Privacy Notice and Consent
The privacy and the security of your personal information will be extremely important to you should you decide to participate in the Healing Process.
This notice sets out how your personal information will be collected during the Healing Process, what will be done with your personal information and what will be done to keep it secure. It also explains your rights over the personal information that will be held about you. This Privacy Notice may also be used in conjunction with other privacy notices that you may be provided with in certain situations.
This policy relates to the overall Healing Process and all stages within that process. It applies to all of those individuals who access the Healing Process (including ex-employees and current employees of NHS Highland and those classed as Expanded Scope Individuals) and who may or may not become clients of CMP and Validium as part of this process. It also applies to any individuals who act as a representative, companion or witness for any participant at any stage of the Healing Process.
If you have any questions regarding this notice, please contact us on firstname.lastname@example.org.
Who will collect your personal information / who may your personal information be shared with?
When you enter the Healing Process, your personal information will be collected by Conflict Management Plus Limited (CMP). At this initial stage, CMP will act as a data controller of your personal information. This means that CMP will be responsible for deciding how your personal information in used and held. CMP’s privacy notice is available at https://www.cmpsolutions.com/privacy/.
As you progress through the Healing Process, personal information may be collected by or shared with different entities depending on your path through the process. These entities may include:
- The Independent Review Panel;
- Validium Group Limited; or
- NHS Highland.
Each of these organisations may also act as a data controllerduring the Healing Process but only for the relevant parts of the process that relates to them. Further information on this is provided below.
If your engagement with the Healing Process results in access to the Independent Review Panel, then your personal information shall be processed in accordance with this privacy notice.
If your engagement with the Healing Process results in a referral to Validium, then Validium will have its own privacy notice which will relate to the processing of your personal information by Validium. Validium’s privacy notice is available at https://www.validium.com/privacy/.
If your engagement with the Healing Process results in actions being required of NHS Highland, then NHS Highland will have its own privacy notice which will relate to the processing of your personal data by NHS Highland. NHS Highland’s privacy notice is available at https://www.nhshighland.scot.nhs.uk/Pages/YourRights.aspx.
Your personal information may also be held by third party service providers, for example, for the provision of secure document storage services.
What personal information will be collected?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
As part of the Healing Process, different kinds of personal information about you may be collected, used, stored and transferred. What information is collected will depend on your engagement with the Healing Process and what information you provide through any forms you complete, meetings you attend, the supporting information your submit or through correspondence relating to the Healing Process. Information may also be obtained if any representative, companion or witness who accompanies you to any stage of the Healing Process provides such information.
What information is collected will depend on the information that you provide as part of the Healing Process but may include:
- Identity Data including name, gender, date of birth, occupation, details of dependants and family members, information about any representative, companion or witness accompanying you at any stage of the process, whether you are a current or previous employee or an Expanded Scope Individual;
- Contact Data including home address, email address, phone numbers;
- Financial Data including bank account details or details about payments made to you;
- Process Data any information relating to your participation in the process including your summary statement, preferences on outcomes and the final outcomes relating to you, and information provided about your experiences and the impact that those experiences had on you.
Special category information
During the Healing Process, special category personal information may be collected, stored and used if you provide this information as part of the Healing Process. Such information may relate to your health, including any medical conditions or disabilities.
How will your personal information be used?
This Privacy Notice has been organised by Processing Activity, to enable you to easily access details specifically relating to the use of your data.
The first stage of the Healing Process will be a confidential individual session with CMP Resolutions. During this stage, your personal information will be used for the purposes of:
- providing services to you or the individual who you are accompanying as a companion during the session;
- supporting you in the preparation of a statement that can be used throughout the Healing Process;
- supporting you and allowing you to register your intentions to pursue any one or more pathways;
- conducting an eligibility check for your engagement in the Healing Process;
- contacting you about arranging your session and subsequent to your session to discuss what decision you may have reached on next steps;
- if you select a certain pathway thought the Healing Process, making an onwards referral and passing on relevant information to ensure that the next steps of the Healing Process can be organised;
- replying to communications from you;
- complying with its legal obligations; and
- any further purposes set out in CMP Resolutions Privacy Notice.
The content of the session is confidential between you and CMP Resolutions unless you decide to share it. However, you will need to share some details in order to move through the Healing Process.
The pathways that can be accessed following this session are:
- No further action;
- Apology from NHS Highland;
- Referral to assessment for Psychological Therapies; and
- Referral to Independent Review Panel (IRP).
No further action
If you decide that following your initial session you do not wish to continue to participate in the Healing Process, you may do so. Your personal information may be used for the purposes of contacting your to confirm your choice and responding to any communications from you.
Apology from NHS Highland
Personal information may be passed to NHS Highland in order for NHS Highland to issue you with an apology for your experiences. You can agree with CMP Resolutions what aspects of your statement and other information discussed with CMP Resolutions you are prepared to have shared with NHS Highland. Your personal information will be used for the purposes of NHS Highland preparing any apology and communicating with you relating to this apology. You information may also be used for further purposes set out in NHS Highland’s Privacy Notice.
If you want to be referred for psychological therapy, you may be referred by CMP Resolutions to Validium. Validium will be provided with your basic details and, if you consent, your statement, so that you can be contacted by Validium. Your personal information will be used in order to provide you with psychological therapy, contact you, reply to communications from you; complying with its legal obligations; and any further purposes set out in Validium’s Privacy Notice.
Independent Review Panel
If you wish to be referred to the Independent Review Panel, your personal information may be used to:
- arrange and hold your meeting;
- respond to any communications from you;
- consider any information provided by you to the Independent Review Panel;
- assess what recommendation the Independent Review Panel considers appropriate in the circumstances;
- make its recommendation and notify you and the relevant body of its recommendation; and
- carry out that recommendation in accordance with the Healing Process guidelines.
Your information may be shared with the appropriate body for the purposes of them carrying out the recommendation of the Independent Review Panel. If a financial payment is recommended this recommendation would be sent to the Chief Executive of NHS Highland for consideration. In line with the delegated authority of the NHS Highland Remuneration Committee. Recommendations will be considered by the Remuneration Committee and reported to the Private Session of the Board on an anonymous basis. Certain identifiable information will need to be processed on a need-to-know basis for the purposes of making any payment. In addition, information will be shared with Scottish Government as appropriate.
It is also the case that the Private Session of the Board will be supplied with anonymous data on the following: Total number of staff registering with the process; job family; number of staff opting for each option (which will include anyone choosing more than one option); number of financial recommendations made in total; by case number individual recommendations for payment and amount involved as described above.
What is the legal basis for using your information?
The information that is collected about you will only be used lawfully. At every point in the process there will be compliance with the regulatory and legal obligations to comply with relevant legislation for processing data.
The majority of information collected during the Healing Process will be information provided by you. Therefore, processing of your personal information will primarily be conducted on the basis of your consent. It is your decision what information you wish to disclose as part of the Healing Process. You can withdraw that consent at any time however this may mean that certain information cannot be considered as part of the Healing Process.
The following have been identified as additional lawful bases for the use of your data within the Healing Process:
- The ‘legitimate interest’ of the parties and those involved in the services provided in the operation of the Healing Process
- Compliance with required ‘legal obligations’
- Where relevant, to ensure the performance of a ‘contract’ between yourself as an individual with CMP, Validium and NHS Highland.
Where special categories of personal information are collected, for example, information about your health, this will be done on the basis of your consent. However, sometimes, there may be reasons that allow for this information to be used without consent, for example, in order to provide you with health care or in the establishment, exercise or defence of legal claims.
Data storage / retention
Your personal data will be subject to appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, access to your personal data will be limited to those who need to know this for the purposes of the applicable stage of the Healing Process.
Your personal data will only be held for as long as is necessary to fulfil the purposes that it was collected from you as set out in this notice or any other privacy notice provided to you. Certain information may need to be held for a specified period of time following you participation in the Healing Process, for example, how you were referred or the outcome you obtained.
To determine the appropriate retention period for personal data, the following factors will be taken into account: the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which your personal data is processed and whether these purposes can be achieved through other means. In addition, if appropriate consideration will need to be given as to the period of the retention of your data in line with any Scottish Government guidance on the retention of personal data where it is appropriate to do so.
International transfers of personal data
All data is retained within the United Kingdom and transferred only if adequate protection has been confirmed.
The Data Protection Act provides the following rights for individuals:
- The right to be informed: You have the right to be informed. There will be a direct communication with you within which you will be informed of the reason for processing your data. This will be within the details provided to all individuals who decide to access the “Healing Process” or via clear and accessible privacy notices. CMP, Validium and NHS Highland Privacy Notices will be able to be viewed on their websites details of which are contained in the “Who will collect your personal information” section of this notice.
- The right of access: You have the right to access the personal information that we hold about you in many circumstances. This is sometimes called a ‘Subject Access Request’.
- The right to rectification: If any of the personal information we hold about you is inaccurate or incomplete you have the right to have this corrected.
- The right to erasure: You have the right to erasure, also known as ‘the right to be forgotten’. You can request the deletion or removal of your personal data where there is no compelling reason for its continued processing. Note, however, that we may not always be able to comply with your erasure request for specific legal reasons.
- The right to object: You have the right to object to the processing of your personal data in certain circumstances such as when processing is based on legitimate interests, or for direct marketing (including profiling).
- The right to restrict processing: You have the right to ask us to suspend the processing of your personal data in some instances. When processing is restricted, we are permitted to store your personal data, but not further process it.
- The right to data portability (request to transfer): You have the right to receive the personal data which you have provided in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance where technically feasible.
- Rights in relation to automated decision making and profiling: This is not applicable within the “Healing Process”.
If you would like to exercise your rights as set out above or have any concerns or questions regarding this notice, or the way your personal information is processed, please get in touch with your contact at the entity about which you are concerned.
If you are unhappy with the handling of your personal data you have the right to register a complaint the ICO, who are the UK’s supervisory authority for data protection: www.ico.org.uk/concerns
As part of the Healing Process, your personal information will need to be processed in accordance with the Healing Process Privacy Notice.
You will be asked at the 1:1 session with CMP to confirm that you are happy to participate in the Healing Process and for your personal information to be used as set out in the Privacy Notice. You will then be sent confirmation in writing of your agreement.
At all times you will have the ability to withdraw from the Healing Process or withdraw your permission for your personal information to be processed in the Healing Process (other than as required by law or set out in the Privacy Notice). However, you should be aware that if you refuse or withdraw permission for your information to be processed as part of the Healing Process, you may be unable to move forward with the Healing Process or the options available to you through the Healing Process may be restricted.