W2W & Working Towards Wellbeing are trading names of Working To Wellbeing Ltd, a company registered in England & Wales (11437436).

It is important that you understand who is responsible for keeping your data safe. W2W are the “controller” of all personal data collected and used for the purposes of providing our service and for any other purposes set out in this Privacy Policy. This means that that the Directors, associates and staff are responsible for ensuring that the personal data that you entrust us with are handled legally and safely.

We have appointed a Data Control Officer (DCO) who has ultimate responsibility for making sure your data is treated in accordance with this Privacy Policy and the law. This is Nicola Hunter one of the Directors of W2W.

When someone visits WWW.WORKING2WELLBEING.COM we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. You can find more information on how cookies are used on this website in the Cookies Policy below.

If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

We use a contact form to allow you to contact us directly through the website. We do not store this information elsewhere. By completing this form you are consenting for your information you put on this form to be transmitted to us via the internet. It is advisable that you do not put any personal sensitive information on this form. Please call us if you wish to discuss your condition.

If you register with our website to access resources your personal information is kept securely and is not divulged to any 3^rd party. We don’t rent or trade email lists with other organisations and businesses.

We collect email address and IP address only for the purpose of giving you access to our resources.

Once you have been discharged from our service we will delete this information.

 The information below relates to the information that we keep on you if you are a patient of ours.

What data do we collect and where from?

We collect data directly from you including the following:

• full name
• address and postcode
• email address
• date of birth
• gender
• phone number/s
• details of your insurer/ organisation providing funding for your treatment
• details of your GP / consultant

We keep detailed records of our assessment and treatment of your condition.

We also collect information that you may voluntarily provide to us such as complaints, comments or praise about our service.

What do we use your data for?

Primarily, we use your data to provide you with a vocational rehabilitation or healthcare services to support you to optimise your health & wellbeing. As some of the data required for this relates to health, it is managed in accordance with the data protection laws regarding special category data. We may also use your health data for professional training within the team. We also use anonymised data for marketing or research outside the organisation. A comprehensive consent form is completed prior to any service commencing.

What is our legal basis for using your data?

Data protection law says that we have to tell you the legal basis that we rely on to process your personal data for the purposes that we have notified to you. The legal basis for processing your data is for the provision of health and social care under Article 9 of the UK GDPR.

How long do we keep your data for?

In accordance with professional guidelines, your data is kept for 7 years. This is in case there is a query or problem regarding the service we provided to you.

Who do we share your data with?

Information is not shared without your consent. When we work with you we ask for consent to share relevant information between trusted clinical and non-clinical members of the team within W2W in order to provide you with high quality interdisciplinary and administrative support. We obtain your consent to share information with your referrer in order to provide a joined up service to enable you to achieve your health or vocational rehabilitation goals. We may be asked by your employer to provide information and, with your consent, we only share the minimum required to achieve the agreed goal.

If we wish to use your information as a case study in the public or professional domain to highlight the benefit of value of the service then additional consent is sought and appropriate anonymisation or pseudonymisation. If your data is to be used for research or statistical purposes then it is fully anonymised.

What rights do you have?

The Information Commissioner’s Office advises that you have a number of rights under the data protection law. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/

As an example, for the right to access, often known as ‘subject access right’ (SAR), individuals are asked to let a member of the team know either verbally, or in writing, if they

wish to see their records. W2W strives to continually implement best practice strategies to ensure that individuals’ rights are embedded in day-to-day practices.

We never market to patients directly and no information about you will ever be passed to a third party.

We do conduct business to business marketing to organisations and businesses to inform them about the services we provide. This may be through email or other ways and this is where you have agreed to these marketing communications. This may be through a sign up to a webinar, accessing resources, opting in to communications from a third party or attending a conference and providing your details directly or through a data scanner. We also research and approach businesses that we feel may have a legitimate business interest in services we offer.

When you have taken part in our service we will ask you to complete a satisfaction survey.  We currently use Survey Monkey to undertake this.  The purpose of the surveys are to obtain feedback to help us improve our service.

Survey Monkey has its own privacy policy Survey Monkey privacy policy . Please be aware that as Survey Monkey have servers based  in the US and other locations, any personal data collected from them in the survey may be transferred to various countries, including the United States and other locations.

We will ask permission to use any of your comments and replies for promotional purposes and you have the right to withdraw that consent at any time.

Survey monkey does hold information about your IP address but this is not disclosed to any 3rd party.

Please note that any clinical questionnaires we send are within our own system and not affected by the above.

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

You have a right to complain to the Information Commissioner’s Officer (ICO), which regulates data protection compliance in the UK, if you are unhappy with how we have processed your personal data.

You can find out how to do this by visiting http://www.ico.org.uk(opens in a new window).