About Us

The York Community Wellbeing Hub brings together mental health and wellbeing services in York to provide holistic, person-centred care. This is part of NHS England’s Community Transformation programme.

Who we are

The following organisations work together as joint controllers of your information and have agreements and arrangements in place under UK GDPR Article 26 to ensure your information is handled securely and your rights are respected:

The providers and partners are:

  • City of York Council
  • Tees, Esk and Wear Valley NHS Foundation Trust (TEWV)
  • York Carers Centre
  • York CVS (Centre for Voluntary Service)
  • York Mind
  • Nimbuscare Ltd

We created this privacy notice in November 2022, and it was updated in April 2026. It tells you what to expect when we process your information.

This privacy notice should be read in conjunction with the other organisations in the Hub privacy notices that are available on their websites at:

When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this privacy notice.

Top of page

How we collect your information

We get information about you from the following sources:

  • directly from you
  • from third parties acting on your behalf such as family member(s), advocates, councillors, MPs etc
  • from other organisations such as NHS and the Police
  • from commissioned partners or contractors who undertake work on behalf of the organisations in the Hub

Top of page

What personal data we process and why

We will only collect and process the information that is necessary such as:

  • name
  • date of birth
  • contact info
  • health and care information
  • NHS number
  • carer details
  • other relevant information (e.g., ethnicity, language, accommodation status)

When we process information relating to criminal convictions and offences, this includes details of any past criminal convictions or offences.

If you choose to take part in our surveys, consultation or events, we will also collect and use your comments, feedback and opinions.  You can withdraw your consent to these at any time by contacting [email protected] or [email protected].

We use your information to

  • deliver joined-up care and support
  • share safety concerns
  • avoid duplication of services
  • meet legal and statutory duties

We may use your information to create reports and statistics that are anonymous and cannot be linked back to you, your family, or individuals such as:  

  • statistical analysis
  • statutory returns
  • audit framework
  • see how the Hub is supporting individuals
  • help design better services
  • inform funding decisions

Top of page

Automated decision making

We do not carry out any automated decision making in providing the Hub services.

Top of page

Collecting information automatically

Please see our cookies page for further information about the information we collect automatically when you use our website

Top of page

Children’s information

Where we provide services directly to children or young people, the information in the relevant parts of this notice applies to children and young people, as well as adults.

Top of page

Lawful basis for processing your personal data

Any personal data, special category data and criminal offence data that we process about individuals is done so in accordance with one or more of the following Articles 6, 9 and 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (DPA 2018).

Article 6(1)

(a) Consent: the individual has given clear consent for us to process their personal data for a specific purpose.
(c) Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This does not apply to councils or public authorities processing data to perform their official tasks.)

Article 9(2)

(a) Explicit consent
(b) Employment, social security and social protection (if authorised by law)
(c) Vital interests
(g) Reasons of substantial public interest (with a basis in law)
(h) Health or social care (with a basis in law)
(i) Public health (with a basis in law)

This is supported by Schedule1, Part 2 (6) of the Data Protection Act 2018 and the following legal framework:

Where we process information relating to criminal convictions and offences, this is under Article 10 UK GDPR that covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences, or proceedings for an offence committed or alleged to have been committed, including sentencing.

Some of the Schedule 1 conditions for processing special category and criminal offence data require an Appropriate Policy Document (APD) to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice.

You can find these on each organisation’s website

Top of page

How long we keep your personal data

We will only keep your information for as long as it is needed then it will be securely and confidentially deleted or disposed of.

You can find more details about this on each of the organisation’s own privacy notice.

Top of page

Sharing your information

We share information within the Hub and with trusted partners (e.g., NHS, commissioned providers) where necessary.

We only share when legally permitted or required, such as for safeguarding.

We will always satisfy ourselves that we have a lawful basis on which to share the information and document our decision making.

Additionally, some of the organisations in the Hub are required under the Public Records Act 1958 (as amended) to transfer records to the City or National Archives (TNA) for permanent preservation. Full consideration will be given to Data Protection and Freedom of Information legislation when making decisions about whether such records should be open to the public.

Top of page

Data processors and or third parties

When the organisations in the Hub have third parties providing parts or all of their services, systems, software, platforms, applications (apps) etc for us, they have contracts or agreements in place with them.

Top of page

Transfers of personal data

The organisations in the Hub do not routinely transfer personal data, special categories of personal data or criminal offence data, outside of the UK but when this is necessary, they will ensure that they have appropriate safeguards in place and that it is done in accordance with the UK data protection and privacy legislation.

Top of page

How we protect your information

We are committed to keeping your information safe and secure. There are several ways this is done, such as:

  • IT security safeguards such as firewalls, encryption, and anti-virus software
  • on-site security safeguards to protect physical files and electronic equipment
  • training for all staff
  • policies and procedures

Top of page

Your rights in relation to this processing

To find out about your rights under Data Protection law, you can go to the Information Commissioners Office (ICO) For the public | ICO

You can also find information about your rights on each of the organisation’s own privacy notices

If you have any questions about this Privacy Notice, want to exercise your rights, or if you have a complaint about how your information has been used, you can find details in each organisations privacy notice or policy.

For City of York Council, you can contact [email protected] or on 01904 555719, or write to the:

Data Protection Officer
City of York Council
West Offices
Station Rise
York
YO1 6GA

Top of page

Galaxy Website Information

Cookies

By using our website you are consenting to certain types of cookie being placed on your device. See our Cookies Policy[UPDATE].

Where our website links to external resources or websites, these may add their own cookies. These are outside our control. Cookies can be disabled by changing the settings in your browser, but you may need to re-enter information at times.

Email

Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our record retention schedules. If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.

Unsolicited mail

You will not receive unsolicited paper or electronic mail as a result of sending us any personal data while using our website, unless you have given us permission to do this.

Third parties

We do not pass personal data to third parties for marketing, sales or any other commercial purposes without your prior explicit consent.

If we have to share your personal data externally, we require any third party to comply with the principles of data protection legislation, and our procedures and instructions, when they use your information on our behalf.

Top of page