Privacy Notice for UK Addiction Treatment Group Limited
This Privacy Notice is effective from 1st May 2018
This Privacy Notice gives you information on how UK Addiction Treatment Group Limited (Company number: 08234534) and its subsidiaries (collectively “UKAT”, “we”, “us”, or “our”) collect and process your personal data and your rights in relation to the data we hold about you.
UK Addiction Treatment Group Limited is a “data controller” for the purposes of the Data Protection Act 1998 and (from 25 May 2018) the EU General Data Protection Regulation 2016/679. This means that we are responsible for, and control the processing of, your personal information. UKAT is listed with the Office of the Information Commissioner as a data controller with the reference number: ZA289330.
We will update this Privacy Notice from time to time. When we do change the notice, we will post an update on our website.
UKAT takes data protection and confidentiality very seriously. This Privacy Notice covers:
- How to contact us
- When and what personal data do we collect
- How we use your personal data
- How we store your personal data
- Protection of your personal data
- Sharing your personal information
- Young persons
- Disclosure to third parties
- Accuracy and retention of personal information
- Your rights
We collect personal data about our service users (patients and clients in our care) and colleagues so please make sure that you read the relevant sections of this notice and get in touch if you have any questions.
If you have any questions or concerns about this Privacy Notice or how we process your information or if you would like to make a complaint about a possible data breach please contact us:
By Email: firstname.lastname@example.org
Write to us at:
Data Protection Officer UK Addiction Treatment Group Limited
Unit 1, Floor 1 Imperial Place
We take data security extremely seriously and all such communications are examined and replies issued where appropriate as soon as possible. If you are unsatisfied with the reply you receive, you may refer your complaint to the Information Commissioner’s Office (ico.org.uk/make-a-complaint/)
When and what personal data do we collect
You may be asked to provide your personal information anytime you are in contact with UKAT. UKAT and its affiliates may share this personal information with each other but will always use it in accordance with this Privacy Notice. We may also combine it with other information to provide and improve our services. You are not required to provide the personal information that we may request, but, if you chose not to do so, in many cases we will not be able to provide you with our services or respond to any queries you may have.
UKAT will collect information from you in various ways, including when you:
- contact us by any means with queries, complaints or ask a question about mental health and addiction treatment
- register with us for treatment or rehabilitation
- ask a question about mental health and addiction treatment
- voluntarily complete our surveys or provide us with feedback
- visit our website (website usage information is collected using cookies – see below)
- engage with us on social media or download/install one of our apps
- book an appointment with us or attend an event/programme that we are running
- have given a third party permission to share with us the information they hold about you
Typically the type of personal information we collect about you will include:
- Personal contact details (i.e. name, postal address, e-mail and contact number)
- Date of birth
- Racial or ethnic origin
- Religious or philosophical beliefs
- Physical and mental health information
- Political opinions
- Trade union membership
- Genetic data
- Biometric data
- Health and medical records
- Financial information
- Passport details
- Residency state
- Username (e.g. any name you use on a social media site or an NHS website)
- Online identifier / IP address (where you visit our website)
- Social media identifier
- National insurance number
- CCTV recordings when you visit one of our centres
If our services are commissioned for you by third parties (your GP, local authorities, clinical commissioning groups, private medical insurers etc.) they will provide us with a variety of information, including your name, postal address, telephone number, email address and, medical/educational history.
During the course of your time with us, we will keep information about you in your personal records like your name, address and date of birth together with details of any care and/or treatment that you are having.
How we use your personal data
We will rely on the following factors (as applicable) as the basis for processing your personal information:
- It is necessary for the performance of a contract with us
- It is necessary to comply with mandatory legal or statutory obligations
- It is necessary for public interest
- It is necessary to protect the vital interest of you or other persons, such as your health and wellbeing
- It is necessary for the purposes of our legitimate interests as data controller to continue processing your personal data in a way that we have previously done (however, we will not allow our interest to override your interests or fundamental rights and freedoms)
- Consent, whereby you have consented to the processing of your personal data for one or more specific purposes
The personal information we collect and store about you allows us to provide services to you. We also use it to help us develop, operate, deliver, and improve the quality of the care we provide or, more generally, the type of services that we offer. From time to time, we may use your personal information to send important notices to you or to those acting on your behalf, such as updates to your care and/or treatment plans or changes to our terms, conditions and policies. Because this information is important to your interaction with UKAT, you may not opt-out of receiving these communications.
We may also use personal information for internal purposes such as auditing, data analysis, and research to improve our services and our communication with you.
How we store your personal data
Any personal information which is collected, recorded or used in any way, whether on paper, online or any other media, will have appropriate safeguards applied in line with our data protection obligations. We have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.
Protection of your personal data
UKAT takes the security of your personal information very seriously. To make sure your personal information is protected, we have a series of technical and administrative measures in place. Access is limited only to those of our employees who need to access it to provide services to you.
All members of staff are required to undertake annual data protection and confidentiality training and our privacy and security guidelines are communicated to all UKAT employees. These privacy safeguards are monitored and strictly enforced. We send any information that we need to share with any third parties either as a legal requirement or through an anonymised process securely.
The majority of your information is processed in the UK and European Economic Area (EEA). However, some of your information may be processed by us or the third parties we work with outside of the EEA, including countries such as the United States. Where your information is being processed outside of the EEA, we take additional steps to ensure that your information is protected to at least an equivalent level as would be applied by UK / EEA data privacy laws e.g. we will put in place legal agreements with our third party suppliers and do regular checks to ensure they meet these obligations.
Sharing your personal information
UKAT will not share your personal information with any third party that intends to use it for direct marketing unless we have received your specific consent to do so. Information may be shared with our subsidiary companies which UKAT has control through direct or indirect ownership (as defined in section 1159 of the UK Companies Act 2006). There may be occasions where UKAT will need to share your information with selected third parties, on these occasions will ensure there is a data processing agreement in place which ensures that the third party keeps information private, secure and processed only in the way specified by UKAT.
We understand the importance of taking extra precautions to protect the privacy and safety of the young people under our care. Where a young person engages with the services of UKAT, we will ask the young person if an adult with parental responsibility can provide consent for us to hold/use the young person’s personal data but if this is not possible, we will make a professional judgement. If it can be justified to be in the public interest to share the personal data, we will lawfully share it to protect the young person from significant harm and promote the welfare of the young person.
Whilst the majority of young person information provided to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the law, we will inform you whether you are required to provide certain young person information to us or if you have a choice in this.
All young person information will be held on the same basis as other information outlined in this Privacy Notice.
We routinely share information about young people who are using our services with local authorities, guardians and parents. We do not share information about the young people in our care with anyone without consent unless the law and our internal policies allow us to do so.
We share young people’s data with the local authority on a statutory basis. This data sharing underpins local authority funding and policy and monitoring.
Parents and young persons have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s record, contact us at the address outlined above.
Disclosure to third parties
UKAT will not share your personal information with any third party that intends to use it for direct marketing unless we have received your specific consent to do so. Information may be shared with our subsidiary companies which UKAT has control through direct or indirect ownership (as defined in section 1159 of the UK Companies Act 2006). There may be circumstances where UKAT will need to share your information with selected third parties. We will only share your personal information with third parties in the following circumstances:
- where you have given your consent to the information being shared
- where there are issues or concerns like your wellbeing or the wellbeing of others
- where there is a legal requirement or obligation to share the information
Personal information of service users may also need to be shared with third parties to make arrangements for the funding and/or payment of services received.
Additionally, in the event of a reorganization, merger, or sale of UKAT or any part of it, we may transfer any and all personal information we collect to the relevant third party.
Accuracy and retention of personal information
UKAT makes it easy for you to keep your personal information accurate, complete, and up to date. If any of your information changes please let us know so that we can update our records.
We are legally required to hold certain information about you for a set period of time. The length of time we keep your information for these purposes will vary depending on the obligations we need to meet. All personal information will be deleted or securely destroyed at the appropriate time and we will not keep your personal information for longer than is required or permitted by law.
Your communications with the staff members of UKAT (including by telephone or email) may be monitored and/or recorded for training, quality control and compliance purposes to ensure that we continuously improve our customer service standards and to enable us to deliver our services to you.
You have various in relation to how UKAT uses your information and these are:
- You are entitled to see what personal information we hold about you at any time. If you wish to access your personal information, please make a data subject access request using contact details set out above.
- If the personal information is inaccurate or incomplete, you can request that it is corrected.
- You have the right to request that all data held by UKAT which identifies you is deleted but please note UKAT may be compelled to maintain your information due to specific legislative or regulatory requirements.
- Whenever you have given us consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
- You have the right to ask us not to process your personal data for direct marketing purposes. We will ask you when we collect your personal data if we can use your data for such purposes or if we can disclose your information to any third party for such purposes. You can opt-out of receiving such marketing at any time.
- You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.