Data Protection Policy

Registered Address: Womble House, 31 Lower Brook Street, Ipswich IP4 1AQ
Email: reception@teenagementalhealth.co.uk
Call: 01473 411324

Document Purpose: Policy for Data Protection
Author: Dylan Pomietlo / HR Manager
Email: Dylan@teenagementalhealth.co.uk
Contact Number: 07859326209
Date completed: 01/07/2026
Audience: Public
Superseded Document: N/A
Action Required: Compliance
Date for Review: 01/07/2027
Version: 1.0
Status: Approved and Shared 02/07/2026

Document Status: This is a controlled document. Whilst this document may be printed, the electronic version posted on the website www.teenagementalhealth.co.uk is the controlled copy. Any printed copies of this document are not controlled. As a controlled document, this document should not be saved onto local or network drives but should always be accessed from the website.

Data Protection Officer: Dylan Pomietlo
Information Sharing Manager: Dylan Pomietlo

1. Introduction

1.1 Background

Teenage Mental Health Ltd ‘TMH’ need to collect and process personal data about people with whom it deals in order to carry out its business and provide its services. Such people include but are not limited to patients, employees (present, past and prospective), suppliers and other business contacts. The data may include identifiers such as name, address, email address, data of birth, NHS Number, National Insurance Number. It may also include private and confidential information, and special categories of personal data. In addition, TMH occasionally be required to collect and use certain types of such personal information to comply with the requirements of the law.

No matter how it is collected, recorded and used (e.g. on a computer or other digital media, on hardcopy, paper or images, including CCTV) this personal information must be dealt with properly to ensure compliance with data protection legislation – the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Which implements the GDPR in the UK.

The lawful and proper treatment of personal information by TMH is extremely important to the success of our business and in order to maintain the confidence of our service users and employees. TMH must ensure that it processes personal information lawfully and correctly.

1.2 Joint Working

Teenage Mental Health Ltd (TMH) works collaboratively with a range of organisations and professionals where this is clinically appropriate, lawful, and in the best interests of the client. These may include, but are not limited to, schools and colleges, NHS services, General Practitioners (GPs), Local Authorities, charities, private organisations, independent healthcare providers, and other professionals involved in a client’s care.

Where it is necessary to share or receive personal information to support the safe, effective, and coordinated delivery of services, TMH will only do so where there is an appropriate lawful basis under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and with the client’s consent where required, unless disclosure is otherwise permitted or required by law.

TMH acts as an independent Data Controller in relation to the personal information it processes and will only enter into appropriate Information Sharing Agreements or Data Sharing Agreements where these are necessary to facilitate lawful joint working with another organisation.

To support these arrangements, TMH will:

• Appoint a Data Protection Officer to oversee compliance with data protection legislation.
• Carry out Data Protection Impact Assessments where required before introducing new processing activities or significant changes to existing practices.
• Ensure that any sharing of personal information is proportionate, secure, necessary, and limited to the information required for the intended purpose.
• Maintain clear procedures governing the receipt, storage, processing, retention, and sharing of personal information.
• Ensure that all information sharing arrangements comply with UK GDPR, the Data Protection Act 2018, professional guidance, and TMH policies.

Further information regarding the sharing of patient information with referring organisations can be found within Section 1.10 – Patient Data Between Organisations for Therapy Referrals Policy.

1.3 Data Protection Principles.

TMH fully support and must be able to demonstrate compliance with the six principles of the Act which are summarised below:

• Personal data shall be processed lawfully, fairly and in a transparent manner in relation to individuals;
• Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
• Personal data processed must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• data shall be accurate and, where necessary, kept up to date;
• data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
• Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

1.4 Information covered by data protection Legislation.

The GDPR definition of “personal data” covers any information relating to an identified or identifiable natural person – i.e., living individuals. Pseudonymised personal data is covered, however anonymised or aggregated data is not regulated by the GDPR or DPA2018, providing the anonymisation or aggregation has not been done in a reversible way. Individuals can be identified by various means including their name and address, telephone number or Email address, NHS Number, NI Number.

The GDPR defines special categories of personal data (previously referred to as sensitive personal information) as information related to:

• Race or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Health data
• Sexual history and/or sexual orientation
• criminal convictions and offences data

2. Scope

All our staff and of hosted organisations, without exception, are within the scope of this policy, including and without limitation:

• Charities, Companies or Organisations using our service to send referrals for Therapeutic Services or others.
• Other Strategic Clinical Networks
• Regulatory Bodies

2.1 Clinical Records and Process Notes

As part of providing psychotherapy and counselling services, TMH therapists maintain contemporaneous clinical process notes to support safe, ethical, and effective therapeutic practice. These records are separate from general administrative records and are maintained solely for the purposes of delivering clinical care, professional supervision, safeguarding, and meeting legal or regulatory obligations where applicable.

TMH’s clinical process notes are not routinely stored within our electronic administrative systems. Where maintained in handwritten form, they are stored securely with appropriate physical safeguards and access is strictly restricted to the treating therapist and, where clinically or legally necessary, authorised members of the TMH Clinical Team.

Clinical process notes remain confidential and are managed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable professional guidance, and TMH’s Confidentiality Policy.

3. Roles and Responsibilities

3.1 TMH will:

• Implement the requirements as Data Sharing Agreements when working with other Organisations of any description
• ensure that an appropriate policy is in place encompassing relevant roles within the organisation that have responsibility for data protection within this document
• provide training for all staff members who handle personal information and ensure access to further guidance and support
• provide clear lines of report and supervision for compliance with data protection
• carry out regular checks to monitor and assess new processing of personal data and to ensure the any Improvement notification is provided to the TMH Document Owner is updated to take account of any changes in processing of personal data
• develop and maintain procedures to ensure compliance with data protection legislation, to cover for example:
  • data protection impact assessment
  • managing responses to subjects’ rights requests
  • to management of personal data breaches
  • provision of privacy information
  • training and compliance testing
• Maintain a record of processing activities
• Ensure the organisation complies with its transparency and fair processing obligations in relation to data subjects’ personal data

3.2 The Data Protection Officer

The assignment of a data protection officer is a standard requirement. This document establishes this role as follows. The DPO is responsible for providing advice, monitoring compliance, and is the first point of contact in the organisation for data protection matters. The DPO reports to the Director directly in relation to data protection matters.

3.3 Information Security

Teenage Mental Health Ltd is committed to protecting the confidentiality, integrity, and availability of the personal information it holds.

TMH will implement and maintain appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure, or unauthorised access. These measures may include, but are not limited to:

• Secure electronic record systems.
• Password-protected devices and user accounts.
• Appropriate encryption and secure methods of transferring personal information where reasonably practicable.
• Restricted access to personal information on a need-to-know basis.
• Appropriate physical security measures for paper records and premises.
• Staff training and regular review of information security practices.

Where a personal data breach is suspected or identified, TMH will investigate the incident promptly and take appropriate action in accordance with UK GDPR, the Data Protection Act 2018, and any applicable reporting requirements.

3.4 Employee Responsibilities

All employees will, through appropriate training and responsible management:

• Observe all forms of guidance, codes of practice and procedures about the collection and use of personal information.
• Understand fully the purposes for which TMH uses personal information.
• Collect and process appropriate information, and only in accordance with the purposes for which it is to be used by TMH to meet its service needs or legal requirements.
• Ensure the information is destroyed (in accordance with the provisions of the Act) when it is no longer required.
• On receipt of a request by or on behalf of an individual for information held about them, or any other data subject’s rights in relation to their personal data, staff will immediately notify their line manager and the Reception Team or Data Protection Officer and abide by the Procedure for managing personal data requests.
• Not send any personal information outside the UK unless appropriate safeguards under UK GDPR are in place and authorised by the Data Protection Officer.
• Understand that breaches of this Policy may result in disciplinary action, up to and including dismissal.

Section 170 (1) of the Data Protection Act 2018: Unlawful obtaining etc. of personal data, states it is an offence for a person knowingly or recklessly:

(a) to obtain or disclose personal data without the consent of the controller

(b) to procure the disclosure of personal data to another person without the consent of the controller, or

(c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained

4. Distribution Plan

4.1 Distribution Plan

This document will be made available to all staff via the company website and reception. A notice will be issued via email to all staff notifying of the release of this document.

4.2 Training Plan

A training needs analysis will be undertaken with staff affected by this document with the Data Protection Officer.

Based on the findings of that analysis appropriate training will be provided to staff as necessary.

Guidance will be provided by the Data Protection Officer and the Information Sharing Manager as and when identified.

5. Monitoring

Compliance with the policies and procedures laid down in this document will be monitored via the Data Protection Officer and the Information Sharing Manager.

Data Protection Officer and the Information Sharing Manager is responsible for the monitoring, revision and updating of this document on a 2 yearly basis or sooner if the need arises.

6. Data Retention

Teenage Mental Health Ltd will retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, professional, safeguarding, insurance, and accounting obligations, and to protect the legitimate interests of clients and the organisation.

Records will be securely retained and disposed of in accordance with applicable legislation, professional guidance, and the Teenage Mental Health Ltd Records Retention Schedule. When personal information is no longer required, it will be securely destroyed or permanently anonymised where appropriate.

Individuals may request further information regarding the retention periods applicable to their personal information by contacting the Data Protection Officer.

7. Equality Impact Assessment

This document forms part of TMH’s commitment to create a positive culture of respect for all staff and service users along with our Ethics policy. The intention is to identify, remove or minimise discriminatory practice in relation to the protected characteristics (race, disability, gender, sexual orientation, age, religious or other belief, marriage and civil partnership, gender reassignment and pregnancy and maternity), as well as to promote positive practice and value the diversity of all individuals and communities. As part of its development this document and its impact on equality have been analysed, and no detriment identified.

8. Associated Documents

The following documents will provide additional information:

• Confidentiality Policy
• Terms and Conditions Policy
• Therapeutic Services Contract
• Criminal Convictions Appropriate Policy
• Privacy Information Notice for Candidates and Applicants
• Safeguarding Policy
• Complaints Policy

9. Patient Data between Organisations for Therapy Referrals Policy

9.1 Introduction

The Following is TMH’s policy on the information we will accept or share with another organisation through our standard agreements of service provisions.

TMH are confirming within this document that we will not enter any agreement that conflicts with the following commitments and actions regarding the handling of Patient information within the process of referrals from separate organisations.

All TMH staff have been notified and adequate training or supervision to follow the policy.

9.2 Information Shared

The following is the limited information we are prepared to receive and share.

The action of information handover will only ever be received or provided between organisations following patients documented consent in all cases for new or historic referrals and patients.

• TMH will only accept and hold physically or digitally:
  • Patient Name
  • Patient Address
  • Patient Phone Number(s)
  • Patient Email Address
  • Legal Guardian Name
  • Legal Guardian Address
  • Legal Guardian Phone Number(s)
  • Legal Guardian Email Address
  • GP details (where supplied)
  • Educational or Work details
  • Referring organisation or professional
  • Emergency contact details
  • Patient and or Guardian approved presentation information for the purpose of;
    • Assessments
    • Therapy
    • Parent consultations
    • Reviews
    • Service enquiry.

And any previous Support or intervention received historically or at current.

• The above information should be transferred using secure electronic systems approved by TMH, encrypted email where appropriate, or by hand where suitable.
• TMH will not share Patient/Referral Information listed above under any circumstances without specific written and signed consent from the Patient or Legal Guardian to any other party.
• If TMH is unsuccessful in contacting a Patient referral, the Authorising organisation who sent the referral will be advised.
• If a patient referral signs and agrees to our services terms and conditions for the provision of our services, the documents stated in “7. Associated Documents” and all other TMH Polices will be active to the Patient directly.
• Unless the Patient expresses no information to be shared with the organisation they have been referred via, TMH may, where appropriate and with the necessary consent, provide a brief summary regarding attendance, engagement, clinical risk (where relevant), and recommendations regarding continuation, amendment or discharge from services. Otherwise TMH’s Confidentiality policy is superseding document for Patient confidentiality.
  • If a Patient requests for no information to be shared with the referring Organisation, if the organisation is funding the therapy service TMH provides they may rightfully cease any further funding towards Therapy services for the patient, and Patients will have to revert to privately self-funding the therapy to continue Therapeutic services offered or started.

Further information about how Teenage Mental Health Ltd collects, stores, uses and protects personal information can be found within our Privacy Notice, available on our website.