Live Well service privacy notice
About this notice
Our core data protection obligations and commitments are set out in the council's primary privacy notice.
This notice provides additional privacy information for all referrals (including self-referrals) into the Live Well services that are seeking help and guidance with lifestyle-related behaviour change.
The Live Well Service is a combined service of two previously distinct services known as Lifestyle Service and Bury Exercise and Therapy Scheme (BEATS).
With your consent, we collect your personal information for the following purpose(s):
- To keep a record of your progress during the referral process
- To keep a record of any previous interactions with the service
- To determine local clinics and classes within your area
- To report on anonymised statistics for both local and national measurements
- To drive strategic and budgetary decisions
- To provide effective targeted information, advice, guidance, and support that is relevant to you.
Categories of personal data
In order to carry out these purposes we collect and obtain:
- Contact details (name, address, telephone/mobile number, and email)
- Date of birth
- We may also collect information relating to health-related conditions and other relevant medical issues regarding reason for referral*
*The types of data, which have an asterisk (*) next to them, are classed as special category data under the UK General Data Protection Regulation because it is sensitive information and therefore will be protected at a higher level to safeguard your confidentiality and privacy.
Legal basis for processing
We collect information under Article 6 of the UK General Data Protection Regulations (UK GDPR) enabling us to effectively support you throughout your Wellness journey.
The lawful basis for processing your personal information is:
(a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
(b) necessary for the performance of an agreement to which the data controller (us) is party to take steps at the request of the data subject (you) prior to entering into a contract;
(c) necessary for compliance with a legal obligation to which the data controller (us) is subject;
(d) necessary in order to protect the vital interests of the data subject (you);
(e) necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (us);
(f) necessary for the purposes of the legitimate interests pursued by a data controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.
These conditions are all equally valid and organisations should assess which of these grounds are most appropriate for different processing activities and then fulfil any further requirements the UK GDPR sets out for these conditions (UK GDPR Article 5).
The UK GDPR defines Consent in Article 4(11) as:
'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her[.]
All client information will be stored on a secure NHS approved database with up-to-date facilities for the secure transmission and storage of data. This database is fully NHS data-standard compliant and is also ISO accredited.
To opt out of electronic marketing information about our services, you may withdraw your consent at any time by contacting us.
Statutory or contractual consequences of information not provided
By not providing certain information when requested, we may be prevented from providing our full range of range of services and support to you.
We may share personal information about you with the following types of organisations:
- Live Well Services e.g. Lifestyle Services, BEATS etc.
- Gym Instructors within Bury Leisure Services (only where applicable and with explicit consent)
- Externally (only where applicable and with explicit consent):
- NHS e.g. GP Practices, Physiotherapy, Midwives/Health Visitors (this list is not exhaustive)
- Integrated Neighbourhood Teams
With your consent, we may share information with these organisations to facilitate your post-referral journey or to sign post you to other appropriate services.
Data retention / criteria
We will keep identifiable information for a maximum of 5 years, after this time your data will be anonymised and subsequently deleted after 7 years.
Deleted data retention period
In line with ISO27001 and NHS standards please note that due to backup archives being held any data which is deleted or anonymised today will not be removed from FMC backup archives until the full backup cycle is completed (a total of two years).
Rights of individuals
Information about the following is accessible in our guide to exercising your rights:
- exercising your rights
- contacting our Data Protection Officer
- raising a concern with us, or
- making a complaint to the Information Commissioner