Privacy notice

Your privacy when using this website

Who we are

Our website address is: https://www.nyhorizons.org.uk

What personal data we collect and why we collect it

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact forms

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Analytics

We use a company called Google to collect and analyse information about the use of our website. This information helps us to measure understand how visitors use our website. If you have an account with Google, manage your advertising settings, otherwise you can manage these settings through your web browser.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where we send your data

Visitor comments may be checked through an automated spam detection service.

Full privacy notice

This privacy notice is for people who use the North Yorkshire Horizons (NYH) service. NYH is a service Waythrough provide in North Yorkshire. We are funded by North Yorkshire County Council to provide this service.

Waythrough adheres to the Data Protection Act 2018 in relation to how we collect and process information that identifies you as an individual. This type of information is called personal data.

Please note: If you started using our services prior to 1st October 2022, this privacy notice does not apply and you should request a copy of the information you received at the time from the service. You can also contact Caldicott.guardian@Waythrough.org.uk

Managing Your Information

Waythrough is a Joint Data Controller with North Yorkshire County Council. This means that we jointly decide how data is processed and share a joint purpose for this.

We sub-contract Data Processors who are our partners Changing Lives (who provide after-care provision) and Spectrum (who deliver the clinical element of our contract).

Please note that the Click and Collect service is provided directly by Waythrough as a Data Controller, for which there is a separate privacy notice.

What We Use and Why

We use personal data like your name, address, DOB, NHS number and contact details so that we can provide you with a service.

We also use more sensitive data about your health; and demographic data such as your gender, sex life (specifically relationships), sexual orientation, race and ethnicity and religious beliefs. This is called Special Category Data which requires extra protection.

If you are subject to the criminal justice system, we may process some criminal offence data about you so that we can provide you with our service and so that we can manage risks to you, to our team and to the public.

How We Collect Your Data

We receive your data from you and sometimes from other people like your GP, local authority, Primary Care Services, prison, probation, police and housing services. This list is not exhaustive as anyone can refer you into our service.

We may receive your data by telephone, email, electronic web form or by post.

Lawful Reasons for Processing.

The lawful reasons (known as lawful bases) for processing are set out in the UK General Data Protection Regulation (UK GDPR). At least one of these must apply whenever we process personal data.

We use the lawful basis of Legitimate Interests to process your data, to provide you with the service.

We process your health data using the Article 9 condition (h) Health or Social care. We only process what is necessary for the purpose; and processing is overseen by a health professional bound by the common law duty of confidentiality.

In addition to health data, we process a minimal amount of other special category data such as; data about your racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation/relationships and we use this data for demographic purposes and statistical analysis and to meet individual health and social care needs

We process your health data under the Health or Social care condition of the UK GDPR. We only process what is necessary for the purpose; and processing is overseen by a health professional bound by the common law duty of confidentiality.

Where we are processing criminal offence data, we rely on special conditions under the Data Protection Act 2018 relating to health and social care, preventing or detecting unlawful acts and safeguarding.

Sharing Your Information with Others (also known as ‘Third Parties’)

There are times when we may share data in the public interests relying on the basis of Public Task or because it is our Legal Obligation to share your information with third parties (usually authorities) and we do not require your consent to be allowed to do this. Sometimes we do not need to make you aware that we are sharing. We will only share the information that is needed; and we only share the minimum information for the purpose.

Examples of this are:

to report a crime to the police (this includes driving under the influence)
to report to the police if you have gone missing
to report abuse or neglect to social services
to let mental health crisis services know if you are at serious risk
any other request where we are obliged to share data as per a legal obligation which is
laid down in UK law.

We rely on the lawful basis Legitimate Interests to share your personal data with:

North Yorkshire County Council as we are a joint controller with the council who are
entitled to see personal data of our service users.
Changing Lives who are a Data Processor for us and provide an after care service.
Spectrum who are a Data Processor for us and provide the clinical aspect of the service.
The local authority social care team to provide you with support through partnership working, where risks and vulnerabilities require us to do so in your best interests or in the
best interests of others (particularly children, families and adults at risk).
Your GP, in order to prescribe you medication.
Pharmacies, in order to prescribe you medication.
The prison, probation services, courts and police to share prescribing information
and/or arrange ongoing support, if you have recently been released or are going into
custody.
Rough Sleepers, police and housing/homeless services as part of multiagency working.
If you would like a referral to detox services we share your data as a legitimate interest with our partners Chapman Barker Unit, Greater Manchester Mental Health NHS Foundation Trust and Edward Myers Unit, North Staffordshire Combined Healthcare NHS Trust who are data controllers. Please see the Detox Beds privacy notice for reference.
Multi-agency sharing protocol organisations including: North Yorkshire Fire and Rescue
Service, Chief Constable for North Yorkshire (NY Police), City of York Council, Harrogate
and District NHS Foundation Trust, North Yorkshire CCG, Tees, Esk, and Wear Valley NHS
Foundation Trust, Vale of York CCG, York and Scarborough Teaching Hospitals NHS
Foundation Trust, Beyond Housing (Formerly Yorkshire Coast Homes), Broadacres Housing Association, Joseph Rowntree Foundation Housing Trust, PACE (Parents against child sexual exploitation), York CVS, North Yorkshire Youth Justice Service, Police Fire and Crime Commissioner for North Yorkshire, Yorkshire and Humber Probation Service, Veritau Ltd.

If our project is decommissioned, we will transfer all your data to the new provider and notify you by letter. We transfer your data on the lawful basis of legitimate interests so that you continue to receive the service you are using. Although we transfer your data, we also keep a copy of your data in line with our retention period (see below “Keeping Your Information”).

All other third-party personal data sharing is decided by you with your explicit consent. You provide us with this information on the Sharing Consent Form. You should update us at any point if you wish us to change these consents.

The Sharing Consent Form will ask you if you wish us to share your data with NDTMS. NDTMS is the National Drug Treatment Monitoring System (NDTMS). It is used by the Office for Health Improvement and Disparities (OHID) to collect information about drug and alcohol treatment in England. If you consent, your treatment service will share some of your treatment information with NDTMS.

If you are receiving criminal justice interventions, the Sharing Consent Form will ask you if you consent to us sharing your information to Criminal Justice Interventions Teams (CJIT). CJIT is used by OHID to collect information about drug and alcohol and treatment and criminal justice interventions. If you consent, your treatment service will share some of your criminal justice information with CJIT.

You Can Opt Out of Your Personal Data Being Used For Research and Planning

National Data Opt Out is a government policy overseen by the NHS. Waythrough Charity is one of many organisations working in the health and care system to improve care for patients and the public. Whenever you use a health or care service, such as a Waythrough health or social care service, attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, You can find out more about these purposes and opting out here

Most of the time, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential patient information isn’t needed. Where your data cannot be anonymised and Waythrough is not confident that you are aware that your personal data may be used for research or planning, Waythrough will generally seek to obtain your explicit consent.

Where Waythrough has your NHS number, we can check to see if you have applied an NHS Opt Out to your data being used for this purpose. Patients apply their Opt Out via the NHS National Data Opt Out process. If you have Opted Out, Waythrough will not use or share your data for purposes other than your treatment and care (i.e. Waythrough will not use or share your data for research or planning).

You have a choice about whether you want your confidential patient information to be used for research and planning. If you are happy with this use of information you do not need to do anything. If you do choose to Opt Out of your data being used for research or planning, your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to Opt Out, please visit the NHS website.

You can also find out more about how patient information is used at: https://understandingpatientdata.org.uk/what-you-need-know

Confidentiality

Information about you may be shared between team members; and recorded on your file and in other records to enable us to give you the best service that we can and get the best possible support for you.

Only what is necessary and proportionate is shared and we are bound by the common law duty of confidentiality. In some circumstances we may share your data in order to keep you or other people safe which is a legal obligation this is explained in the section above titled Sharing Your Information with Third Parties.

Transferring Your Data Outside of the UK

As part of our day-to-day operations, we do not transfer your data outside of the UK unless with your explicit consent to do so (right to portability).

When a service closes and we archive data in line with our data retention period, we use a third-party Processor called Iron Mountain. Iron Mountain may in some instances, use sub-processors who are based in other countries. Iron Mountain ensures that where required, Standard Contractual Clauses are in place to protect data where it is transferred to another country as per the EU’s adequacy decisions.

Keeping Your Information Safe

Your data is held securely on a third-party management system and only those who need access, have access to it. This includes staff that support you and staff who maintain the system. We have policies in place which our staff follow to ensure your data is only accessed appropriately and when necessary.

We store some of your personal data on our secure network drives which is restricted to our service team and may be accessed under policy by our IT Team should there be a technical issue. All Waythrough’s workforce abide by data management policies, processes and training.

We cannot offer you a service without storing your details on these systems.

We have a number of people who oversee that data is used safely (see ‘Relevant Contacts’).

Should an incident occur where we breach your data, causing a high risk to your rights or freedoms, we will inform you of this without delay and using the primary contact details you have provided. We will also report this to the Information Commissioner’s Office (ICO), who supervise organisations that handle data.

Retaining Your Information

We keep your personal data for the period stated in our records retention and destruction policy. The policy currently states that we will keep your information for 10 years from the date that the service contract ends which for this service is 30/09/2029.

In the event that we change the retention period in our policy, we will update our privacy notice and notify you of this change.

Your data will be securely destroyed at the end of our retention period.

Keeping in Touch With You

As part of your treatment we will contact you at various stages to discuss your progress, deliver interventions and provide reminders around upcoming appointments.

This is usually via the following methods; however this is not an exhaustive list

letters
online platforms such as Zoom or WhatsApp
phones calls
home visits (when applicable)
e-mails*
text messages*

If you do not wish to be contacted via one or all of these methods or have specific communication needs then please tell us using the Contact Preferences form. You can request this from your Waythrough worker.

*e-mail & text Messages should be used for non-urgent contact only. Recovery Coordinators have e-mail accounts and mobile phones but will not routinely access them throughout the day. We always recommend phoning the service if you require assistance urgently (for example cancelling /rearranging upcoming appointments).

Your Data Rights

Under the Data Protection Act 2018 and UK GDPR, you have the following rights: 

to be informed about the collection and use of your personal data.
to access your personal data (known as Subject Access Request).
to have inaccurate personal data rectified; or completed if it is incomplete. 
to have personal data erased (known as the right to be forgotten).
to request the restriction or suppression of your personal data.  
to data portability, which allows individuals to obtain and reuse their personal data for their
own purposes across different services. 
to object to the processing of your personal data in certain circumstances.

We do not use any automated decision making (decisions made by a computer) or profiling (when an automated system is used to assess certain things about you) when we use your data.

Please note that some of these rights only apply in certain situations and we may not be able to fulfil every request. Where we say no to a request, we will always explain our decision in full, within the timeframe that the law says. Should you request that your data is erased please be aware that we will be unable to continue offering you a service as we require your personal data to do this effectively and safely.

To request access to your data or to contact us about any of the rights we have listed, you can request this through the service or contact our Caldicott Guardian (see below; Relevant Contacts).

How To Complain

If you are unhappy about an issue relating to your data you can complain to us through the service you attend; or if you would feel more comfortable, you can contact the Waythrough Caldicott Guardian (see below; Relevant Contacts).

To make a formal complaint to the independent regulator for personal data in the UK about the way we have used your data, contact the Information Commissioner’s Office (ICO): 
https://ico.org.uk/make-a-complaint/ or call ICO on  0303 123 1113  

Relevant Contacts

Free call 08000 14 14 80 info@nyhorizons.org.uk

You can write to us at Waythrough, Inspiration House, Unit 22 Bowburn North Industrial Estate DH6
5PF.

Our Data Protection Officer (DPO) is Mark Burnett. You can contact our DPO by email
dpo@Waythrough.org.uk or by phone 01325 731 160.

Our Caldicott Guardian is Leesa Howes. You can contact our Caldicott Guardian by email
caldicott.guardian@Waythrough.org.uk or by phone 01325 731 160

We also access information via YHCR, read their fair processing notice