Privacy Policy

1. Who we are / Data Controller

Durham & Darlington Talking Therapies is an NHS talking therapies service providing assessment and treatment for people experiencing common mental health difficulties.
The service operates as part of an NHS Foundation Trust and is responsible for deciding how your personal information is collected, stored and used. For the purposes of data protection legislation we act as the Data Controller.

2. What information we collect

We collect information that is necessary to provide safe, effective and timely care. This includes basic contact information, information about your health and treatment, and limited technical information when you use our website.

Types of information

• Identity & contact details: name, address, postcode, telephone number, email address, date of birth, gender and where available your NHS number.
• Referrer & professional information: details from your GP, other clinicians or organisations involved in your referral.
• Health / clinical information (special category): clinical assessments, mental health questionnaires, risk assessments, therapy notes, treatment plans, outcome measures and correspondence relating to your care.
• Administrative information: appointment records, attendance, communications and consent records (for example consent to share information or to be contacted by text/email).
• Technical information: IP address, pages visited and session times collected by website logs or cookies when you use this website, where applicable.

We only collect the minimum information necessary to provide care and to comply with our legal and regulatory responsibilities.

3. How we collect your information

We collect information in three main ways:

• Directly from you — when you self-refer, register for an appointment, complete online forms, take part in assessments, or otherwise communicate with the service.
• From other health professionals — for example your GP or another clinician who refers you into our service.
• Automatically — limited technical information may be collected when you visit our website (for example analytics or cookies) to help us understand and improve the site.

4. Why we collect and use your data

Your information is used so we can plan and deliver appropriate healthcare and support. We rely on a combination of legal bases to process personal data, depending on the circumstances and the nature of the information.

Legal bases for processing

• Provision of healthcare and treatment: processing is necessary for the delivery of NHS care and treatment.
• Legal obligations: to meet statutory duties such as record-keeping and safeguarding responsibilities.
• Public interest: for service monitoring, audit, evaluation and public health purposes where required.
• Consent: where we ask for your explicit consent (for example, where required for research, feedback or training recordings) you may withdraw that consent at any time.

We use personal data to:

• Provide, manage and coordinate your care and treatment.
• Assess and record your clinical needs and outcomes.
• Contact you about appointments, referrals and service changes.
• Monitor and improve the quality of the service through audits and service evaluation.
• Meet our legal and statutory obligations.

5. Who we share your information with

We only share personal information where there is a legitimate reason to do so and where sharing is permitted by law. We will take care to only share the minimum information required for the purpose.

Examples of organisations we may share with

• NHS Digital and other national bodies: where required for reporting and monitoring purposes – this is usually anonymised or pseudonymised where possible.
• Your GP and other clinical teams: to ensure coordinated care and to make sure anyone involved in your care has the relevant information.
• Local integrated care records and multi-agency teams: where this supports your care and you have consented or there is a lawful basis to share.
• Partner organisations: for example third-sector organisations or employment support services, but only with your consent unless there is another lawful reason to share.
• Legal or safeguarding organisations: when required by law, court order or to protect the safety of an individual.

We do not sell personal information to commercial organisations.

6. How long we retain your data

We retain personal and clinical records in line with NHS record retention guidance and the Records Management Code of Practice for Health and Social Care. Retention periods may vary depending on the type of record, statutory requirements and clinical need.

When information is no longer required it will be disposed of securely in a way that protects your confidentiality.

7. How we keep your data secure

We take the security of personal information seriously and have measures in place to protect it against unauthorised access, loss or misuse.
These measures include secure NHS systems for storing records, access controls to limit who can see your information, staff training on confidentiality and data protection, and secure methods for transferring information where necessary.

If we ever need to store or process your data outside of the UK we will tell you where this applies and the safeguards in place.

8. Cookies and website analytics

Our website may use cookies and analytics tools to monitor how visitors use the site and to help us improve its design and content. Cookies are small text files stored in your browser. The cookies we use are limited to:

• Essential cookies: required for basic site functionality.
• Analytical cookies: to gather non-identifying information about site usage (for example pages visited and session length).

These analytics do not collect clinical or identifying personal health information. You can control cookies through your browser settings; please be aware that disabling certain cookies may affect how parts of the site work.

9. Your rights under GDPR and UK law

You have a number of rights in relation to your personal information. These rights are subject to certain conditions and exemptions (particularly for health records where there are legal or clinical reasons to retain information).

Your main rights

• Access: you can request a copy of the personal information we hold about you (a subject access request).
• Rectification: ask us to correct information that is inaccurate or incomplete.
• Erasure: request deletion of your personal data in some circumstances (this may be limited for clinical records).
• Restriction: ask us to restrict how we process your data temporarily.
• Portability: request a machine-readable copy of certain personal data you have provided.
• Object: object to processing based on public interest or direct marketing, where applicable.
• Withdraw consent: where we process data on the basis of consent you may withdraw that consent (this will not affect processing already carried out).

To exercise any of these rights, please contact the service using the contact details above. We will respond in line with legal timeframes and explain any reasons where a request cannot be fulfilled in full.

10. Complaints & contact details

If you have a complaint about how we handle your information, please contact the Data Protection Officer or the service contact above so we can investigate and respond promptly. If you remain unhappy, you have the right to escalate the matter to the Information Commissioner’s Office (ICO).

Contact details

11. Changes to this policy

We keep this privacy policy under review and will update it when necessary. Any changes will be published on this page with a revised date. We recommend checking this page periodically to stay informed about how we protect and use your information.