Apppropriate Policy

Entity: Richard Reid Enterprises (IOM) Limited, trading as Pinnacle Wellbeing Services (“Pinnacle”, “we”, “us”, “our”)

The Data Protection Act 2018 (DPA 2018) requires an Appropriate Policy Document to be in place when processing Special Category (SC) data under specific substantial public interest conditions or health and social care purposes. This document demonstrates how Pinnacle Wellbeing Services complies with the UK GDPR Article 5 principles when processing sensitive psychological data.

1. Description of Special Category Data Processed

We process the following Special Category (SC) data to deliver psychological and executive coaching services:

• Mental and physical health disclosures.
• Clinical therapy notes and psychological assessments (e.g., CBT, EMDR, Counselling records).
• Occupational health context provided by clients or corporate sponsors.

2. Schedule 1 Condition for Processing

We process this SC data under the following conditions of Schedule 1, DPA 2018:

• Part 1, Paragraph 2: Health or social care purposes (specifically, the provision of health care or treatment).
• Explicit Consent: We also rely on the explicit consent of the data subject prior to commencing psychological services.

3. Procedures for Ensuring Compliance with GDPR Principles

• Accountability: We carry out Data Protection Impact Assessments (DPIA) for processing likely to result in high risk, maintaining a master Information Security Framework.
• Lawfulness, Fairness, and Transparency: We are open and honest when we collect the SC/CO data and ensure that we do not deceive or mislead people about its use, outlining our processing clearly in our External Privacy Policy.
• Purpose Limitation: If we use personal data for a new purpose, we check that this is compatible with our original purpose or get specific consent.
• Data Minimisation: We only collect the SC personal data we need for our specified purposes (i.e., delivering effective therapy and coaching).
• Accuracy: We have a process in place to identify when we need to keep the SC/CO data updated to fulfil our purpose correctly, and we update it as necessary during continuous client sessions.
• Storage Limitation: We carefully review how long we keep the SC/CO data and justify this amount of time by fulfilling statutory obligations and professional clinical standards.
• Integrity and Confidentiality: We analyse the risks presented by our processing and mandate end-to-end encryption, multi-factor authentication, and strict Role-Based Access Controls for all clinical data.

4. Retention and Erasure Policy for Special Category Data

We retain Special Category data (clinical notes, therapy records, and psychological assessments) for a strictly enforced period of 7 years following the client’s last session. This aligns with professional indemnity requirements and clinical best practices. Following this period, all SC data is permanently and securely destroyed via certified cryptographic wiping tools (for digital data) or secure cross-cut shredding (for physical records).

You may read our full Data retention and disposal protocol and schedules here.

To exercise any of relevant rights to your SC data, kindly email a completed Data Subject Rights Request Form to our Data Protection Officer at info@richard-reid-enterprises.com and CC info@pinnaclewellbeingservices.com

APD Review Date:
Written on: 22nd July 2024
Last Updated: 18th September 2026
Next Review Date: 17th September 2027