Special category question

Dear SEQ Legal

I've just completed editing your free privacy policy document for my website.  I'm a psychotherapist so deal with one of the special categories of data.  I didn't see anywhere in your privacy policy where I should indicate anything about a special category.  As I understand it, for someone who collects personal data which is health-related, I should state in my privacy policy what special category applies to what I'm doing. This is in Article 9 of the GDPR legislation.

The ICO guidance document on GDPR from their website says (p.10):

"If you are processing special category data you need to identify both a lawful basis for general processing and an additional condition for processing this type of data."

As far as my website is concerned, the only way I collect health-related data is if a potential client says something, such as their diagnosis or symptoms, in the contact form message field.  But they do give quite a lot of personal health-related information when I contact then in response to that, and sometimes also in an initial enquiry by email, which I think would count as "enquiry data" in your privacy policy.

Please advise how to deal with this special category issue.

Many thanks.

Karen Williams

Counsellor, Psychotherapist, EMDR Therapist
MA, Dipl Psych, MBACP, UKCP Reg

No answers yet