Drawn up in partnership with Humankind and Public Health Dorset
This privacy notice is for people who use the Reach service. Reach is a service which is funded by Dorset Council and delivered by Humankind Charity.
We adhere to the Data Protection Act 2018 when we collect and process information that identifies you as an individual. This type of information is called personal data.
Please note: If you started using our services prior to 1/6/24 this privacy notice does not apply and you should request a copy of the information you received at the time from the service or Caldicott.guardian@humankindcharity.org.uk
Humankind and Dorset Council are Joint Data Controllers for Reach which means that we decide together, how your data is processed and we share the same purpose for the processing.
We are jointly accountable for ensuring that your rights are respected, and that the data is processed lawfully. Should a breach occur, it is our responsibility to report it to the Information Commissioner’s Office (ICO) if there is a likely risk to your rights or freedoms as per the UK General Data Protection Regulation (UK GDPR).
Humankind sub-contracts Avon and Wiltshire Mental Health Partnership (AWMHP) to support people recovering from drug and alcohol addiction through psychological interventions which includes prescribing. AWMHP is a Data Processor for Humankind which means that they have access to your health information for the purposes of delivering Reach services.
We use personal data including your name, address and contact details so that we can provide you with the service.
We also use more sensitive data about your health; and demographic data such as your gender, sex life (specifically relationships), sexual orientation, race and ethnicity and religious beliefs. This is called Special Category Data which requires extra protection.
If you are subject to the criminal justice system, we may process some criminal offence data about you so that we can provide
We receive your data from you and sometimes from other people like your GP, local authority, Primary Care Services and housing services. Anyone can refer you into our service.
We may receive your data by telephone, email, electronic web form or by post.
We also seek access to and share your health information through NHS systems including Dorset Care Record and your GP summary record for the purpose of delivering your healthcare safely and effectively. We abide by the common law duty of confidentiality. You can
object to us sharing your information by contacting caldicott.guardian@humankindcharity.org.uk
The lawful reasons (known as lawful bases) for processing are set out in the UK General Data Protection Regulation (UK GDPR). At least one of these must apply whenever we process personal data.
Dorset Council uses the lawful basis of Public Task and Humankind uses the lawful basis of Legitimate Interests when we collect your information and use it to provide you with individual healthcare and support.
You have the right to object to our processing via caldicott.guardian@humankindcharity.org.uk and we will respond jointly to you within one month of receiving your data rights request. We need your information to offer the service to you, so if we comply with your request you may not be able to receive part or all of our service. We will explain our decision when we respond to your request.
Where we deliver community orders (such as ATR, DRR, CBO or civil injunctions) we may also process your data upon a Public Task and Legitimate Interests.
We process your health data using the Article 9 condition (h) Health or Social care. We only process what is necessary for the purpose; and processing is overseen by a health professional bound by the common law duty of confidentiality. This is further supported by Schedule 1 Condition 2; Health and Social Care Purposes.
In addition to health data, we process a minimal amount of other special category data such as; data about your racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation/relationships and we use this data for two clear purposes. We have outlined these below and their relevant Article 9 conditions:
Where we are processing criminal offence data, we rely on:
There are times when we may share data in the public interests relying on the basis of Public Task, Legitimate Interests or because it is our Legal Obligation to share your information with third parties (usually authorities) and we do not require your consent to be allowed to do this. Sometimes we do not need to make you aware that we are sharing. We will only share the information that is needed; and we only share the minimum information for the purpose.
Examples of this are:
Where we deliver community orders (such as ATR, DRR, CBO or civil injunctions) we may also process your data upon a Public Task and Legitimate Interests when we share with the authorities. In all cases there is a legal requirement for us to use and share your data.
If you were in a life-or-death situation, we use the lawful basis Vital Interests to provide your personal data to the emergency services so that they may save your life.
We also rely on the lawful basis Legitimate Interests and Public Task to share your personal data with:
If changes are made to the provider of the Reach service, your data will be accessible to a different organisation who are contracted by Dorset Council to deliver the service contract. Dorset Council will notify you via your communications preferences of this change, giving you the opportunity to object to the new provider accessing your information. Dorset Council has one month to respond to your request. If it is agreed that the Council will comply with your request, the Council will explain if there will be any impact to the level of service which can be provided to you. This is because service delivery is interdependent upon the uses of your personal data.
All other third-party personal data sharing is decided by you with your explicit consent. You should update us at any point if you wish us to change these consents.
We will ask you if you wish us to share your data with NDTMS. NDTMS is the National Drug Treatment Monitoring System (NDTMS). It is used by the Office for Health Improvement and Disparities (OHID) to collect information about drug and alcohol treatment in England. If you consent, your treatment service will share some of your treatment information with NDTMS. We will provide you with the OHID NDTMS leaflet which explains this in detail.
If you are receiving criminal justice interventions, we will ask you if you consent to us sharing your information to Criminal Justice Interventions Teams (CJIT). CJIT is used by OHID to collect information about drug and alcohol and treatment and criminal justice interventions. If you consent, your treatment service will share some of your criminal justice information with CJIT.
National Data Opt Out is a government policy overseen by the NHS. Humankind Charity and Dorset Council is one of many organisations working in the health and care system to improve care for patients and the public. Whenever you use a health or care service, attend Accident & Emergency or use Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:
This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.
Most of the time, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential patient information isn’t needed.
Where your data cannot be anonymised and we are not confident that you are aware that your personal data may be used for research or planning, we will generally seek to obtain your explicit consent. However, by providing you with this privacy notice and making you aware of National Data Opt Out, we are letting you know that we may on occasions use or share your data for research of planning purposes without your consent.
Where we have your NHS number, we can check to see if you have applied an NHS Opt Out to your data being used for this purpose. Patients apply their Opt Out via the NHS National Data Opt Out process. If you have Opted Out, we will not use or share your data for purposes other than your treatment and care (i.e. we will not use or share your data for research or planning).
You have a choice about whether you want your confidential patient information to be used for research and planning. If you are happy with this use of information you do not need to do anything. If you do choose to Opt Out of your data being used for research or planning, your confidential patient information will still be used to support your individual care.
To find out more or to register your choice to Opt Out, please visit the NHS website www.nhs.uk/your-nhs-data-matters. On this web page you will:
You can also find out more about how patient information is used at:
https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and
https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)
You can change your mind about your choice at any time.
Please Note: Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement. There are also other exemptions where we do not need to apply Opt Out and these can be reviewed here
The service uses a third-party MIS called, Halo. Halo is hosted by a company called Footworks Solutions. Footworks Solutions are sub-contracted as a Data Processor by Dorset Council. Dorset Council are the data controller for your data on the Halo system. Humankind and AWMHP have access to your personal data.
Your data is held securely and only those who need access, have access to it. This includes staff that support you and also staff who maintain the system. We have policies in place which our staff follow to ensure your data is only accessed appropriately and when necessary.
Humankind have an incident reporting system called The Hub. This is where we record incidents such as safeguarding, death in service, health and safety and information governance incidents. We would only add your personal data to this system if you were involved in an incident. Each incident has access restrictions. Only those who are interested parties can see it and some staff who maintain the system.
All Humankind and AWMHP workforce abide by data management policies, processes and training.
We cannot offer you a service without storing your details using these systems.
Information about you may be shared between team members; and recorded on your file and in other records to enable us to give you the best service that we can and get the best possible support for you.
Only what is necessary and proportionate is shared and we are bound by the common law duty of confidentiality. In some circumstances we may share your data in order to keep you or other people safe, this is explained in the section above titled Sharing Your Information with Third Parties.
As part of our day-to-day operations, we do not transfer your data outside of the EEA unless with your explicit consent to do so (right to portability).
We keep your information safe by using secure ways to store it. We only keep what we need and no more than that. Everyone who handles data is trained on how to use it safely and only people who need to use it are able to.
We have a number of people who oversee that data is used safely (see ‘Relevant Contacts’).
Should an incident occur where we breach your data, causing a high risk to your rights or freedoms, we will inform you of this without delay and using the primary contact details you have provided. We will also report this to the Information Commissioner’s Office (ICO), who supervise organisations that handle data.
Dorset Council will hold your personal information in the case management system for 8 years after you leave or until you are 25 years old (whichever is latest) and then it is deleted.
If Dorset Council recommissions the Reach service to another provider, Dorset Council will authorise for the new provider to have access to all of your data for the purposes of continuing your healthcare and support. In this event Dorset Council will notify you of this change and provide you with information about your data rights.
Your data will be securely destroyed at the end of our retention period. It will be destroyed by Footworks solutions under the accountability and direction of Dorset Council.
As part of your treatment we will contact you at various stages to discuss your progress, deliver interventions and provide reminders around upcoming appointments.
This is usually via the following methods; however this is not an exhaustive list:
If you do not wish to be contacted via one or all of these methods or have specific communication needs then please tell your Humankind worker.
*e-mail & text Messages should be used for non-urgent contact only. Recovery Coordinators have e-mail accounts and mobile phones but will not routinely access them throughout the day. We always recommend phoning the service if you require assistance urgently (for example cancelling / rearranging upcoming appointments).
Under the Data Protection Act 2018 and UK GDPR, you have the following rights:
We do not use any automated decision making (decisions made by a computer) or profiling (when an automated system is used to assess certain things about you) when we use your data.
Please note that some of these rights only apply in certain situations and we may not be able to fulfil every request. Where we say no to a request, we will always explain our decision in full, within the timeframe that the law says. Should you request that your data is erased please be aware that we will be unable to continue offering you a service as we require your personal data to do this effectively and safely.
To request access to your data or to contact us about any of the rights we have listed, you can request this through the service or contact our Caldicott Guardian (see below; Relevant Contacts).
If you are unhappy about an issue relating to your data you can complain to us through the service you attend; or if you would feel more comfortable, you can contact the Humankind Caldicott Guardian (see below; Relevant Contacts).
To make a formal complaint to the independent regulator for personal data in the UK about the way we have used your data, contact the Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/ or call ICO on 0303 123 1113
As of 1 July EDP fully merged into its parent charity Humankind.
Humankind is a company registered in England.
Registered Company No. 182 0492 and a Registered Charity No. 515755, VAT No 334 6763 43
Copyright 2022
