Privacy Notice Statement

What Personal Information We Collect

​

The information we collect depends on the service you are accessing. This may include: 
• Name, address, date of birth and contact details 
• Emergency contact information 
• Health information relevant to exercise, wellbeing or counselling services 
• Food allergies and intolerances 
• Accessibility requirements, disabilities or health conditions 
• Information relating to children and young people accessing our services 
• Payment information for paid services 
• Attendance records and feedback forms 
• Photographs or videos where consent has been provided 
 
Health information is considered special category data and is handled with additional safeguards. 

​

Children's Information

​

Some Healthbox CIC services are provided to children and young people. Where appropriate, we collect and process information about children to deliver services safely and effectively. Where consent is required, this will be obtained from a parent, guardian or the young person themselves, depending on age and circumstances. 

 

Why We Use Your Information 
 
We use personal information to: 
• Deliver services safely and effectively 
• Provide personalised support 
• Meet safeguarding responsibilities 
• Report outcomes to funders and commissioners 
• Contact you about appointments, services or activities 
• Use photographs, testimonials or case studies where consent has been provided 
 
We will always have a lawful basis for processing your information in line with UK GDPR and Data Protection legislation. 

 

Data Controller and Data Processor 
 
Depending on the service you access, Healthbox CIC may act as either a Data Controller or a Data Processor. 
 
When we are the Data Controller, we decide what information is collected, why it is collected and how it is used. 
 
When we provide services on behalf of organisations such as NHS bodies, GP practices or local authorities, those organisations may be the Data Controller and Healthbox CIC acts as a Data Processor, handling information only in line with their instructions and legal requirements. 
 
Regardless of our role, we are committed to handling your information lawfully, fairly, securely and with respect for your privacy. 

 

Sharing Information 
 
Information sharing depends on the service being provided. We may share information with NHS organisations, GP practices, local authorities, safeguarding agencies or community organisations where there is a lawful basis to do so. 
 
Where appropriate, we will ask for your consent before sharing information. We may also share information without consent where required by law or where there are safeguarding concerns. 

 

Keeping Information Safe 
 
We use a range of organisational and technical measures to protect personal information, including: 
• Staff training and internal audits 
• Secure IT systems and device management 
• Multi-factor authentication and email security 
• Access controls based on staff roles 
• Data protection by design for new projects and services 
• Cyber security and business continuity arrangements 
• Annual completion of the NHS Data Security and Protection Toolkit 
 
While no system can ever be completely secure, Healthbox CIC continually reviews its processes, systems and security measures to reduce risks and protect personal information. 

 

Website Cookies and Analytics 
 
Our website uses cookies to help it function properly and to understand how visitors use the site. 
 
We use analytics information to: 
• Understand how visitors use the website 
• Improve website content and performance 
• Provide a better user experience 
 
Analytics cookies are not used for targeted advertising and we do not sell personal information to third parties. 
 
You can accept or decline non-essential cookies through our website cookie banner and adjust cookie settings through your browser at any time. 

 

Contact and Enquiry Forms 
 
If you complete a form on our website, we may collect your name, email address, telephone number and details of your enquiry. 
 
We use this information to respond to your enquiry and provide information or support that you have requested. 

 

How Long We Keep Information 
 
We only keep personal information for as long as necessary to provide services, meet legal obligations, fulfil funding requirements, respond to complaints or protect individuals' safety. 
 
Examples include: 
• Counselling records – 7 years 
• Community project records – normally 2 years after project completion 
• Staff employment records – 6 years after employment ends 
• Financial records – 6 years 
 
Full retention schedules are available on request. 

 

 

Your Rights 
 
You have the right to: 
• Access your personal information 
• Request correction of inaccurate information 
• Request deletion where applicable 
• Restrict processing in certain circumstances 
• Object to certain types of processing 
• Request data portability 
• Withdraw consent where consent is the lawful basis 
 
We may ask for proof of identity before releasing personal information and will normally respond within one month. 

 

Marketing Communications 
 
We may contact you about services you are receiving, appointment changes or service updates. 
 
We will never sell or pass your contact details to third parties for marketing purposes. 
 
You can opt out of non-essential communications at any time by contacting info@healthboxcic.com

 

How to Raise a Concern 
 
If you have any questions about how we use your information, please contact us: 
 
Email: info@healthboxcic.com 
Telephone: 0151 355 0205
 
If you are unhappy with how we have handled your information, you can contact the Information Commissioner's Office (ICO): 
 
ICO Helpline: 0303 123 1113 

​