People Who Use our Services Privacy Policy
Purpose:
This Privacy Policy sets out details of the information that Cranstoun and team members responsible for the care of people who use our services may collect and how that information will be used.
Applies to:
All employees, relief workers, volunteers and peer mentors working or otherwise providing services within Cranstoun (together “team members”).
Date First Implemented:
October 2022
Author:
Data Systems Manager
Technical/Clinical Approval by:
Director of Care, Quality & Governance
Executive Approval Date
October 2022
Next Revision Due
October 2025
Document status:
This is a controlled document. Any printed copies of this document are not controlled. As a controlled document, this document should not be saved onto local or network drives but should always be accessed from the intranet
Consequential Amendments
None
Version History
N/A
Current Policy Revision
Revised by: Data Systems Manager
Revised date: October 2022
Next revision due: October 2025
Policy Statement
This Privacy Policy sets out details of the information that Cranstoun and the team members responsible for your care may collect from you and how that information will be used. It is important that you understand our use of your data and your rights.
It provides you with a detailed overview of how we will manage your information, from the point at which it is gathered and onwards. It will give you all the details you need on how we use your information, and how we will comply with the law.
It sets out your rights in respect of your personal information and how to exercise them. You can, for example, seek access to your information, object to us using your information in particular ways and/or request rectification of any information which is inaccurate.
Charity Background
Cranstoun understands that your data privacy is important to you and that you care about how your information is used and when it is shared with others. We respect and value the privacy of everyone who uses our services. We will only collect and use information in ways that are useful to you and in a manner consistent with your rights and our obligations under the UK GDPR and Data Protection Act 2018.
This Policy applies to our use of any, and all, information collected by us about your use of our services.
If you do not accept and agree with this Privacy Policy and our use of your information this will affect the level of service and quality of the care we can provide to you, as processing your information is a necessary part of providing our services to you.
Information About Us
In this Privacy Policy, we use “we”, “us” or “our” to refer to Cranstoun who are making decisions about the use of your personal information. Depending on the service(s) you are using, this may be either:
Cranstoun, Thames Mews, Portsmouth Road, Esher, Surrey KT10 9AD Registered Charity No: 1061582 | Registered in England No: 3306337
What Information Do We Collect?
Over the course of our work with you we are likely to collect a considerable amount of your information covering your journey with us.
Personal Information Which may include;
- Full name, date of birth,
- Home address, telephone, mobile, email and emergency contact details
- Who referred you to our services?
- Details of your current and former physical and mental health
- Advice, information and treatment(s) we have provided you,
- Prescriptions or medical advice you have received,
- Details of any contact we have had with you directly via email, text, or telephone
- Details of any contact we have had with third parties regarding your care and treatment, which may include your GP, other services.
We will also agree with you in advance the methods by which we can contact you.
Special Category Information
Which may include;
- race; ethnic origin; politics; religion; trade union membership; genetics;
- health; sex life; or sexual orientation
How Do We Use Your Information?
We may process your information for a number of different purposes however for each of these purposes we must have a legal justification for doing so.
The main reason you come to us is to provide you with advice and support through your journey, and so we have to use your personal information for that. We would be unable to offer our services without processing your information.
Legal grounds
To provide you with health care and related services we have legitimate interests in storing and processing your information.
Additional legal grounds for special categories of personal information
Condition (h) from Article 9(2) of the UK GDPR states that our processing of your information is necessary for the provision of health and/or social care or treatment, and so we need to use the special category information in order to provide appropriate health or social care services to you.
How and Where Do We Store Your Information?
Your Personal Information stored by our case management systems providers are on electronic databases on systems protected by anti-virus software, firewall and other security within a secure datacentres in the UK – this includes on-site security, CCTV and fire protection. All access to this information is via a secure connection to the case management system, and access is controlled by multiple authorised username and password logins to systems. This arrangement supports remote off-site working while still proving a high level of information security.
Regardless of the security measures that we take, it is important to remember that the transmission of information via the internet will never be completely secure and that you are advised to take suitable precautions when transmitting information to us via the internet.
How long do we keep your information?
In line with the NHS Records Management Code of Practice (2021) , we retain most personal information for eight years from the end of your journey with us. We may remove some non- healthcare related information sooner than this, should our need to process the information no longer exist.
Do We Share Your Information?
As part of our initial (and subsequent) contact with you, we will issue you with this Privacy Policy document and will explain the key elements of it, especially around information sharing. In most cases, we will only share any of your personal information with others with your explicit consent; in advance.
There are instances when we are legally obliged to share some of your information to meet our duty of care for yourself and others. Where any of your information is shared for such a purpose, we will take all reasonable steps to ensure that your information will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the law. In these instances, we would only ever share the minimum amount of information required to fulfil our duty of care and would securely share this information to ensure it is protected from unauthorised access.
Your Rights Over Your Information Under the UK GDPR, you have;
- the right to request access to, and deletion or correction of, your information, held by us;
- be informed of what information processing is taking place;
- the right to restrict processing;
- the right to information portability;
- object to the processing of your
If you wish to enforce any of the above rights or if you have any other questions about Our Site or this Privacy Policy, please contact us using the details below.
However, due to the nature of the information we store, about you and your care, we do have statutory duties that may require us to retain the information you supply under the NHS Code of Practice , which would impact on some of the above rights as these statutory duties may take precedence.
You also have the right to complain to a supervisory authority, which in the UK, would be the ICO, via http://www.ico.org.uk
How Can You Get a Copy of Your Information?
You are entitled to a copy of the personal information we hold about you and details about how we use it. Your information will usually be provided electronically unless you have requested otherwise. We will usually provide your information within one calendar month of your request, however in some cases this may take longer, or we will not be able to fully comply with your request, but if this is the case we will advise you of that within one calendar month.
As well as providing you with a copy of your personal information that we hold, we will also explain;
- The purposes for which we use your personal
- The types of personal information we hold about
- An explanation of any terms or
- Who your personal information has been or will be shared
- Where possible, the length of time we expect to hold your personal information. If that is not possible, the criteria, we use to determine how long we retain your information for.
- If the personal information we hold about you was not provided by you, details of the source of the information.
- Your right to complain to the Information Commissioner’s Office
Contacting Us
If you have any questions about this Privacy Policy, the Personal Information we hold about you and the ways we use and share it, or to enforce any of the rights listed above, please contact us;
- via Email: dataprotection@cranstoun.org.uk
- via Telephone: 020 8335 1830
- via Post: Data Protection, Cranstoun, Thames Mews, Portsmouth Road, Esher, KT10 9AD
Implementation
All team members will be made aware of this policy when they join as part of their induction
Any changes to this policy will be communicated to team
All team members this policy applies to will be required to read it, and confirm that they’ve done so.
Responsibility
The Strategic Leadership Team are responsible for ensuring that this policy is reviewed and that team members are aware of this policy.
The Assistant Directors of Services and Service Managers are responsible for ensuring that this policy is shared within The Head of Communications is responsible for ensuring that this policy is displayed on Cranstoun’s website.
Team members are responsible for ensuring that service users are made aware of this policy
All team members are responsible for feeding back any improvements that could be made to
this policy or problems they’ve found when trying to implement it.
Policy review and compliance monitoring
We may change this Privacy Policy as we may deem necessary from time to time, or as may be required by law. Any changes will be shared via our web site. We will make you aware of any significant changes at our next contact with you, following the We recommend that you also check our website periodically to keep up-to-date.
This policy will be reviewed periodically in accordance with the Cranstoun Document Control Policy (QP01).
Team member compliance monitoring and policy effectiveness audits will be conducted periodically under the Cranstoun Quality Governance Framework.
Breach of the policy
Disciplinary action, up to and including summary dismissal, may be taken if a team member is found to be in breach of this policy.
