Malvern Hills Wellbeing Hub CICPrivacy and Data Protection PolicyLast updated: 1 November 2026Organisation: Malvern Hills Wellbeing Hub CICCompany Registration Number: 16434305ICO Registration Number: C1773131Registered Address: 21 Hoopers Close, Leigh Sinton, Malvern, WR13 5BZWebsite:www.malvernhillswellbeinghub.netPrivacy Contact:MHWH@Malvernhillswellbeinghub.net1. Our Commitment to PrivacyMalvern Hills Wellbeing Hub CIC (MHWH) provides affordable, accessible counselling and wellbeing support to individuals in the Malvern Hills area.We are committed to protecting your privacy, maintaining confidentiality and ensuring that your personal information is handled securely and respectfully.We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.This policy explains what information we collect, how we use it, who may have access to it and your rights.2. What Information We CollectWhen you contact us, complete a referral form or access our services, we may collect:Your name and contact details.Your postcode or address where necessary.Information provided through self-referrals or professional referrals.Information about your wellbeing and support needs where relevant.Appointment, attendance and waiting-list information.Information relevant to safeguarding concerns.Payment and concession information where applicable.Information necessary to manage and evaluate our services.We aim to collect only the information necessary to assess referrals and provide appropriate support.We do not require individuals to provide detailed accounts of their mental health difficulties or personal experiences through our initial online referral forms.3. How We Use Your InformationWe use personal information to:Receive and process referrals.Contact individuals requesting counselling or wellbeing support.Assess eligibility and suitability for our services.Manage waiting lists and appointments.Allocate clients to appropriate counsellors.Maintain necessary administrative records.Manage payments, concessions and funded services.Respond to safeguarding concerns.Monitor service effectiveness and improve our provision.We may provide anonymised statistical information to funding organisations, including information about referral numbers, counselling sessions delivered and service outcomes.We do not routinely share identifiable counselling information with funders.We do not sell personal information or use counselling records for marketing.4. Our Legal Basis for Processing InformationWe process personal information where an appropriate lawful basis exists under Article 6 of UK GDPR.Depending on the activity, this may include:Taking steps to provide a service requested by an individual or fulfilling an agreement with them.Our legitimate interests in administering and delivering counselling and wellbeing services, where these do not override individuals' rights.Compliance with legal obligations.Protecting vital interests in emergencies.Consent where this is the appropriate lawful basis.Information concerning physical or mental health is classified as special category data and receives additional protection under Article 9 of UK GDPR.Where applicable, we may process such information for the provision or management of health or social care, subject to the relevant legal and professional confidentiality requirements.Other lawful conditions may apply in particular safeguarding or emergency circumstances.We document the appropriate lawful bases and special category conditions for our processing activities.5. Online Referrals and WixOur website uses Wix to receive online self-referrals and professional referrals.We have simplified our referral forms to collect only information necessary for initial contact and assessment.Completed referrals are held within the Wix submission system and are accessible only to authorised personnel.We do not routinely send completed referral forms or sensitive referral details by email.Referrals are reviewed by an authorised MHWH administrator and transferred to our practice management system, Cliniko.Information temporarily held within Wix is deleted when it is no longer required, in accordance with our retention arrangements.6. Cliniko and Administrative RecordsMHWH uses Cliniko to manage referrals, waiting lists, appointments and administrative client information.Each client is allocated a unique reference code to reduce unnecessary use of identifiable information.MHWH retains information necessary to administer the counselling service, including referral information, attendance and appointment records.Access is restricted to authorised individuals who require the information for legitimate service purposes.Routine client records are retained for 12 months after the client's last contact with the Hub, unless there is a justified reason to retain them for longer.7. Confidential Counselling NotesCounselling services are delivered by self-employed counsellors who maintain their own confidential counselling notes.These notes are held separately from MHWH's administrative records.MHWH does not routinely hold or access individual counselling session notes.All counsellors working with MHWH are individually registered with the Information Commissioner's Office and are responsible for maintaining appropriate data protection, confidentiality and record-keeping arrangements.Each counsellor is responsible for the secure storage, retention and disposal of their own counselling notes in accordance with their professional and data protection obligations.Where counsellors determine independently how and why their counselling records are processed, they act as independent data controllers for those records.Clients may request information about how their individual counsellor manages confidential counselling notes.8. Confidentiality and Information SharingConfidentiality is fundamental to our counselling services.Personal information is accessible only to those who require it for legitimate administrative, professional or safeguarding purposes.We may receive referrals from organisations including:Healthcare professionals and social prescribing services.Neighbourhood mental health services.Citizens Advice.WorkWell.Platform Housing.Other appropriate community and support organisations.We do not routinely share counselling notes with referring organisations or funding bodies.Relevant referral and contact information may be shared with an allocated counsellor where necessary to arrange and provide counselling support.Information may also be shared where there is an appropriate lawful basis, including to comply with legal obligations or respond to safeguarding concerns.Any disclosure will be limited to the information necessary for the relevant purpose.9. Safeguarding and Limits to ConfidentialityWe take safeguarding responsibilities seriously.Although counselling information is confidential, there may be circumstances where disclosure is necessary to protect an individual or another person from serious harm.This may include:Concerns about the safety or welfare of a child.Concerns involving an adult at risk.Serious risks of harm to an individual or another person.Circumstances where disclosure is required by law.Safeguarding concerns are handled in accordance with MHWH's safeguarding procedures.Where appropriate and safe, individuals will be informed when information needs to be shared.10. How Long We Keep InformationMalvern Hills Wellbeing Hub CIC retains routine client referral and administrative records in Cliniko for 12 months after the client's last contact with the Hub, unless there is a legal, safeguarding, insurance or other justified reason to retain information for longer.This allows us to maintain continuity of support, including where clients return for further counselling after six months.Referral information temporarily stored in Wix is removed once it has been securely transferred to Cliniko and is no longer required.Financial records and safeguarding information may be subject to different retention periods in accordance with applicable legal and professional requirements.All self-employed counsellors are individually responsible for the secure storage, retention and disposal of their own confidential counselling notes, in accordance with their professional and data protection obligations.MHWH does not routinely hold or access those counselling notes.11. How We Protect Your InformationWe use appropriate technical and organisational measures to protect personal information.These include:Restricted access to referral and administrative records.Secure account management and authentication.Use of established practice management systems.Confidentiality requirements for counsellors, directors, staff and volunteers.Procedures for secure information sharing.Appropriate retention and deletion arrangements.Procedures for identifying and responding to data protection incidents.12. External Service ProvidersWe use external services to support our operations, including:Wix: Website hosting and online referral forms.Google Workspace: Organisational email and communications.Cliniko: Referral administration, appointments and client records.These providers process information in connection with the services they supply to us and are subject to applicable data protection requirements.Some information may be processed or stored outside the UK. Where international transfers occur, appropriate legal safeguards must apply.13. Your Data Protection RightsUnder UK data protection law, you may have the right to:Request access to personal information held about you.Request correction of inaccurate information.Request deletion of information in certain circumstances.Request restriction of processing.Object to certain uses of your information.Request data portability where applicable.Withdraw consent where consent is the lawful basis for processing.These rights are subject to applicable legal conditions and exceptions.Requests concerning MHWH administrative records can be directed to the Hub at MHWH@Malvernhillswellbeinghub.net.Requests concerning counselling notes held by an independent counsellor should normally be directed to that counsellor. MHWH can assist in identifying the appropriate contact.We will respond to requests within the timescales required by data protection law.14. Website CookiesOur website uses Wix and may use cookies necessary for its operation and security.Additional cookies, including analytics or marketing cookies, may be used where configured.Where consent is legally required for non-essential cookies, visitors will be offered an appropriate choice.15. ComplaintsIf you have concerns about how your personal information is handled, please contact:Malvern Hills Wellbeing Hub CICMHWH@Malvernhillswellbeinghub.netYou also have the right to raise concerns with the Information Commissioner's Office.Information Commissioner's Office: www.ico.org.uk16. Reviewing This PolicyThis policy is reviewed periodically and updated when our services, systems or legal obligations change.The latest version will be available on our website.
.png)
