of legal claims;
• Explicit consent where required;
• Substantial public interest where applicable.

10. Confidentiality

Maintaining confidentiality is fundamental to the delivery of psychological services and independent expert witness work.

All personnel are expected to protect confidential information obtained during the course of their duties.

Confidential information must only be accessed where there is a legitimate business, clinical or legal need.

Unauthorised disclosure of confidential information may constitute:

• A breach of confidentiality;
• A breach of UK GDPR;
• Professional misconduct;
• A contractual breach.

10.1 Confidentiality Obligations

All personnel must:

• Protect confidential information;
• Access information only where authorised;
• Ensure conversations cannot be overheard by unauthorised persons;
• Avoid unnecessary disclosure;
• Verify recipient identity before sharing information;
• Report suspected confidentiality breaches immediately.

11. Special Category Personal Data

Much of the information processed by Trinaya Limited relates to health and psychological care and is therefore classified as Special Category Personal Data.

Such information requires enhanced protection.

Trinaya Limited will ensure that:

• Processing is lawful;
• An Article 9 condition is identified;
• Access is restricted;
• Information is shared only where necessary;
• Appropriate safeguards are implemented.

12. Children's Information

Trinaya Limited provides services to children and young people.

Children's personal information requires additional protection under UK GDPR.

When processing children's information, Trinaya Limited will:

• Provide age-appropriate privacy information where practical;
• Consider parental responsibility;
• Consider the child's capacity to understand and make decisions appropriate to their age and circumstances;
• Comply with safeguarding responsibilities;
• Maintain confidentiality in accordance with legal and professional requirements.

Where appropriate, decisions regarding information sharing will take account of the child's best interests and applicable legal principles.

13. Data Quality

Maintaining accurate information is essential for safe clinical practice and high-quality expert witness services.

Personnel must ensure that records are:

• Factual;
• Contemporaneous where appropriate;
• Clear;
• Legible;
• Relevant;
• Objective;
• Attributable to the author.

Clinical records should distinguish clearly between:

• Factual information;
• Professional opinion;
• Information provided by third parties.

14. Privacy by Design and by Default

Trinaya Limited will consider data protection and information security throughout the design, implementation and review of services, systems and processes.

Where appropriate, privacy considerations will include:

• Collecting only necessary information;
• Restricting access;
• Minimising disclosure;
• Secure system configuration;
• Secure disposal;
• Reviewing risks before introducing new technologies or services.

Where processing is likely to result in a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be completed before processing begins.

15. Records Management

Trinaya Limited is committed to maintaining complete, accurate and secure records.

Records must be managed throughout their lifecycle from creation to secure disposal.

Records may include:

• Clinical records;
• Therapy records;
• Medico-legal records;
• Administrative records;
• Financial records;
• Correspondence;
• Electronic communications;
• Business records.

Detailed retention periods and disposal procedures are contained within the Records Management & Retention Policy.

16. Information Security

16.1 Policy Statement

Trinaya Limited is committed to protecting all information assets against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Information security measures shall be proportionate to the sensitivity of the information being processed and regularly reviewed to reflect changes in technology, legislation and organisational requirements.

The objective is to maintain the:

• Confidentiality of information.
• Integrity of information.
• Availability of information.

16.2 Information Security Objectives

Trinaya Limited aims to:

• Protect the privacy of clients, claimants and other individuals;
• Maintain secure clinical and medico-legal records;
• Prevent unauthorised disclosure of information;
• Reduce cyber security risks;
• Maintain business continuity;
• Comply with legal and professional obligations.

17. Access Control

Access to personal information shall be restricted to individuals who require access to perform their authorised duties.

Access permissions shall be granted using the principle of least privilege, ensuring that users receive only the level of access necessary for their role.

Where appropriate:

• User accounts shall be unique;
• Access rights shall be reviewed periodically;
• Unused accounts shall be disabled or removed promptly;
• Privileged access shall be limited.

Access shall be removed promptly when employment, contractual arrangements or authorised access ends.

18. Authentication and Password Management

All users must use strong authentication credentials to access systems containing personal information.

Passwords should:

• Be unique;
• Be difficult to guess;
• Not be shared;
• Not be reused across multiple business systems;
• Be changed immediately if compromise is suspected.

Where supported, Multi-Factor Authentication (MFA) shall be enabled for systems containing personal or confidential information.

Passwords must never be recorded in an insecure manner or disclosed to unauthorised individuals.

19. Microsoft 365

Microsoft 365 is used to support secure business communications and document management.

Where Microsoft 365 is used, Trinaya Limited will:

• Restrict access to authorised users;
• Enable appropriate security features where available;
• Apply appropriate authentication controls;
• Use business rather than personal accounts for organisational information;
• Review user access periodically.

Business email accounts must be used for all professional communications unless an approved alternative has been authorised.

20. Trikon Digital Platform

Where Trikon Digital is used as the practice management system, it may support:

• Appointment management;
• Client records;
• Document management;
• Secure messaging;
• Client communications;
• Website integration;
• Online forms;
• Audit logging.

Access shall be role-based and restricted to authorised users.

Trinaya Limited will ensure that appropriate contractual arrangements are maintained with the platform provider.

21. Cloud Hosting

Trinaya Limited may use secure cloud infrastructure to host information systems and business applications.

Where cloud services are used, providers shall be selected having regard to:

• Security;
• Reliability;
• Resilience;
• Legal compliance;
• Data protection obligations.

Where appropriate, information may be hosted using Amazon Web Services (AWS) located within the United Kingdom or another provider offering equivalent standards of protection.

22. Remote Consultations

Psychological consultations may be delivered remotely where clinically appropriate.

Secure video consultation platforms such as Microsoft Teams or Zoom may be used.

When remote consultations are undertaken:

• Reasonable steps should be taken to verify identity where appropriate;
• Consultations should take place in a private environment;
• Confidentiality should be maintained;
• Recordings will not be made unless there is a lawful basis and all necessary permissions have been obtained.

23. Remote Working

Where personnel work remotely, they must ensure that personal information remains secure.

This includes:

• Preventing unauthorised viewing of information;
• Securing portable devices;
• Locking devices when unattended;
• Using secure internet connections where possible;
• Avoiding public discussions of confidential information;
• Reporting lost or stolen devices immediately.

Paper records should not normally be removed from secure premises unless operationally necessary and authorised.

24. Mobile Devices

Where mobile phones, laptops or tablets are used for business purposes:

• Devices should be protected by appropriate authentication controls;
• Software should be kept up to date;
• Business information should be stored only within approved systems where possible;
• Loss or theft must be reported immediately.

Personally owned devices used for business purposes must comply with organisational security requirements.

25. Email Security

Email remains an important method of communication but presents information security risks.

Personnel should:

• Verify recipient details before sending confidential information;
• Avoid unnecessary disclosure;
• Use secure methods for transmitting sensitive information where appropriate;
• Exercise caution when opening unexpected emails or attachments;
• Report suspected phishing attempts immediately.

Where confidential information is sent electronically, appropriate safeguards should be considered.

26. Artificial Intelligence (AI) Governance

Trinaya Limited recognises that AI-assisted technologies may improve efficiency but must be used responsibly.

AI tools may be used to assist with administrative activities, including document drafting, transcription or note preparation.

AI must not replace professional judgement.

All:

• Psychological assessments;
• Therapy records;
• Clinical decisions;
• Treatment recommendations;
• Expert witness reports.

Must be reviewed and authorised by an appropriately qualified psychologist before use.

No clinical decision or expert opinion shall be made solely through automated processing.

27. Physical Security

Appropriate physical measures shall be implemented to protect information and equipment.

Examples include:

• Secure premises;
• Controlled access where appropriate;
• Secure storage of paper records;
• Protection of portable equipment;
• Confidential disposal arrangements.

Visitors should not have unsupervised access to confidential information.

28. Information Security Incident Reporting

All personnel must report suspected information security incidents immediately.

Examples include:

• Loss of devices;
• Unauthorised access;
• Accidental disclosure;
• Phishing attacks;
• Malware infections;
• Ransomware incidents;
• Unauthorised alteration of records.

Prompt reporting enables Trinaya Limited to investigate incidents, reduce potential harm and determine whether further action, including notification to the ICO or affected individuals, is required.

29. Data Sharing

29.1 Policy Statement

Trinaya Limited recognises that the sharing of personal information is sometimes necessary to provide safe and effective psychological services, fulfil contractual obligations, comply with legal requirements and support independent expert witness work.

Personal information will only be shared where there is a lawful basis under the UK GDPR and, where applicable, an Article 9 condition for Special Category Personal Data.

Only the minimum personal information necessary for the intended purpose will be shared.

29.2 Information Sharing Principles

Before sharing personal information, Trinaya Limited will consider:

• Whether there is a lawful basis for sharing;
• Whether sharing is necessary and proportionate;
• Whether the recipient has authority to receive the information;
• Whether confidentiality obligations apply;
• Whether the minimum necessary information is being disclosed;
• Whether the sharing should be documented.

29.3 Routine Information Sharing

Information may be shared, where appropriate, with:

• General Practitioners (GPs);
• Hospitals;
• Consultant Psychiatrists;
• Psychologists;
• Community Healthcare Providers;
• Solicitors;
• Medical Reporting Organisations (MROs);
• Insurers;
• Rehabilitation Providers;
• Courts;
• Barristers;
• Expert Witnesses;
• Approved Data Processors.

30. Data Processors

Trinaya Limited may engage carefully selected third-party organisations to process personal information on its behalf.

Examples include providers of:

• Cloud hosting;
• Secure email;
• Payment processing;
• Practice management systems;
• Secure video consultations;
• Website hosting;
• IT support.

30.1 Processor Selection

Before appointing a Data Processor, Trinaya Limited will consider:

• Information security;
• UK GDPR compliance;
• Confidentiality;
• Technical capability;
• Organisational capability;
• Contractual safeguards.

30.2 Processor Contracts

Where required by Article 28 UK GDPR, Trinaya Limited will maintain written agreements with Data Processors.

These agreements should address:

• Processing instructions;
• Confidentiality;
• Security;
• Sub-processing;
• Breach notification;
• Return or deletion of information;
• Audit rights.

31. Data Protection Impact Assessments (DPIAs)

A DPIA will be considered before introducing new processing activities that are likely to result in a high risk to the rights and freedoms of individuals.

Examples may include:

• Introduction of new technologies;
• Significant changes to information systems;
• Large-scale processing of Special Category Personal Data;
• AI-assisted technologies that may materially affect the processing of personal information.

The Privacy Officer will determine whether a DPIA is required and maintain appropriate records.

32. Individual Rights

Trinaya Limited will have procedures in place to facilitate the exercise of individuals' rights under UK GDPR.

These include:

• Right to be informed;
• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability (where applicable);
• Right to object;
• Rights relating to automated decision-making.

Requests will be handled promptly and in accordance with applicable legal timescales.

33. Subject Access Requests (SARs)

Trinaya Limited will maintain procedures for managing Subject Access Requests.

The organisation will:

• Verify the identity of the requester where appropriate;
• Record the request;
• Identify relevant information;
• Consider any applicable exemptions;
• Respond within the statutory timescale unless an extension is permitted by law.

All Subject Access Requests should be referred to the Privacy Officer without delay.

34. Personal Data Breaches

34.1 Policy Statement

A personal data breach is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.

All suspected personal data breaches must be reported immediately.

34.2 Incident Management

Where a personal data breach occurs, Trinaya Limited will:

• Contain the incident where possible;
• Assess the risks;
• Investigate the cause;
• Document the incident;
• Implement corrective actions;
• Determine whether notification is required.

34.3 ICO Notification

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Trinaya Limited will consider whether notification to the Information Commissioner's Office (ICO) is required in accordance with UK GDPR.

Where legally required, notification will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where there is a high risk to affected individuals, Trinaya Limited will also consider whether those individuals should be informed.

35. Staff Awareness and Training

All personnel must receive information governance and data protection training appropriate to their role.

Training may include:

• UK GDPR;
• Confidentiality;
• Cyber security awareness;
• Phishing awareness;
• Information security;
• Safeguarding;
• Incident reporting;
• Secure handling of information.

Refresher training should be undertaken periodically.

36. Monitoring and Audit

Trinaya Limited will periodically review its information governance arrangements to ensure continued compliance with legal and professional obligations.

Monitoring activities may include:

• Policy reviews;
• Access reviews;
• Incident reviews;
• Audit of records;
• Review of Data Processor arrangements;
• Review of security controls.

Where improvements are identified, appropriate corrective actions will be implemented.

37. Business Continuity

Trinaya Limited will maintain appropriate arrangements to support the continued availability of information and services in the event of disruption.

Business continuity arrangements may include:

• Secure backups;
• Disaster recovery planning;
• Alternative communication methods;
• Restoration procedures;
• Periodic testing where appropriate.

38. Policy Review

This Policy will be reviewed:

• At least annually;
• Following significant legislative changes;
• Following significant organisational changes;
• Following major information security incidents;
• Where improvements are identified through audit or review.

The Director is responsible for approving revisions to this Policy.

Document Approval