Privacy notice

About this notice

Mind Connect Mental Health CIC provides mental health and wellbeing support through individual and group sessions, community hubs, online and by telephone. This notice explains how we use personal information about people who access or enquire about our services, their contacts, people who work with us and visitors to our website. Mind Connect Mental Health CIC, company number 15192777, is the controller of information collected for our own services. Information handled for Mersey Care patients through RiO is also subject to our NHS contract and Mersey Care's privacy arrangements. For questions about these records, contact us or Mersey Care; we will direct requests to the organisation responsible for the relevant information.

The Director is responsible for overseeing this notice and privacy enquiries. Contact Mind Connect about privacy or your information by email at leemonaghan@mindconnect.org.uk or by post at Mind Connect Mental Health CIC, Partnership for Learning, South Rd, Speke, Liverpool L24 9PZ. Mind Connect is registered with the Information Commissioner’s Office (ICO), registration reference ZB610236. Please do not send urgent safety concerns to these addresses; use the emergency or crisis support routes appropriate to your circumstances.

Information we collect

For people who self-refer, we hold the information supplied on the self-referral form and relevant follow-up correspondence. This may include contact details, reasons for seeking support, health or wellbeing information and any risks or preferences you disclose; the exact fields depend on the form used. A self-referral remains an enquiry record unless the person goes on to paid one-to-one coaching or therapeutic interventions, when relevant referral information may become part of that support record. Other projects keep records in their respective secure portals. For patients supported under our Mersey Care NHS contract, relevant care records are entered and accessed through Mersey Care’s RiO clinical record system in accordance with that contract.

For staff, applicants, volunteers and placement students, we may collect identity and contact details, qualifications, recruitment and training records, references, payroll and tax information where relevant, absence information and evidence of appropriate safeguarding or DBS checks. We may keep emergency contact details for staff and service users.

If you visit our website or contact us online, we may receive the details you submit and technical information needed to operate and protect the site. The precise website technologies are described under Website and cookies below.

Where information comes from

We obtain information directly from you and, where appropriate, a parent, carer or authorised representative. Referrals and information relevant to support may come from NHS services, GPs, local authorities, community partners or others involved in your care. We may receive information from referees or previous employers for recruitment. We will tell you where information came from when required and practical.

How and why we use information

We use information to answer enquiries; consider referrals and suitability; assess needs and risks; plan and deliver support; record attendance and outcomes; communicate with you and professionals involved in your care; manage safeguarding concerns; administer payments, contracts and employment; meet legal duties; and keep our services secure and effective. We may use anonymous or aggregated results to evaluate our work and report to funders. If a report could identify you, we will assess a separate lawful basis and explain that use to you.

Our Article 6 UK GDPR lawful bases depend on the purpose. We use legitimate interests for responding to referrals and managing services, including safety, administration and service improvement, where these interests do not override your rights. We use contract or steps before a contract for paid support and employment, and legal obligation where a specific employment, tax or other legal duty applies. We use consent for optional activities such as identifiable publicity and for website contact-form enquiries as explained below. In an emergency, vital interests may apply where necessary to protect life. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

For information needed to provide health or social care support, we use Article 9(2)(h), together with the relevant Data Protection Act 2018 condition, where the information is handled by or under the responsibility of a health professional or another person subject to the required duty of confidentiality. Health information in an enquiry is handled for arranging or providing the requested health or social care support under the same professional confidentiality requirements. Where this condition does not apply, we obtain explicit consent before using that health information for an optional purpose. Employment-related health information may be used under Article 9(2)(b) where necessary to meet employment rights or duties. Where safeguarding requires use without consent, we use an applicable substantial public interest condition, including the safeguarding condition in Schedule 1 to the Data Protection Act 2018 where its requirements are met. Agreement to receive therapy or share confidential information is separate from consent as a data protection lawful basis.

Confidentiality and sharing

We treat support records as confidential and restrict access to people who need them for their work. We may share relevant information with your GP, NHS or other care teams, referrers and support partners where appropriate to arrange or coordinate care, with your knowledge and in line with confidentiality requirements. We normally seek your permission before sharing with family or friends.

We may disclose necessary information without permission where required by law, a court order, or to protect someone from serious harm or respond to safeguarding concerns. We may also use vetted providers for secure record storage, email, website hosting, payroll or other administration under appropriate contractual controls. We share only what is necessary for the purpose and assess each disclosure.

How long we keep information

Self-referrals that do not lead to paid one-to-one coaching or therapeutic interventions are retained as enquiry records for 12 months after last contact, then reviewed and securely deleted unless a documented reason requires longer. Where paid support begins, relevant referral information is kept with that support record. For our own care records, the retention period follows the category of support and applicable professional, contractual and NHS records guidance: mental health records follow the relevant 20-year category and other adult health or social care records the relevant 8-year category, normally from the end of care. The NHS mental health category also provides for retention for 10 years after death. Non-clinical coaching records are assessed against their contractual and legal purposes rather than automatically treated as NHS clinical records. Records in Mersey Care’s RiO system follow Mersey Care’s arrangements. Other projects follow their agreed project and portal schedules. We review records before disposal and may retain them longer where necessary for safeguarding, complaints or legal proceedings. Contact us for the retention period applicable to your service.

Where we keep records and how we protect them

Our internal records are held through Outlook with restricted access. Other projects use secure portals under their respective arrangements. Mersey Care patient records are held in RiO; authorised access uses a keycard, VPN and secure app access. Only people who need information for their work may access it. We complete an NHS Data Security and Protection Toolkit assessment every 12 months. Where a supplier transfers personal information outside the UK, an applicable UK adequacy arrangement or appropriate safeguards are required. Contact us for details about the suppliers and safeguards relevant to your information.

Website contact forms and providers

The contact form collects your name, the email address or telephone number you provide, and your message. We use your consent to respond; the form asks you to confirm that we may use your details to reply. Health information is handled under the additional conditions explained above. You can withdraw this consent by contacting us. Providing information is voluntary, but we may be unable to reply or assess a request without sufficient details. Resend delivers messages to our team’s email inbox; submissions are not stored on the website. General website enquiry emails are cleared in our weekly data cleanse unless you go on to use our services or a documented reason requires retention. Self-referral forms follow the separate 12-month period above. Vercel hosts the site and keeps short-term technical logs for operation and security. Sanity manages website content and staff editor access. Their role is distinct from providers who hold clinical support records.

Website and cookies

Our public website does not set cookies for visitors, use analytics or advertising trackers, or embed videos, maps or other third-party content. Fonts are hosted on the site. Public visitors therefore do not need a cookie consent banner. The staff editor at /studio uses Sanity authentication and browser storage: a login cookie until sign-out or session end, a login token until sign-out, and layout settings until cleared in the browser. These items apply only to staff who sign in. Details are published at https://mindconnect.org.uk/cookies. If we introduce technology requiring consent, we will update that page and obtain consent before enabling it.

Children and young people

If we offer a service or project to a child or young person, we will explain its privacy arrangements in language suited to their age and assess their ability to make decisions about information sharing. Where appropriate we will involve a parent or guardian, while respecting the young person's confidentiality and safeguarding needs. Community drop-in sessions are for adults aged 18 and over. Where a separate project supports young people, its eligibility and privacy arrangements will be explained before participation.

Your rights and complaints

Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use, object to certain uses, receive portable data where applicable, and withdraw any consent on which we rely. Some rights have legal exceptions, including where records must be retained. Contact leemonaghan@mindconnect.org.uk to make a request; we may ask for reasonable proof of identity and normally respond within one month, subject to permitted extensions.

Please contact us first if you have a concern. You can also complain to the Information Commissioner's Office at ico.org.uk or telephone 0303 123 1113. If we introduce automated decisions with legal or similarly significant effects, we will explain the processing and applicable rights before using it.

Changes to this notice

This notice takes effect on 2 October 2026 and is approved by the Director. The next scheduled review is 2 October 2027, or sooner if our services, systems or legal requirements change. The current version will be published on our website.