Welcome to the Simply Divine Wellbeing privacy policy.

Simply Divine Wellbeing respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you use our services and/or visit our website (regardless of where you visit it from) and tells you about your privacy rights and how the law protects you.

Purpose of this privacy policy

This privacy policy aims to give you information on how Simply Divine Wellbeing collects and processes your personal data when you access services from us and/or through your use of our website, including any data you may provide through the website when you sign up to our newsletter or use one of our services. It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you or your child, so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them

Controller

Simply Divine Wellbeing is the controller and responsible for your personal data (collectively referred to as "Simply Divine Wellbeing", "we", "us" or "our" in this privacy policy). We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise any of your legal rights, please contact the DPO using the details set out below.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our DPO in the following ways:

Full name of legal entity: Simply Divine Wellbeing C.I.C

DPO Name: Diane Gower (Director of Simply Divine Wellbeing C.I.C)

Email address: [email protected]

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to resolve your concerns before you approach the ICO, so please do contact us in the first instance

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

What data do we hold about you

In order to work within our professional guidelines, the type of data we may typically hold about you/or working alongside young people includes the following:

• Your name and address.

• Your contact details including email/phone numbers.

• Details of an emergency contact number

• Any information relating to your health or medical needs which is relevant to being with us

• Notes from our session or assessment – these are anonymised.

• Any creative or other pieces of work created in our session or assessment.

• Copies of any information or reports you have provided us with as part of our session or assessment.

• Emails and text messages sent during our sessions and assessment.

• Payment and invoicing information relating to you.

• Any data about your use of our website which includes internet protocol (IP) address, browser type and version, time zone setting and location, and other technology on the devices you use to access our website.

How is your personal data collected?

We use different methods to collect data from you and about you including though:

Direct Interactions. You may give us contact details, information about health, GP/Social Worker/Consultant/Teacher details by filling in forms with us by post, phone, email or face-to-face. This includes personal data you provide when requesting our services, subscribing to our newsletter, requests for marketing to be sent to you, or contacting us.

Third Parties. We will receive personal data about you from various third parties, such as (i) a social worker, the local authority, your GP, Consultant o (ii) technical data from analytic providers such as Google; (iii) contact or financial data from providers of technical and payment services such as Local Authority accounts departments.

Why we hold your data:

We hold your data so that we are able to make contact with you to schedule appointments/sessions, make you aware of any safeguarding concerns shared or offer you a wellbeing call should your Practitioner need to take extended unplanned leave for any reason . We keep your data so that we have background information which is pertinent to the assessment/piece of therapeutic work we are completing. We do this so we can endeavour to provide you with the best service possible. This privacy notice tells you what we will do with your personal information from initial point of contact to the completion of assessment/therapy offered under Simply Divine Wellbeing .

How we use your personal data:

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you. This means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. This is where the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

• Where processing your personal data is necessary for compliance with a legal obligation that we are subject to.

• We rely on consent as a legal basis for processing your sensitive health data. You have the right to withdraw consent to marketing at any time by contacting us.

How your data is held and security of your data:

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those Sisters of Simply Divine, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

In line with guidance from the Information Commissioner’s Office we will only retain your personal information for as long as is necessary. We will never use your personal data for any purposes other than the delivery of services which we are offering to you.

We will receive a referral to our service from your Social Worker or other person supporting you, or you will make a self-referral. We will ask for information about your/your child at the point of referral to establish whether or not we are the appropriate service for you to access. We will ask that referral details are provided to us via secure email or in paper form and that you, and anyone else with parental responsibility for your child, consents to this referral being made. We will keep a copy of your referral form on a password protected computer, used only for Simply Divine Wellbeing work purposes and by authorised Practitioners or in the case of repair/maintenance. We keep this information so that if your Practitioner is unwell or has a change of circumstances a member of our service can alert you to this and offer a wellbeing call if required. 

The laptop is stored in a lockable cabinet and only Simply Divine Wellbeing Practitioners have access to this key. Any paper referral forms will be either scanned onto the computer or kept in a lockable cabinet in the same manner.

Brief session notes will be kept in an anonymised paper form in either a locked filing cabinet or a locked basement room. Session notes will detail attendance days and times and a brief overview of themes emerging and interventions used in session. Should there be any safeguarding concerns in session, this will be noted on the session notes. In line with the confidentiality and safeguarding agreement, should there be a need to share safeguarding concerns with another person, this will be noted and a printed email with evidence of this will be stored with your referral information. This will be stored for 7 years in line with the session note retention period and a copy of the concern will be forwarded to your allocated Social Worker should you have one in place. 

In respect of any creative work you complete as part of an assessment or intervention, these are kept in a locked room at the Office of Simply Divine Wellbeing C.I.C base until the end of your assessment/intervention. They are held anonymously. Any assessment or work which requires photographing or video recording will be stored anonymously on a password protected computer which is only used for the work purposes of the Practitioner/s providing services to you. This data will be destroyed/deleted at the end of assessment/intervention, or where required, stored anonymously on a memory card or in photographic form along with your paper records for the 7 year retention period.

Your referral form is kept separate from your anonymised session notes.

Your email address will be stored in our ProtonMail account, this is an encrypted account and held on servers in Switzerland. We request that all of the Practitioners offering work on behalf of Simply Divine Wellbeing use this service to ensure our communication with them is end-to-end encrypted, and we request that you install and set up a free version of this if you wish to correspond or share any information by email with us.

Who will see your Data:

Your Data will only be seen by the Directors of Simply Divine Wellbeing , Administrative persons working on behalf of Simply Divine Wellbeing , the Practitioner/s supporting you and their Supervisors. As per our service, we work with a range of professionals such as Art Therapists, Psychotherapists, Play Therapists Holisitc Health Therapists – at the point of referral it is important that we are able to discuss your request for support with some of these professionals to refer you to the most suited person. We would not share any personally identifying information about you until the point at which a referral was agreed. In, the case of children who are currently or have previously been looked after, the Local Authority Social Worker will have access to any completed reports or assessments.

We may also need to share your personal data with the following external third parties:

• Service providers acting as processors who provide IT and system administration services, such as Mailchimp, WordPress, WooCommerce, Stripe and Paypal.

• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.

• Simply Divine Wellbeing is a not-for-profit C.I.C. and the area can be shared. At times we may ask external providers for support for the running of our building or to develop new services. As part of this process, we are often asked to confirm things such as how many people use our service, their age ranges, their presenting concerns, their gender, their ethnicity and their sexuality. We ask for your consent to share this information. This information would be in the form of statistic and would not be personally identifiable to you.

 You have the right to opt out of this process and this will not affect any service you receive from us.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

In the event of external third parties based outside the UK .

If we were to transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; and/or

• Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

• Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

Confidentiality

The only other reason that your personal data would be shared with anyone else would be in the event of a safeguarding concern whereby we would be under an obligation to share information in order to preserve the safety of your child or another person. Wherever possible, we would discuss our concerns with you directly in the first instance and come to an agreement about the best way forward. We will be transparent about the information we need to share and how it will be shared. If the child is under the age of 18, the Practitioner will also discuss the situation with parents / carers before sharing information, as long as it is safe and appropriate to do so. If a Sister of Simply Divine needs to share information without the child or family’s consent, we ask that they make the Directors at Simply Divine Wellbeing aware of this plan, but that they do not delay in taking action to safeguard in order to do this.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your contact details and knowledge of previous services provided by us to you, to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

We will always get your express opt-in consent before we share your personal data with any third party for marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by contacting us at any time to notify us of your opt-out.

Use of CCTV

If we use CCTV in and around our premises. For a detailed explanation of what we collect and how it is used, please see our CCTV Policy, which can be found under the policy section on our website or requested in paper copy.

How long we will hold your data:

Your referral form will be destroyed by the use of a GDPR compliant shredder once our work together is complete.

Your session notes will be kept in line with the insurance guidelines of the Practitioner who is providing your support. Typically, that is 7 years from the completion of work.

If the child we are working with is a looked after or previously looked after child there is an obligation for records to be kept substantially longer than this. In order for us to discharge this duty an end of intervention summary report or completed assessment will be requested from all Practitioners working with you and this will be provided by secure email to the referring Social Worker to hold on Social Care records. Your Practitioner may also retain a copy of this report for the 7 year period, in case you wish to return for further work in the future, unless you request otherwise.

In line with GDPR obligations, if a data breach occurs and personal information is shared in error that could put you at risk, we will make you are aware at the earliest opportunity and liaise with the ICO to report this error.

In order to manage financial records in line with HMRC legal stipulations, Simply Divine Wellebeing C.I.C  keep a log of payments that are made to ourselves by you or the Local Authority commissioning services on your behalf. These are anonymised and stored on password protected spreadsheets. This information is kept for a period of 7 years and then destroyed.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Under the following 3 circumstances, access to your records can be denied:

• Where someone else has confidentially supplied information about you - in such a case we would need to seek consent from this person in the first instance.

• Where it is believed by the Practitioner that sharing information would cause harm to you.

• Where the information is about your child and your child does not provide consent for you to see this. Parents/Guardians do not have automatic rights to see details of their child’s therapeutic sessions, and we would not breach their confidentiality outside of the reasons detailed above as this would not likely be in the best interests of the child.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data's accuracy.

• Where our use of the data is unlawful but you do not want us to erase it.

• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required: You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you: We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond: We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Any Questions?

If you have any questions or comments about this privacy policy or anything contained within it, please do contact us at the above email address.

We will review this policy on a regular basis and in line with any new guidance and law, and as such you may be asked to review and sign an updated privacy policy during your involvement with our service.