For website-specific privacy policy, click here.

This privacy notice explains how Platfform Wellbeing uses the personal information we collect about you when you engage with our services.

We want everyone who comes to us for support to feel confident and comfortable with how their personal information is collected, used, and protected

WHY WE NEED YOUR PERSONAL INFORMATION

Platfform Wellbeing provides counselling, wellbeing, and mental health support services. To deliver these services safely and effectively, we need to collect and use personal information about you.

When you register with a Platfform Wellbeing project, we may collect information including:

  • Your name, address, telephone number, email address, and other contact details.
  • Information relating to your referral to our service.
  • Details of previous counselling or support services you have received.
  • Information about your emergency contacts or next of kin where relevant.
  • Information about your dependants, parents, or carers where relevant to the support provided.
  • Records of support provided, including appointment details, session notes, assessments, safety plans, risk assessments, and correspondence.
  • Information relating to your health, wellbeing, disabilities, medical conditions, and medication where relevant to the service.
  • Information about protected characteristics, such as age, ethnicity, religion, disability, sex, gender identity, or sexual orientation.
  • Details of professionals or organisations involved in your care or support, such as your GP, support worker, solicitor, university, employer, or healthcare provider.
  • Payment and billing information where applicable.
  • Any other information that is relevant to providing our services or fulfilling our contractual and legal obligations.

SPECIAL CATEGORY INFORMATION

Some of the information we collect is considered “special category” personal information under UK GDPR because it is particularly sensitive. This may include information about:

  • Physical or mental health.
  • Disability.
  • Race or ethnic origin.
  • Religion or belief.
  • Sexual orientation.
  • Sex life.
  • Other information relevant to therapeutic support.

We process this information only where permitted by law and where necessary to provide counselling, wellbeing, health-related, safeguarding, or support services.

Where required, we rely upon the conditions contained within Article 9 UK GDPR, including:

  • Health or social care purposes.
  • Substantial public interest, including safeguarding.
  • Your explicit consent where appropriate.

HOW DO WE GET YOUR INFORMATION

We obtain personal information in several ways:

Information you provide directly

  • You may provide information when:
  • Contacting us.
  • Registering for services.
  • Completing assessments or questionnaires.
  • Attending counselling sessions.
  • Making payments.
  • Corresponding with us by telephone, email, online forms, or other means.

Information received from others

We may receive information from:

  • Referring organisations.
  • NHS services.
  • Universities.
  • Commissioners and funders.
  • Employers where services are employer-funded.
  • Family members, carers, or friends.
  • Other healthcare, social care, or support organisations.

Where information is received from another organisation, it will only be shared where there is a lawful basis for doing so.

OUR LEGAL BASIS FOR USING YOUR INFORMATION

Under UK GDPR, organisations must identify a lawful basis for processing personal information.

Depending on the service you receive, Platfform Wellbeing may process your information because:

Contract

  • Processing is necessary to provide the counselling, wellbeing, or support service you have requested.

Legitimate Interests

  • Processing is necessary for Platfform Wellbeing’s legitimate interests, including:
  • Delivering and improving services.
  • Service planning and development.
  • Clinical supervision and quality assurance.
  • Managing complaints and legal claims.
  • Ensuring service safety and effectiveness.

Legal Obligation

  • Processing is necessary to comply with legal or regulatory requirements, including safeguarding, financial, taxation, insurance, health and safety, and regulatory obligations.

Vital Interests

  • In rare circumstances, information may be processed to protect somebody’s life or prevent serious harm.

Whenever we rely on legitimate interests, we take account of your rights and interests and ensure that our processing is fair, proportionate, and necessary.

WHAT WE DO WITH YOUR INFORMATION

We use your information to:

  • Deliver counselling, wellbeing, and support services.
  • Assess eligibility for services.
  • Manage appointments and referrals.
  • Maintain records of support provided.
  • Undertake risk assessments and safeguarding activities.
  • Monitor attendance and engagement.
  • Measure outcomes and service effectiveness.
  • Conduct service audits, quality monitoring, and supervision.
  • Comply with contractual, regulatory, legal, and safeguarding obligations.
  • Investigate complaints and concerns.
  • Protect staff, clients, and members of the public.
  • Produce statistical and management information.

Where possible, reports provided to commissioners, funders, researchers, or partners will use anonymous or aggregated information that does not identify you.

HOW LONG WE KEEP YOUR INFORMATION

Platfform Wellbeing will only keep your personal information for as long as it is needed for the purposes described in this privacy notice (usually for 7 years), including providing services, meeting contractual requirements, complying with legal and regulatory obligations, handling complaints, responding to claims, and safeguarding clients, staff, and others.

Different types of information may be kept for different periods depending on the service provided, the type of record, funder or commissioner requirements, safeguarding considerations, professional guidance, legal requirements, and operational need.

Our retention periods are set out in a separately maintained retention schedule. This schedule is reviewed and updated separately from this privacy notice so that it remains accurate when services, systems, contracts, or legal requirements change.

You can view the current retention schedule by getting in touch with us.

When information reaches the end of its retention period, it will be securely deleted, anonymised, or archived where there is a lawful reason to keep it for longer.

SHARING YOUR PERSONAL INFORMATION

Your information is primarily used by authorised Platfform Wellbeing staff, counsellors, supervisors, and volunteers who need access to perform their duties.

We will never sell your personal information or use it for third-party marketing purposes.

We may share information with:

  • Commissioners and funders.
  • NHS organisations.
  • Local authorities.
  • Healthcare professionals.
  • Referring organisations.
  • Safeguarding agencies.
  • Professional advisers, insurers, auditors, and regulators.
  • IT and software providers who process data on our behalf.

Where information is shared, we will only do so when:

  • You have provided consent.
  • It is necessary to deliver services to you.
  • It is required by law.
  • It is necessary to protect you or another person from serious harm.
  • It is necessary for safeguarding children or vulnerable adults.
  • It is necessary for the establishment, exercise, or defence of legal claims.

Sharing Information About Sessions

Some funded services require us to report attendance information and service outcomes to commissioners or funders.

Where session information must be shared, we will explain this before services begin. The type of information shared, the legal basis for sharing it, and any applicable confidentiality limitations will be clearly explained as part of the service agreement.

SECURITY

Platfform Wellbeing is committed to maintaining the security of your personal information.

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, destruction, alteration, or disclosure.

These measures include:

  • Access controls and permissions.
  • Staff confidentiality agreements.
  • Password and authentication controls.
  • Secure storage systems.
  • Security monitoring.
  • Staff training and awareness programmes.
  • Information governance policies and procedures.

Only authorised individuals who need access to your information are permitted to do so.

TRANSFERRING YOUR PERSONAL INFORMATION

Some of the organisations and systems we use may process information outside the United Kingdom.

Where this occurs, Platfform Wellbeing will ensure that appropriate safeguards are in place, including:

  • UK adequacy regulations.
  • The UK Extension to the EU-US Data Privacy Framework where applicable.
  • International Data Transfer Agreements (IDTAs).
  • Other approved safeguards permitted under UK GDPR.

For example, payments processed through Stripe may involve processing outside the UK under approved international transfer mechanisms

YOUR DATA PROTECTION RIGHTS

RIGHT OF ACCESS

You have the right to ask us for copies of your personal information. This right always applies, however there are some exemptions, which means you may not always receive all the information we process.

RIGHT TO RECTIFICATION

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

RIGHT TO ERASURE

You have the right to ask us to erase your personal information in certain circumstances.

RIGHT TO RESTRICTION OF PROCESSING

You have the right to ask us to restrict the processing of your information in certain circumstances.

RIGHT TO OBJECT TO PROCESSING

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests.

RIGHT TO DATA PORTABILITY

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent and the processing is automated.

RIGHT TO WITHDRAW CONSENT

Where we rely on your consent to process personal information, you may withdraw that consent at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

AUTOMATED DECISION-MAKING

Platfform Wellbeing does not make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.

OUR COMMITMENT TO YOU

Platfform Wellbeing is committed to protecting your personal information and making every effort to ensure that your personal information is processed in a fair, open and transparent manner.

For the purposes of UK GDPR and the Data Protection Act 2018, Platfform is the Data Controller for the personal information processed as part of Platfform Wellbeing services. This means that Platfform is responsible for, and control the processing of, your personal information.

If you have any questions about this privacy notice or how your information is used, please contact:

Data Protection
Platfform
Beaufort House,
Beaufort Road,
Swansea.
SA6 8JG

Phone: 01656 647722
Email: dpo@platfform.org

If you have concerns about jhow we have handled your information correctly, please contact us first so that we can investigate and attempt to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner’s Office. Please view the website www.ico.org.uk for further information.

Platfform is Cyber Essentials Certified