Access to Work Mental Health Support Service Privacy Notice

Ingeus UK are the lead partner in the Able Futures partnership, which delivers the Access to Work Mental Health Support Service.

Ingeus UK are fully committed to ensuring that we are transparent about how we process your personal information. The ‘processing’ of your personal information includes the collection, recording, storing, changing, sharing, general use, or destruction of your information

This Privacy Notice describes what data we collect, why we collect it, how we use it, how we keep it secure, and the conditions under which we share it. It also outlines you rights under the General Data Protection Regulation and Data Protection Act 2018.

This Notice may be updated periodically, in line with changes to our processing activities or legislative changes. All changes will be published on our website.

What is the Access to Work Mental Health Support Programme?

The Access to Work Mental Health Support programme (AtW MHSS) is delivered through the Access to Work programme – a Jobcentre Plus discretionary grant scheme, and is an essential element of the Department for Works and Pension’s (DWP) support to individuals with a mental health condition, to stay in work, or to move to more suitable work. The AtW MHSS programme provides support by assisting individuals to overcome work related obstacles.

The AtW MHSS also offers advice and guidance to employers on how best to support employees with a mental health condition or issue, and help resolve practical and organisational factors related to the work environment.

Who are we?

Ingeus UK Ltd is a company incorporated in England, registered at Companies House (04320853). In partnership with our Delivery Partners we deliver the AtW MHSSProgramme on behalf of the DWP. Our Delivery Partners are:

• Health 2 Employment (i2i),
• Case UK,
• Salus, and
• The Better Health Generation.

We collect and use information obtained from yourself or from an Access to Work referral, in order to provide the services described above.

By collecting information from you, Ingeus UK and our Delivery Partners can better identify your individual needs and how best to support you on the programme.

For the purposes of processing your data:

• Ingeus UK Ltd and the DWP are Data Controller/Joint Data Controller/Data Processor for the processing of your personal data in relation to the Access to Work MHSS programme.
• Ingeus is the Data Controller for any Health data that you provide directly to us.

What personal information do we process?

• Name, date of birth, contact details, gender, family circumstances
• National Insurance Number
• Health information
• Information regarding your employment

How we use your information

Ingeus UK Ltd process your information in order to provide you with the best possible support whilst on the programme, and to meet the requirements of our contracts and other legal obligations. We cannot process your information without having a valid, lawful reason for doing so. Key reasons for processing your information are described below, further details about the organisations we share with and the legal basis for processing can be found here.

• In order to start you on the programme and arrange your first appointment we will receive from Access to Work information including name, occupation, date of birth, National Insurance number, contact details and further information about your health and wellbeing.
• During your initial meeting you will be asked questions that allow your Vocational Rehabilitation Consultant (VRC) to assess the level of support you require. Your VRC will make some notes about how you are doing while you are on the programme and what has been discussed during your appointments.
• Some of this information may be shared with others, such as your GP, but with your consent.
• We also have to pass on information to the DWP where our contract with the DWP requires this.

Sharing your Personal Information

The aim of this programme is to help you to remain in work or to move to more suitable employment. During your meetings, your VRC may feel that your GP/Health Practitioner, may not have the full picture about your condition, and may want to write to them so that they are better equipped with information to provide you with the support you need. With your consent, the VRC might contact your employer to discuss the obstacles you are experiencing, and provide guidance to them as to how they can support you.

Routine Sharing

We routinely share your personal data with the following organisations to update them on your progress, including whether you have completed the programme, achieved any key milestones or left early, or to provide additional support to you.

• Department of Work and Pensions – Ingeus UK will share information with the DWP who have commissioned the AtW programme. Our contract with the DWP stipulates what information is to be shared, the manner in which it is to be shared and the information security requirements that must be adhered to.
• Direct Delivery Partners – Your information may be shared with an organisation that is contracted to deliver the program on our behalf in your area. In order to share this information, we have legal contracts in place with those organisations, which state how your personal information is to be securely processed.

Other Ad-Hoc Sharing

• Fraud detection and prevention - In certain circumstances we may be legally required to share personal information with other organisations, such as the HRMC or law enforcement agencies for the detection and prevention of crime and fraud
• Emergency Services - We may contact the emergency services or your GP to assist you or to provide emergency response management support in high-risk situations. Where possible this will be carried out with your consent. However your consent may be overridden where we believe you are a danger to yourself or others

Ingeus UK cannot process your information without having a valid, lawful reason for doing so. For further details about the organisations we share with and the legal basis we have for sharing this data please click here.

Research and evaluation

Ingeus UK pride ourselves on continuously improving the services provided to you and others. We identify areas for improvement by conducting research and evaluating the effectiveness of our existing services. One way in which we do this is to convert your personal data into statistical or aggregated data, which is then used to produce statistical research and reports. This information is sometimes shared with the DWP and other research organisations, however, it cannot be used to identify you.

We sometimes commission other organisations to carry out research on our behalf. Where your personal data can be identified or we would like you to provide additional information, via focus groups or feedback forms, we will always ask your permission first.

Consent

Where we need your agreement to process your information, for example, contacting your employer, we will ask you to give your consent first. We will explain why your consent is needed and the information that we will share. This information will be provided verbally or or in written form. Where consent is given by you, this will be recorded on our systems for tracking and audit purposes.

Right to Withdraw Consent

Where you have consented for us to share your information, for example, with your GP or Employer, you have the right to withdraw your consent at any time. Should you wish to withdraw your consent, please speak to your VRC who will update our records.

Out of hours Service

Ingeus UK understand that it isn’t always convenient to arrange or cancel appointments during work hours. As such we provide an out of hours service, which you can contact for general advice, to cancel your appointment or to re-schedule. This service will be manned by Ingeus UK staff, as well as our Delivery Partners’ staff. All staff manning the out of hours service can gain access to your information with your permission, so that they can assist you in cancelling/rescheduling your appointments, or provide you with other information you may need. If the VRC on duty that day is not the one assigned to you, they will require your verbal consent to access your records. If you don’t feel comfortable with a VRC other than your own accessing your records, then the VRC will take a note for your own VRC to contact you to assist you with your query.

Protecting your information

1. UK is committed to protecting the confidentiality and security of your information, ensuring that your information is processed lawfully and respectfully, in accordance with data protection laws and information security standards, for example, the General Data Protection Regulation (GDPR), Data Protection Act 2018 and ISO27001 (an information security standard). We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

All Ingeus UK staff must complete mandatory data protection and information security training to ensure they understand their responsibilities in relation to processing your personal information. Internal and external audits are also undertaken to ensure that data protection laws are being complied with.

Keeping your information

Ingeus UK and our Delivery Partners are required to retain your information as part of our contractual and legal obligations. We will not retain your information for any longer than is necessary. Where we are no longer required to keep your information, it will be safely and securely destroyed.

The following table provides you with information on how long we keep your information.

Your Individual Rights

The GDPR grants you certain rights in regards to your personal information, and the way in which it is processed. This gives you more control over what organisations are doing with your information. These rights are:

• To be informed
• To access personal data
• To correct/ erase personal data
• To restrict how we use personal data
• To object to how we use personal information
• To ask us to transfer personal data to another organisation
• To object to automated decision making including profiling
• To understand how we protect information transferred outside of the European Economic Area

To find out more about how we use personal data we may ask you to prove your identity whenever you make a request to exercise any of these rights. We do this to ensure we only disclose information where we know we are dealing with the right individual.

We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.

The right to be informed

Ingeus UK Ltd is committed to ensuring that you are always aware of what we are doing with your information and are kept abreast of any changes to the processing of your information. We do so through this Privacy Notice, which is reviewed and updated as and when required.

The right of access

You have the right to ask for the personal information we hold about you. This is known as a Subject Access Request. While we will do our best to comply with your request, we may not be able to fulfil your request, for example, where information we hold has been provided to us in confidence.

When requesting your personal information you will need to include the following information:

• your full name, address and contact telephone number;
• any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique ID's etc);
• details of the specific information you require and any relevant dates

The right to rectification

We endeavour to ensure that the information we hold about you is always accurate. however, there may be instances where the information we hold is no longer up to date. You can ask us to rectify any information about you that is incorrect, but we may need to verify the accuracy of the information first. Please speak to your VRC so that any inaccuracies can be investigated and corrected where necessary.

The right to erasure

You may request that certain personal information be erased from our systems if you feel that there is an underlying legal basis for this, or, where you withdraw consent.

We will not always be able to comply with your request, as there may be a legal reason that we have to keep your information. As such, each request is considered on a case-by-case basis.

The right to object to how we use personal information

You may object to us processing your personal information for the following reasons:

• direct marketing,
• scientific/historical research and statistics,
• legitimate interests and processing in regards to the performance of a public interest or official authority task.

We will not always be able to comply with your request, such as were we have conflicting, overriding legal obligations. Each request is considered on a case-by-case basis.

The right to restrict processing

You may ask us to ‘restrict’ the processing of your personal information, for example, if you object to the processing of your information, or make a complaint and we are required to investigate We can continue to use your personal data following a request for restriction where we need to use it to establish, exercise or defend legal claims, or we need to use it to protect the rights of another individual or the company.

The right to data transfer to another organisation (portability)

You may ask us to provide you with a copy of the personal information that you have provided to us, and which we process electronically. The data must be provided in a ‘commonly used and machine-readable format, such as a csv file, that allows you to move, copy or transfer your data from one IT environment to another. This allows you to further use the data and to move between service providers without any loss of data.

Please note that we will not always be able to comply your request, for example, when we are legally obligated to process your data As such, each request is considered on a case-by-case basis.

The right to object to automated decision making including profiling

We do not carry out any automated decision making or profiling.

Transfers outside of the European Economic Area (EEA)

We do not transfer any of your data outside of the EEA.

Exercising your rights

If you wish to exercise any of the above rights please email or write to:

The Data Protection Officer

Ingeus, 66-68 East Smithfield, Royal Pharmaceutical Building, London, E1W 1AW

DataProtectionOfficer@ingeus.co.uk

Ensure that you let us have enough information to identify you, e.g.name, address, date of birth, your adviser’s details and let us know the information which you request relates to.

Contact Us

Please contact our Data Protection Officer if you have any questions about this privacy notice or the information we hold about you.

If you have any concerns about in the way that your information is being processed, or feel your information is not being used appropriately, please raise your concerns with the Data Protection Officer, explaining what your specific concerns are. The Data Protection Officer will then investigate your concerns you have raised.

If you remain unsatisfied after the investigation by the Data Protection Officer and their response to you, you may raise a concern with the Information Commissioner