Malvern Hills Wellbeing Hub CICPrivacy and Data Protection PolicyLast updated: 1 November 2026Organisation: Malvern Hills Wellbeing Hub CICCompany Registration Number: 16434305ICO Registration Number: C1773131Registered Address: 21 Hoopers Close, Leigh Sinton, Malvern, WR13 5BZWebsite:www.malvernhillswellbeinghub.netPrivacy and Data Protection PolicyMalvern Hills Wellbeing Hub CIC | Updated: 1 November 2026Company registration: 16434305 | ICO registration: C1773131Registered address: 21 Hoopers Close, Leigh Sinton, Malvern, WR13 5BZWebsite: www.malvernhillswellbeinghub.net | Privacy contact: MHWH@Malvernhillswellbeinghub.net1. Our Commitment to PrivacyMalvern Hills Wellbeing Hub CIC (MHWH) provides affordable, accessible counselling and wellbeing support in the Malvern Hills area. We are committed to confidentiality and to handling personal information securely, in accordance with UK GDPR, the Data Protection Act 2018 and applicable law. This notice explains our handling of information and your rights.2. What Information We CollectWe may collect the following information when you contact us or use our services:Name and contact details, including postcode or address where needed.Information supplied in self-referrals or professional referrals, including relevant wellbeing and support needs.Appointment, attendance, waiting-list and concession or payment information.Information necessary for safeguarding, service administration and evaluation.We seek to collect only what is needed and do not require detailed personal histories through our initial online forms.3. How We Use Your InformationWe use information to receive referrals, maintain a waiting list, contact applicants, arrange counselling, administer appointments and payments, and manage safeguarding. Qualified counsellors select prospective clients from the Cliniko waiting list based on availability and appropriate service considerations, then undertake their own initial counselling assessments. If counselling is unsuitable, they report the relevant administrative outcome to MHWH, without routinely sharing detailed assessment or session notes. We retain limited information to contact and offer reassignment to clients if their counsellor becomes ill, dies or is otherwise unavailable, and to administer our policy that clients do not normally return for another course within six months. We may share anonymised service statistics with funders, not identifiable counselling notes.4. Our Legal Basis for Processing InformationFor necessary service administration, we rely on applicable Article 6 lawful bases, which may include steps requested by a prospective client, performance of a service agreement, legitimate interests in managing referrals, continuity and the six-month return policy (subject to balancing individuals’ rights), and legal obligations where relevant. The basis used depends on the specific processing activity.Health and wellbeing information may be special category data. Where we process it, an additional Article 9 condition is required. Depending on the activity and applicable safeguards, this may include health or social care (Article 9(2)(h)), legal claims (Article 9(2)(f)), or another relevant condition. We must confirm and document the applicable Article 9 condition and any Data Protection Act 2018 requirements for each activity; an Article 6 legitimate interest alone does not authorise processing health information.5. Online Referrals and WixOur website uses Wix for self-referrals and professional referrals. Forms have been simplified to request information needed for initial assessment. Submissions are accessible to authorised personnel. Notification emails do not contain completed referral answers or PDF copies.An authorised MHWH administrator reviews referrals and transfers relevant information to Cliniko. Copies in Wix are removed once no longer needed, according to our deletion arrangements.6. Cliniko and Administrative RecordsMHWH uses Cliniko for referral administration, waiting lists, appointments and client records. Clients are allocated a unique reference code where practicable. Access is limited to authorised individuals for their assigned duties. Counsellors may consult the minimum waiting-list details needed to assess whether their available appointment times and service capacity fit a prospective client; they must not browse other client records out of curiosity or access detailed information unrelated to their work. Once a client is allocated, the counsellor may access the referral information necessary to carry out their assessment. Directors and administrators access records only where necessary for referral management, continuity, safeguarding, complaints or other authorised purposes.7. Confidential Counselling NotesCounselling is delivered by self-employed counsellors, each individually registered with the ICO. They keep their own confidential session notes separately from MHWH administrative records. MHWH does not routinely hold or access these notes.Each counsellor is responsible for appropriate security, retention and disposal of their notes in accordance with their legal and professional obligations. Where a counsellor independently determines the purposes and means of processing their notes, they act as an independent data controller for those records.8. Confidentiality and Information SharingWe receive referrals from healthcare and social prescribing services, neighbourhood mental health services, Citizens Advice, WorkWell, Platform Housing and other appropriate organisations. We may share necessary referral or contact information with an allocated counsellor to arrange support.We do not routinely share counselling notes with referring organisations or funders. Other disclosures are limited to what is necessary and lawful, including safeguarding and legal requirements.9. Safeguarding and Limits to ConfidentialityInformation may need to be disclosed when necessary to protect a child, an adult at risk, the client or another person from serious harm, or when disclosure is required by law. Concerns are handled under MHWH safeguarding procedures. Where safe and appropriate, we will explain a disclosure to the person concerned.10. How Long We Keep InformationMHWH archives clients in Cliniko when counselling ends or when they stop responding after reasonable attempts to contact them. We review routine referral and administrative records 12 months after the last contact or completed session (not simply 12 months after archiving). We delete or minimise information no longer needed. A limited record may be necessary to check eligibility under our six-month return policy and to maintain continuity if a counsellor becomes ill, dies or is otherwise unable to continue.We may retain relevant records beyond the routine 12-month review where reasonably necessary for safeguarding, complaints, incidents, potential legal claims or insurance matters. Each exception must be justified, restricted and reviewed, rather than kept indefinitely. Financial records may have separate statutory retention requirements. Copies of referral submissions in Wix are removed once transferred to Cliniko and no longer required. Self-employed counsellors manage retention and secure disposal of their own confidential notes.11. How We Protect Your InformationWe use restricted access, two-step verification for Wix, Cliniko and Google Workspace, confidentiality and access agreements, secure information-sharing arrangements, retention reviews and procedures for responding to incidents. Personnel with Cliniko access must only view records necessary for their responsibilities. Access rights are reviewed as roles change.12. External Service ProvidersWix provides website hosting and referral forms; Google Workspace provides organisational email; and Cliniko provides practice management and client administration. These providers process information in connection with their services. Where international transfers occur, appropriate legal safeguards are required.13. Your Data Protection RightsDepending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to processing; request data portability; and withdraw consent where processing is based on consent. Legal exceptions may apply.For MHWH administrative information, contact MHWH@Malvernhillswellbeinghub.net. For counselling notes controlled independently by a counsellor, requests should normally go to that counsellor; MHWH can help identify the relevant contact. We respond within applicable legal timescales.14. Website CookiesOur Wix website uses essential cookies for operation and security. We use the Wix Usercentrics consent banner to allow visitors to accept or reject non-essential cookies and manage their preferences. Any optional analytics or marketing cookies must be subject to applicable consent requirements.15. ComplaintsContact MHWH@Malvernhillswellbeinghub.net with privacy concerns. You can also complain to the Information Commissioner’s Office at www.ico.org.uk.16. Reviewing This PolicyWe review this policy periodically and when our services, systems or legal obligations change. The latest version is available on our website.
.png)
