Community Transformation is mandated by NHS England for secondary Mental Health providers to bring together multiple wellbeing services in Community Hubs by 2023/24.

City of York Council is working with providers and partners to provide an interagency team - the York Community Mental Health Hub - to deliver holistic person-centred care (Right Care, Right Place) in the City of York area.

The providers and partners are:

  • Tees, Esk and Wear Valley NHS Foundation Trust (TEWV)
  • York Carers Centre
  • York CVS
  • York Mind
  • Nimbuscare

When we use your personal data, City of York Council (CYC) complies with data protection legislation and is the registered ‘Controller’. Our data protection notification is registered with the Information Commissioner’s Office (ICO) - reference Z5809563.

We created this privacy notice in November 2022 and will keep it under regular review.

This privacy notice should be read in conjunction with other relevant privacy notices where needed. These include:

Read more about:

Personal data

The information we collect about you will include, but is not limited to:

  • name
  • date of birth
  • contact details
  • address
  • clinical/health info
  • NHS number
  • carer details (where relevant)
  • physical or mental health condition(s)

We may ask you further details where required and appropriate such as:

  • ethnicity
  • religious or other similar beliefs
  • language
  • accommodation status
  • nationality
  • sexual orientation
  • marital status
  • financial information

We will:

  • only ask you for the information that is necessary
  • protect it and make sure nobody has access to it who shouldn’t
  • ensure you know if you have a choice about giving us information
  • make sure we don’t keep it for longer than is necessary

We ask that you:

  • give us accurate information
  • tell us as soon as possible of any changes
  • tell us as soon as possible if you notice mistakes in the information, we hold about you

See further details about how we define personal data and non-personal data.

Top of page

Using personal data

York Community Mental Health Hub will use your information to:

  • provide a more collaborative service offer for you
  • join up care pathways,
  • ensure your safety concerns are shared
  • avoid duplication of service provision

This may include, but is not limited to:

  • assessment of need
  • provision of services
  • Adults Safeguarding and Deprivation of Liberty Safeguarding processes
  • assessing financial eligibility for services
  • delivery of a range of preventative, information, and signposting

We may also use the information to create reports and statistics that are anonymous and cannot be linked back to you, your provision or to individuals, such as:

  • statistical analysis
  • statutory returns
  • knowing we are delivering care to the right people
  • ensuring service quality

Top of page

Depending on the processing activity being undertaken by the York Community Mental Health Hub, we will rely on one or more of the following lawful bases for processing your personal data under the UK GDPR:

  • Article 6(1)(c) so we can comply with our legal and statutory obligations
  • Article 6(1)(d) to protect your vital interests or those of another person
  • Article 6(1)(e) for the performance of our public task(s)
  • Article 6(1)(f) for the purposes of our legitimate interest(s)

Where the information we process is special category (sensitive) data such as your health data, the additional bases for processing that we rely on are:

  • Article 9(2)(b) which relates to carrying out our legal obligations and the safeguarding of your fundamental rights
  • Article 9(2)(c) to protect your vital interests or those of another person where you are incapable of giving your consent
  • Article 9(2)(g) – where processing is necessary for reasons of substantial public interest

In addition, we rely on the processing condition at Schedule 1 part 1 paragraph 1 of the DPA 2018.

Examples of the legislation we rely on are:

Top of page

Criminal convictions and offences

Where we have to process information about criminal convictions and offences, the lawful basis we rely on to process this data is:

  • Article 6(1)(e) for the performance of our public task

In addition, we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a) of the DPA 2018.

  • Article 6(1)(b) for the performance of a contract

See further details about law enforcement in our Law Enforcement Processing Privacy Notice.

See further details about how we use your personal data.

Top of page

Sharing personal data

The team members of York Community Mental Health Hub team will share relevant information to provide its services to you. The York Community Mental Health Hub includes:

  • Tees, Esk and Wear Valley NHS Foundation Trust (TEWV)
  • York Carers Centre
  • York CVS
  • York Mind

We may also share with other council services as appropriate, and with other organisations, agencies, partners such as:

This includes organisations or providers that we commission to provide support, such as home care agencies or residential homes. This is because they are delivering support on our behalf.

It is very important that the York Community Mental Health Hub can plan and realign its delivery of services to meet the needs of adults with mental health needs within the City of York. To do this, we carefully use the information we collect about how services are delivered and who is using these services. This also includes the statutory functions of Public Health which is now part of the council’s responsibility.

Where we use platforms, systems, or apps such as Access Care Plan, WhatsApp to contact you, hold meetings, training sessions and more, we'll let you know. You can find out more about these platforms, systems, or apps in their privacy notices:

When we use MS Teams to provide secure online conversations, we may record and or transcribe these and you can find out more about this at Microsoft Office 365 (MS365) Teams Meeting recording and transcription privacy notice.

We only allow our commissioned partners, contractors and third parties to handle your personal data if we are satisfied, they take appropriate measures to protect it. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • safeguarding
  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

Top of page

Retaining personal data

We will only keep your personal information for as long as is necessary and then we will delete or destroy it securely.

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Top of page

Transferring personal data abroad

We do not process your personal data outside the UK and/or the European Economic Area. If this changes, we will only use services hosted outside the UK and/or the European Economic Area, where an agreement is in place that complies with obligations equivalent to the principles of the Data Protection Act 2018.

Top of page

Further processing of personal data

When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this document. The new notice will explain this new use and set out the relevant purposes and processing conditions.

Top of page

Caldicott Guardians

Caldicott Guardians are responsible for protecting the confidentiality of people’s health and care information and making sure such data is used properly. Read more about the council’s Caldicott Guardians.

Top of page

Use of your NHS Number in Adult Social Care

See further details about how we use your NHS number in connection with Adult Social Care services.

Top of page

Your rights relating to personal data

To find out about your rights under Data Protection law, see the Information Commissioners Office (ICO).

You can also find information about your rights in Our Privacy Notice.

If you have any questions about this Privacy Notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact:

City of York Council Data Protection Officer, West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 555719.

Email: [email protected].

See further details of your rights relating to personal data.

Top of page