Project 6 is committed to protecting and respecting your privacy and the personal information we hold about you.
This privacy notice sets out how we use and protect any of your personal data we collect when we provide you with a service.
Managing your information
In its role as data controller, when Project 6 collects and processes your data we are responsible for ensuring that we do that securely, that your rights are respected, and we do so lawfully.
Our contact details are:
Airedale Voluntary Drug and Alcohol Agency (trading as Project 6)
11–19 Temple St, Keighley, BD21 2AD
01535 610180
Why we use your personal data
We use your personal data so that we can provide you with a service. This includes activities such as:
- Scheduling appointments and sending you reminders
- Keeping a record of your relationship with us
- Providing you with advice and information
- Making referrals to other services on your behalf
- Informing you about other local services that might be relevant to you
- Providing volunteering opportunities
- Managing potential risks to you and other people
- Ongoing communication with you while you are accessing our services by email, texts and phone call
- Keeping you informed about changes and updates at Project 6
- Evaluating and monitoring our services
The type of personal information we collect
We may collect and process the following information when you access a service with us:
- Your name
- Contact details
- Date of birth
- NHS number
- Details of appointments and activities you attend at Project 6 services
- Emergency contact details
- Information about your employment status and housing status
- Your history with our services
- Details of referrals made about you
- Details of criminal convictions
- Details of previous employment, training and education
We may also use more sensitive data about your health, disabilities and demographic data such as your gender, relationship status, sexual orientation, race and ethnicity and religious beliefs. This is known as Special Category Data which requires extra protection.
We sometimes process details of criminal offences relating to you. This data is covered by additional protections.
How We Collect Your Data
We may receive personal data from several sources, these include:
- Directly from you when you contact us or request a service
- From professionals making a referral on your behalf
- From our partners with whom we have data-sharing agreements
We may receive your data by telephone, email, electronic web form, by post or orally when you have appointments with us.
Our Lawful Reasons for Processing
The lawful reasons (known as lawful bases) for processing are set out in the UK General Data Protection Regulation (UK GDPR). At least one of these must apply whenever we process personal data.
We use the lawful basis of Legitimate Interests to process your data, to provide you with the service.
We process your health data using the Article 9 condition (h) Health or Social care. We only process what is necessary for the purpose. This is further supported by Schedule 1 Condition 2; Health and Social Care Purposes.
In addition to health data, we process a minimal amount of other special category data such as; data about your racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation/relationships and we use this data for two clear purposes. We have outlined these below and their relevant Article 9 conditions:
- For demographic purposes and statistical analysis. This allows us to monitor and evaluate the effectiveness of our services, using condition (j) Archiving, research and statistics. This is further supported by Schedule 1 Condition 4; Research.
- To meet individual health and social care needs, using condition (h) Health or Social care. This is further supported by Schedule 1 Condition 2; Health and Social Care Purposes.
Where we are processing criminal offence data, we rely on:
- the Schedule 1, Condition 2; Health and Social Care Purposes to work with the prison and probation to provide you with healthcare.
- the Schedule 1, Condition 18; Safeguarding Children and Individuals of Risk, to manage risks where you may present a risk to the public and service users we work with.
Sharing Your Information with Others (Third Parties)
We take your privacy seriously, we only share data when there is a clear purpose backed up in law, or where we have data sharing agreements in place. In most cases we will inform you before any sharing of your data takes place.
There are times when we may share data in the public interests relying on the basis of Public Task or because it is our Legal Obligation to share your information with third parties (usually authorities) and we do not require your consent to be allowed to do this. Sometimes we do not need to make you aware that we are sharing. We will only share the information that is needed; and we only share the minimum information for the purpose.
Examples of this are:
- to report a crime to the police
- to report abuse or neglect to social services
- to let mental health crisis services know if you are at serious risk
- to share information in multiagency settings should you be subject to Multi Agency Risk Assessment Conferences (MARAC: to prevent domestic abuse) and/or Multi Agency Tasking And Coordination Meetings (MATAC: to prevent domestic abuse), or Multi Agency Public Protection Arrangements (MAPPA: to prevent reoffending).
- to share information (if requested to by law) with the court of law.
- any other request where we are obliged to share data as per a legal obligation which is laid down in UK law.
If you were in a life-or-death situation, we use the lawful basis Vital Interests to provide your personal data to the emergency services so that they may save your life.
We rely on the lawful basis Legitimate Interests to share your personal data with:
- the local authority social care team to provide you with support through partnership working, where risks and vulnerabilities require us to do so in your best interests or in the best interests of others (particularly children, families and adults at risk).
- your GP, in order to prescribe you medication.
- we may share information to your GP where we make the decision that your life or someone else’s is at risk and we believe strongly that the GP is in a key position to help you/others. If we make this decision we will make all reasonable attempts to inform you.
- Police and housing/homeless services as part of multiagency working.
Storing your data and keeping it safe
We keep your information safe by using secure ways to store it. We only keep what we need and no more than that. We store your personal data in secure systems with access controls in place. Our policies and staff training ensure everyone who handles data knows how to use it safely and only people who need to use it are able to.
We also have an incident reporting system. This is where we record incidents such as safeguarding, health and safety and information governance incidents. We would only add your personal data to this system if you were involved in an incident. Each incident has access restrictions. Only Project 6 staff responsible for responding to incidents have access to this.
Should an incident occur where we breach your data, causing a high risk to your rights or freedoms, we will inform you of this without delay and using the primary contact details you have provided. We will also report this to the Information Commissioner’s Office (ICO), who supervise organisations that handle data.
We may not be able to offer you a full service without storing your data on our systems.
Confidentiality
Information about you may be shared between team members; and recorded on your file and in other records to enable us to give you the best service that we can and get the best possible support for you.
Only what is necessary and proportionate is shared and we are bound by the common law duty of confidentiality. In some circumstances we may share your data in order to keep you or other people safe which is a legal obligation.
Keeping Your Information
We keep your personal data for the period stated in our Data Retention and Disposal policy. The policy currently states that if you are over 18 we will keep your information for 6 years from the financial year-end that follows our last contact with you. For people under 18 years, data is stored until you reach the age 25. There may be exceptional circumstances when we are required to keep your information for a longer period.
In the event that we change the retention period in our policy, we will update our privacy notice and notify you of this change.
Your data will be securely destroyed at the end of our retention period. It will be destroyed by us if it is electronic. Where we hold paper records, we will use a contractor who will destroy records securely.
Your Data Rights
Under the Data Protection Act 2018 and UK GDPR, you have the following rights:
- to be informed about the collection and use of your personal data.
- to access your personal data (known as Subject Access Request).
- to have inaccurate personal data rectified; or completed if it is incomplete.
- to have personal data erased (known as the right to be forgotten).
- to request the restriction or suppression of your personal data.
- to data portability, which allows individuals to obtain and reuse their personal data for their own purposes across different services.
- to object to the processing of your personal data in certain circumstances.
We do not use any automated decision-making (decisions made by a computer) or profiling (when an automated system is used to assess certain things about you) when we use your data.
Please note that some of these rights only apply in certain situations and we may not be able to fulfil every request. Where we say no to a request, we will always explain our decision in full, within the timeframe that the law says. Should you request that your data is erased please be aware that we will be unable to continue offering you a service as we require your personal data to do this effectively and safely.
To request access to your data or to contact us about any of the rights we have listed, you can request this through the service or contact:
Data Protection Officer
Project 6
11-19 Temple St
Keighley
BD21 2AD
01535 610180
How To Complain
If you have any concerns about our use of your personal information, you can make a complaint to us at:
Project 6
11-19 Temple St
Keighley
BD21 2AD
01535 610180
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Call: 0303 123 1113
Website: www.ico.org.uk