The Medway Therapeutic Alliance is committed to protecting the personal information of children, young people, parents, carers and professionals who access our service. This privacy notice explains how we collect, use, store and share your information, and outlines your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

 

Who We Are

The Medway Therapeutic Alliance is commissioned by Medway Council, who act as the Data Controller. 

The service is delivered by North Kent Mind, acting as a Data Processor, working in with the following subprocessors: 

• Oasis 

• CHUMS 

• Young Lives Foundation 

• Salus 

• Kooth 

• BFB Labs 

• Barrett Behaviour Change Consultancy 

These organisations provide emotional wellbeing and therapeutic support to children and young people in Medway as part of the Medway Therapeutic Alliance partnership. 

All organisations involved follow strict data protection rules to ensure that your information is handled lawfully, fairly and securely.

 

What Information We Collect

We collect only the information necessary to provide emotional wellbeing and therapeutic support and to meet our reporting requirements to the commissioners and MHSDS. This may include: 

• Name, date of birth, and contact details 

• Address and school/education details 

• Parent/carer contact information 

• Referral details and presenting concerns 

• Information about the support you access 

• Relevant health and wellbeing information needed for assessment or intervention

 

Why We Collect Your Information

We collect and use personal data in order to: 

• Provide emotional wellbeing, therapeutic, and early-help support 

• Assess suitability for services 

• Allocate referrals to the appropriate team 

• Keep records of the support you receive 

• Monitor service quality and performance 

• Meet legal and safeguarding obligations 

• Improve service delivery 

We may process your data under: 

• Legitimate Interests – Article 6(1)(f): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. 

• Vital interests – Article 6(1)(d): processing is necessary in order to protect the vital interests of the data subject or of another natural person; 

• Consent – Article 6(1)(a): the data subject has given clear consent for their data to be processed for one or more specific purposes, such as participation in certain activities or interventions.  

Where we rely on consent as the lawful basis for processing your personal data, you may withdraw that consent at any time.

To withdraw consent, please email us at hello@medwaytherapeuticalliance.co.uk. 

Some data ‘special category data’ requires greater justification than other data to process. The law requires us to identify an additional basis for processing, for example, health data. Where we process your special category data this will be either with your specific consent or for the purposes of providing you health or social care: 

• Article 9(2)(a) – Explicit consent 

• Article 9(2)(h) – The provision of health or social care 

 

Who We Share Information With

We may share information with: 

• Medway Council (Data Controller) 

• North Kent Mind (Data Processor) 

• Medway Therapeutic Alliance delivery partners (subprocessors): 
  Oasis, CHUMS, Young Lives Foundation, Salus, Kooth, BFB Labs, Barratt Behaviour Change Consultancy 

• Health, education or social care professionals involved in your support 

• Emergency or safeguarding services when required by law 

• The NHS 

We do not share your information with third parties for marketing or commercial purposes. 

 

How Long We Keep Your Information

We only keep your information for as long as necessary to deliver the service and to meet our legal and regulatory obligations. Our retention periods follow the NHS Records Management Code of Practice for children and young people. 

 

How long your personal data will be kept 

Category	Retention Period
All records relating to the referral and support provided by the service, including evidence of consent from parents/carer	Child/young person’s Date of Birth + 25 years (in line with the NHS Records Management Code of Practice).
Data related to responding to any complaints.	5 years from the date the complaint is resolved.

 

Once your information reaches the end of its required retention period, it will be securely deleted

 

Your Rights

Under UK GDPR, you have the right to: 

• Access your personal data 

• Request correction of inaccurate information 

• Request deletion of your data (in certain circumstances) 

• Request restriction of processing 

• Object to processing 

• Withdraw consent (where consent is the basis for processing) 

• Complain if you think your data has been used unlawfully 

 

How to Request Information or Raise a Concern

If you would like to: 

• Request access to the information we hold 

• Ask a question about how your information is used 

• Request a correction 

• Make a complaint about data handling 

 

Please contact the North Kent Mind Data Protection Officer: 

Email: dpo@northkentmind.co.uk 

 

You may also contact the Medway Council Data Protection Team, as Data Controller, through the contact details available on the Medway Council website. 

 

If you remain dissatisfied, you have the right to contact the Information Commissioner’s Office (ICO). 

 

8. 8. Changes to This Privacy Notice

We review this privacy notice regularly to ensure it remains accurate and up to date. Any significant changes will be published on our website.