SIX MHA Privacy Policy

SIX MENTAL HEALTH ADDICTION LIMITED

Introduction

This privacy policy explains how Six Mental Health Addiction Limited (registered in England and Wales with company number 10887813) (SMHA) collects and processes personal data, your privacy rights and how the law protects you.

How to contact SMHA

SMHA has a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact SMHA or the DPO using the details set out below:

Email address: enquiries@sixmhs.com
Postal address: c/o Burlingtons, 5 Stratford Place, London, W1C 1AX

SMHA is registered with the ICO under registration number ZA843117.

Personal data SMHA may collect from you

SMHA may collect, use, store and transfer different kinds of personal data about you in connection with its services (Services), including:

Identity data, such as first name, last name, data of birth, occupation, and employee reference number with your employer;
Contact data, such as telephone number, mobile number, email address, and postal address; and
Health data, meaning personal data relating to physical or mental health. SMHA only asks for this if necessary to provide an appropriate Service.

You are not obliged to provide any personal data to SMHA. However, if you do not, then SMHA may not be provide any Services to you.

It is important that the personal data SMHA holds about you is accurate and current. Please keep SMHA informed if your personal data changes during your use of the Services, for example a new address or email address.

SMHA may collect, use and share aggregated data, such as statistical or demographic data, which is not personal data if it does not directly or indirectly reveal your identity.

How SMHA collects personal data

SMHA may use different methods to collect your personal data. For the most part, this will be through direct interactions with you, including when you correspond with SMHA by phone, email, post and otherwise. SMHA may also receive identity data and contact data about you from your employer. SMHA is the controller and responsible for any personal data that it collects directly from you, and is the processor of any personal data provided to it by your employer.

Purposes for which SMHA uses your personal data

The table below describes the ways SMHA envisages using your personal data and which of the legal grounds SMHA will likely rely on to do so. The table also identifies SMHA’s legitimate interests, where appropriate:

Purpose or activity - Legal basis for processing

To register you as a user of the Services - Legal obligation, Legitimate interests (to make available and supply the Services to you)

To assess and provide the Services - Consent, Legal obligation, Legitimate interests (to make available and supply the Services to you)

To communicate with you, respond to your queries and requests, and confirm information you give to SMHA - Legitimate interests (to make available and supply the Services to you)

To introduce you to and engage with other third parties, such as counsellors - Consent, Legal obligation, Legitimate interests (to make available and supply the Services to you), Vital Interests

If applicable, to manage SMHA’s relationship and contract with your employer, including to enable funding of treatment sessions, and for the management of payments, fees and charges - Consent, Legal obligation, Legitimate interests (to administer SMHA’s contracts and to recover monies due)

To analyse and improve SMHA’s services, marketing, and customer and user relationships and experiences - Legitimate interests (to develop SMHA’s business and to shape its service offerings and marketing strategies)

To administer and protect SMHA’s business, including in staff and contractor performance reviews, and resolving disputes - Legal obligation, Legitimate interests (for running SMHA’s business and to inform staff and contractor appraisals and training)

The terms consent, legal obligation, legitimate interests and vital interests where used in the table above have the following meanings:

Consent: Where you give consent to the processing of your personal data for one or more specific purposes. SMHA will normally ask you for consent before processing your health data (SMHA only requests this category of personal data if necessary to provide an appropriate Service to you). You have the right to withdraw any consent you give SMHA at any time by contacting us;
Legal obligation: Where it is necessary for compliance with a legal obligation that SMHA is subject to;
Legitimate interests: Where necessary for SMHA’s legitimate interests, as long as these are not overridden by your interests or fundamental rights requiring protection of personal data. SMHA will consider and balance any potential impact on you and your rights (both positive and negative) before processing your personal data on this basis, taking into consideration your reasonable expectations of the purposes which SMHA will use your personal data for (when and in the context you give it); and

Vital interests: Where processing cannot be based on any other basis described above but is essential for your or another person’s life.

Who SMHA may share your personal data with.

SMHA may share your personal data where necessary or appropriate (usually for one of the purposes described in the table above) with the following parties:

agents, contractors and other third parties (such as therapists and treatment centres) who assist SMHA in the provision of the Services and/or who carry out functions on SMHA’s behalf;
any other third party who you ask or agree SMHA to send your personal data to, such as counsellors; and
if you use the Services under a contract between SMHA and your employer, SMHA may share your name and employee reference with your employer to enable your sessions to be funded by your employer.

International transfers

SMHA does not usually transfer your personal data outside the UK. If however this becomes necessary or desirable (for example, if you are located outside the UK, then to transfer your personal data to a counsellor in the same location as you), SMHA will only transfer to a territory or country which the UK Government has determined offers adequate levels of data protection, or SMHA may use the International Data Transfer Agreement approved by the UK Government as giving transferred personal data the same protection as it has in the UK. To obtain a copy of these contractual safeguards, please contact SMHA’s DPO using the contact details earlier in this policy.

Keeping personal data secure

SMHA follows appropriate technical and organisational measures to ensure a level of security for your personal data which is appropriate to the risks of accidental or unlawful loss, alteration, disclosure in an unauthorised way, or access. SMHA takes steps to ensure that any individuals who have access to your personal data only process them on SMHA’s instructions and are subject to a duty of confidentiality.

How long SMHA keeps personal data for

SMHA will only keep your personal data in a form which allows you to be identified for as long as reasonably necessary to fulfil the purposes SMHA collects it for, including for the purposes of satisfying any legal, regulatory, or other requirements. This will typically be for up to 6 years after termination of the Services provided to you or SMHA’s contract with your employer (where applicable). SMHA may retain your personal data for a longer period in the event of a complaint or if SMHA reasonably believes there is a prospect of litigation in respect to its relationship or dealings with you or your employer.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data as summarised below:

Request access to your personal data (commonly known as a ‘data subject access request’): This enables you to receive a copy of the personal data that SMHA holds about you and to check that SMHA is lawfully processing it;
Request correction of the personal data that SMHA holds about you: This enables you to have any incomplete or inaccurate data SMHA holds about you corrected, though SMHA may need to verify the accuracy of the new data you provide to SMHA;
Request deletion of your personal data (right to be forgotten): This enables you to ask SMHA to delete or remove personal data where there is no good reason for SMHA to continue processing it. You also have the right to ask SMHA to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where SMHA may have processed your information unlawfully or where SMHA is required to erase your personal data to comply with local law. However, please note that SMHA may not always be able to comply with your request of erasure for specific legal reasons which SMHA will notify to you, if applicable, at the time of your request;
Request restriction of processing of your personal data: This enables you to ask SMHA to suspend the processing of your personal data in the following scenarios: (i) if you want SMHA to establish the data's accuracy; (ii) where SMHA’s use of the data is unlawful but you do not want SMHA to erase it; (iii) where you need SMHA to hold the data even if SMHA no longer requires it as you need it to establish, exercise or defend legal claims; or (iv) you have objected to SMHA’s use of your data but SMHA needs to verify whether it has overriding legitimate grounds to use it;
Object to processing of your personal data: You can object to SMHA processing your personal data where SMHA is relying on a legitimate interest (or those of a third party) and you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object if and where SMHA is processing your personal data for direct marketing purposes. In some cases, SMHA may demonstrate that it has compelling legitimate grounds to process your information which override your rights and freedoms;
Request the transfer of your personal data to you or to a third party: SMHA will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format, if you request. Note that this right only applies to automated information which you initially provided consent for SMHA to use or where SMHA used the information to perform a contract with you;
Withdraw consent at any time where SMHA is relying on consent to process your personal data: You can withdraw consent at any time where SMHA is relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, SMHA may not be able to provide certain products or services to you. SMHA will advise you if this is the case at the time you withdraw your consent; and
Right to make a complaint: You have the right to lodge a complaint at any time to the Information Commissioner's Office (“ICO”), the UK regulator for data protection issues (www.ico.org.uk). SMHA would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact SMHA in the first instance.