Health & Well-being Projects For Mind Body & Soul

GDPR Privacy Notice

How we use your information

Healthy Living Healthy Lives CIC (HLHL) keeps information about many different people as part of the work we do. We take your privacy very seriously and have detailed procedures regarding how that data is used. We run various services and projects, and the details of how we use data vary between them. This document describes our procedures in detail for the different projects and services. This notice will be updated if we add, alter or cease projects or services.

HLHL employs paid staff, but some of our work is done by volunteers, and a volunteer may process your information. We check that volunteers have the skills to do their work properly, and every volunteer is trained in how to handle information when they start working with us.

Our details and contacting us

Our organisation is called Healthy Living Healthy Lives CIC. The person here responsible for our information systems is Graham O’Leary, the Information Officer. You can contact him by phone on 01277 364276, by email at graham@healthylivinghealthylives.com or by post at Healthy Living Healthy Lives CIC, Love Lane, Ongar, Essex, CM5 9BL.

If you have a question or complaint

You have the right to know what information we hold about you, and to have it corrected if it is inaccurate. If you don’t want us to hold your information any more, we may be able to delete it. If you want us to change how we use your information – for example, if you want us to stop sending you mailings – please let us know. Contact Graham O’Leary, Information Officer, by phone on 01277 364276, by email at graham@healthylivinghealthylives.com or by post at Healthy Living Healthy Lives CIC, Love Lane, Ongar, Essex, CM5 9BL.

Healthy Living Healthy Lives CIC has to obey laws about how we use your information. The government body which implements these laws is called the Information Commissioner’s Office. You have a right to complain to them if you feel that we have not complied with the law. You can contact the Information Commissioner’s Office by phone on 0303 123 1113, by email at casework@ico.org.uk or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Details of the information we hold for each of our projects and

services

The rest of this page includes details of the different information we hold for our various projects and services. These currently are:

• Staff and job applicants

• V olunteers

• People associated with Healthy Living Healthy Lives CIC

• Homeless Health Service

• Training Services

• Peaced Together

Staff and job applicants

Staff

HLHL holds information about our current staff. We do this to fulfil the contract of employment we have with our staff. We keep this information for six years after the end of a staff member’s employment.

• We hold information for payroll purposes including contact details, bank details, pension details, tax details, details of County Court Judgements and student loans. Payroll is processed using 12Pay, and we share this information with them. Only finance staff have access to payroll information.

• We hold personnel management information including contact details, details of an emergency contact person and personnel records. This information is protected by passwords on our computer system, and only available to the staff who need to see it. Paper documents are kept in locked filing cabinets with restricted access.

Job applicants

We hold information about people who apply for jobs with us, including their contact details, and information about their employment history and skills. We do this because it is in our legitimate interests to fairly and accurately assess candidates. This information is protected by passwords on our computer system, and only available to the staff who need to see it. Paper documents are kept in locked filing cabinets.

After the closing date for applications, we shortlist candidates for interview.

• If an applicant is not shortlisted, we hold their information for two weeks after the shortlisting meeting.

• If an applicant is shortlisted but not appointed, we hold their information for six months after their interview.

Volunteers

HLHL holds information about our volunteers, including their contact details, details of an emergency contact and details about their work with us. We do this because it is in our legitimate interests to manage them and their work. We keep this information for 12 months after a person stops volunteering for us.

We also keep personal data about people who express an interest in volunteering for HLHL on any of our projects/services. We keep information about your contact details and your preferences about volunteering.

We also keep your bank details so that volunteer expenses can be paid directly.

It is in our legitimate interests to do this. We may record information on sensitive topics such as your ethnicity to ensure that we provide a service equally to all parts of the community. We may record information on sensitive topics such as your health, including mental health – but only if you tell us about this, and if it is relevant to your volunteering role. We hold information on sensitive topics with your consent, which you can withdraw at any time.

Information is held on the computer system in our office, where it is only available to the staff who need to see it, and on the Company Cloud which is password protected and encrypted. Paper documents are kept in locked filing cabinets in our office.

We keep this information for six years after we last have contact with you.

People associated with Healthy Living Healthy Lives CIC

HLHL holds contact details about these individuals. We do this as part of our contractual relationship with them, as part of providing information and services associated with them or their organisation, or its role as a supporter of HLHL. These services include sending individuals our eNewsletter, information about our services, certain meetings and about our AGM.

The information is held in our database, which is backed up onto the Company Cloud which is password protected and encrypted, and access is limited on a ‘need to know’ basis.

Any individual can opt out of receiving mailings at any point by sending an email to data- controller@healthylivinghealthylives.com

If an organisation or individual ceases to work in partnership or have relationship with HLHL, we will remove the data of the people associated with them after two years.

Colleagues in other organisations

We hold your contact details. We keep this information held on our office computer system: access is restricted to staff who need it. We will hold your information so that we can provide support needed by our clients and refer onwards, as necessary and appropriate.

Homeless Health Service

We hold data about three groups of people associated with Homeless Health Service, our health service for individuals experiencing homelessness in LB Redbridge and who access The Welcome Centre, a day service provided by Healthy Living Projects Ltd:

People accessing the service

In providing a health service, we keep records, including sensitive data of people accessing the service. We do this to maintain a record of health and wellbeing interventions. We also request explicit consent to share relevant information with other health providers who may be involved in the client’s health care in order that we can achieve the best outcomes possible in supporting improved health and wellbeing. This will include the clients GP and other services to which we refer, for example, mental health services. This consent may be withdrawn at any time by the client. Some sensitive data is collected 1) for statistical purposes for our funders and is only presented as anonymised data and 2) where relevant to health outcomes: it is in our legitimate interests to do this. The information is held on HLP Ltd computer system, where only appropriate staff have access to it, and is also held on their server which is managed by Digital Nerve Centre. Due to the nature of homelessness, clients may return after many years absence, hence health records are kept for up to six years. If a

  client is known to have died, we will delete all health records after twelve months from known date of death.

Our service contractors and other health providers

We keep contact details, details of your insurance, details of DBS checks, details of activities for which you are qualified and financial details of invoices you have sent us and payments we have made. Some of this information is held on our computer system, and only finance/personnel staff can access it; all computer data is backed up to the Company Cloud which is password protected and encrypted. Paper documents are stored securely in a locked filing cabinet and is only accessible by the finance/HR team.

We hold this information so that we can carry out our contract with you. We will delete the information six years after we last make a payment to you.

Directors and staff of HLP Ltd and The Welcome Centre

We keep your contact details on our computer system, and only staff working on the Homeless Health Service and their Managers can access it. We hold this information so that we can carry out our agreement with you. We will delete the information six years after we last make a payment to you.

Training Services

We hold data about people who have booked on our training courses, and about people who have told us that they are interested in getting information from us about our training services.

Information about training bookings is held on IT systems based in our office and backed up on the Company Cloud which is password protected and encrypted. We are processing this data to carry out the contract between us. We are processing this data to send you information you have asked for: it is in our and your legitimate interests to do this.

If you book for training, we hold this information for 12 months (36 months for 1st Aid courses) after the date of the training session. If you ask us to stop sending information about our training courses, we will stop immediately and delete your data from our systems. If we are offering a training programme with an external provider, we will share personal data required with that provider to fulfil any contractual or legal requirements. This is particularly relevant for our accredited 1st aid courses which are modified by OfQual and who provided the registration and certification.

Peaced Together

We work with individuals accessing Peaced Together and some charities and community groups who support this service. We keep your contact data for the duration of the course and longer if you wish to maintain contact and access other support services. We collect sensitive data requested by funders which is anonymised and used for statistical purposes only. This

data is kept separately to your contact data and doesn’t identify any individual. Participants complete a start of course evaluation and end of course evaluation which should have nothing more than initials and age to identify the individual. This data is used to compare and validate evidence of improved outcomes. Anonymised data is shared with heidi@peacedtogether.co.uk , course founder, to assess national/international course impact. Statistics are shared with trainers in different locations to support funding applications and to show the impact the course has on individuals. We will never share any information that identifies any of our participants.

Information is held on the computer system in our office, where it is only available to the staff who need to see it, and on the Company Cloud which is password protected and encrypted. We keep this information for twelve months after we last have contact with you.