Oakdale is a group of organisations which includes; Oakdale Centre CIC, Oakdale Therapies Ltd and BUSS MODEL LTD.

Oakdale also contracts with self employed Associate Practitioners using a Franchise Agreement and refers clients to them for private therapy. Oakdale provides a range of therapies and assessments for children and adults as follows:

● Neurodevelopmental Services (Autism and/or ADHD)
● Adoption Support and Trauma
● BUSS – Building Underdeveloped Sensorimotor Systems
● Private Psychological Therapies for adults and childre
● NHS Adult Talking Therapies
● Children and Young People Therapies
● Eating difficulties and Addictions
● Wellbeing in Schools

This Privacy Notice is intended to explain to the clients, their families and the external agencies how Oakdale collects, uses, stores and protects their personal information.

Oakdale is a Data Controller who is responsible for the protection of all personal information. Oakdale also acts as a Shared Data Controller when working with Franchise Associate Practitioners.

This is explained in more detail later in this document.

Contact Name: Caroline Bairstow, Governance Lead
Address: 49 Valley Drive, Harrogate, HG2 0JH

Phone Number: 01423 503080
Email: dpo@oakdalecentre.org
Website: www.oakdalegroup.org

Oakdale currently collects and processes personal information. This is data or information about a living person that could be used to identify that person.

This is information such as a person’s name, address, email, telephone number, date of birth, gender, finance details such as bank card details, family contact information, GP details and details regarding other external agencies involved in the support of a person.

Oakdale also collects data or information that is called ‘Special Category Data’. Special category data is information of a sensitive nature or which has a particularly high risk of being used to negatively target or discriminate against Oakdale clients.

The special category data Oakdale collects is information that relates to a person’s health (physical or mental health past, current or future). In addition, during therapy or assessment a person’s data concerning their sex life or sexual orientation, racial or ethnic origin, political opinion or religious or philosophical beliefs may be disclosed. This is also classed as special category data.

Oakdale is committed to protecting a person’s confidentiality and processing data with integrity and within the law. To assist Oakdale in fulfilling its responsibilities it is essential that people report immediately any changes to their personal information to ensure correspondence from Oakdale reaches them correctly.

Most frequently, personal information is collected directly from clients or their legal representative (eg. parent, carer) for assessment, payment, or treatment purposes.

Personal information may also be collected by Oakdale indirectly through external agencies, such as the NHS. The client or their legal representative will have provided Oakdale details of the external agency contact. This enables Oakdale to assess and treat clients safely and appropriately.

Personal information is collected via our website referral forms, telephone calls and texts, emails and in person. Personal information may also be gathered in video, art work and written work the client produces during the treatment process. Personal information is also collected from Franchisee Associate Practitioners who deliver private therapy for clients once Oakdale has made a referral to them.

Oakdale collects personal information to enable the assessment and treatment process as follows:

● To make clinical decisions
● To provide health care or treatment
● To verify the identity of clients
● To make sure that the therapy or assessment offered/ provided is appropriate
● To process and verify any financial transactions as part of providing services
● To comply with the law to the extent that it requires Oakdale to keep a record of any clinical care provided and any financial transactions associated with our work.
● To safeguard children and vulnerable adults
● To address compliments, complaints, and concerns

Oakdale’s website does not collect personally identifiable information without a person’s knowledge. Please see the Cookie section below

Processing data means the activities each Oakdale employee or associate practitioner does in the course of their work with personal information/ data. Such as:

● Collecting data
● Recording data
● Organising data
● Structuring data
● Storing data
● Adapting or altering data
● Retrieving data
● Consulting data
● Using data
● Disclosing data by transmission
● Disseminating data or otherwise making available
● Aligning or combining data
● Restricting data
● Erasing or destroying data

Under the General Data Protection Regulations (GDPR) and associated Data Protection laws Oakdale relies on the following lawful basis for processing personal data because it is
necessary to carry out our work:

➔ Contractual necessity
Where a client or their legal representative has signed a contract and Oakdale therefore needs to fulfil its promise of services outlined in the contract.

➔ Legal obligation
Where Oakdale is subject to legal obligations, for example processing finance data.

➔ Vital interests
Where Oakdale must process personal data in order to protect the vital interests of the client or another living person. For example, to save a person’s life.

➔ Public interests
To enable Oakdale to process personal data that is in the public interest, for example safeguarding disclosures.

➔ Legitimate interests
Where processing personal data is necessary to pursue a legitimate interest of the Data Controller. In these circumstances the rights and freedoms of the person must be considered and decisions as to why consent was not sought recorded. This is usually used in marketing processes.

➔ Consent has been provided
Oakdale will inform the person what data it requires, why and their rights with regards to the personal data Oakdale will process on their behalf. This privacy notice contains all of the details required to enable a data subject to make an informed decision and understand their rights.

Oakdale has a Consent and Mental Capacity Policy which staff members use to ensure consent from clients is obtained legally based on their age (children and adults),and that their capacity or competence is assessed and where needed their legal representative has full involvement.

Oakdale can seek verbal or written consent to gather personal information when a referral is initially received but the privacy notice shall be sent immediately to the person explaining fully the process and their rights. The person has the right to withdraw their consent at any time.

Where Oakdale decides that personal information will be used for a different reason than initially explained, Oakdale will seek fresh consent from the person.

Oakdale reserves the right to process personal information without the consent of a person if it is a member of the team’s belief it is required to safeguard the person or others from abuse.

Where a person provides consent for Oakdale to contact them regarding the latest promotions or services Oakdale will use email to communicate with the person.

Withdrawal of consent

Consent can be withdrawn by contacting Oakdale using the details in the introduction section of this Privacy Notice.

Oakdale will seek the consent from the client or their legal representative to enable them to share information with all the relevant internal team members and external agencies to
enable the safe delivery of assessment and/ or therapy for them. This may include sharing personal information to an agency following discharge from Oakdale services to ensure a client’s care and needs are handed over safely.

Oakdale reserves the right to process personal information without the consent of a person if it is a member of the team’s belief it is required to safeguard the person or others from abuse.

Oakdale runs services under contract from other organisations such as the NHS. Data may be shared with these organisations during contract audits and or data returns to enable them to ensure Oakdale is providing safe and quality services.

Oakdale is regulated by the Care Quality Commission (CQC) for some of its service provision. Oakdale must comply with legal requirements with regards to reporting certain incidents and taking part in regulatory inspections. Personal information will be shared during these times.

Oakdale will share financial data with your bank to enable payments for services.

In the event that Oakdale transfers its services to a new operator, personal information will be shared to enable the delivery of services without interruption. A person can object to this by contacting Oakdale via dpo@oakdalecentre.org

Oakdale contracts with self-employed professionals to deliver some of its private psychological services. In these circumstances the client will be made aware that they have been introduced to a Franchise Associate Practitioner, who will, as a private practitioner deliver their treatment. In these circumstances personal data will be shared with the Franchisee to enable them to fulfil the requirements of the contract. The Franchisee and Oakdale both therefore hold personal information and are responsible for the data they each process.

Oakdale may be required to share personal information with our insurers/ professional advisors in so far as is reasonably necessary to seek insurance cover, manage risk, obtain professional advice and manage legal disputes or insurance claims.

Social media platforms
Oakdale does operate social media platforms, they are closely monitored to ensure we do
not upload any confidential personal information via these forums.

Data Shared outside of the European Union (EU)
To enable certain assessments to be completed Oakdale engages with organisations who can deliver online assessments and analysis of results. This supports practitioners in ensuring assessments are professional and robust. Some of these assessments are owned by international companies. This means personal data is sent outside of the EU electronically and stored outside of the EU.

Oakdale will only do this when it believes it is necessary to carry out obligations within the contract to the client to deliver services we have promised. Also, where we believe doing so will benefit the client.

The companies we work with will ask for consent prior to the assessment record being completed.

Oakdale also uses the Google Workspace IT platform and under the licence Oakdale holds the data storage centre is held outside the UK/EU. We have completed our due diligence and can confirm that all data is held as securely as it would be within the UK/EU.

In these circumstances Oakdale follows the GDPR guidance to ensure appropriate safeguards are in place to protect the data as it would have been protected if it were processed within the EU. This involves risk assessing the situation and knowing the legislation in the host nation, entering into an international data transfer agreement with the company who will be processing personal data.

Oakdale uses an electronic records system which stores all personal information within a file specifically labelled for each person. Any data collected on paper is either scanned into the electronic records system or typed into the system. All paper copies are then securely shredded.

Associate Practitioners under a Franchise agreement can use the electronic records system to store any personal information, however they can also choose to use their own data storage process external to Oakdale. The Franchisee Associate Practitioner is asked to highlight to clients where they choose for data to be stored.

Oakdale uses a secure IT platform to ensure ‘work in progress’ documents are kept within a secure shared drive. The shared drive is securely maintained with access/ permissions restricted so staff members and associate practitioners can only see what they are authorised to see.

Oakdale has policies which describe to employees and associate practitioners the processes they must follow to ensure personal information is processed safely and protected.

Oakdale has an assigned Caldicott Guardian who is responsible for ensuring all personal information is used legally, ethically and appropriately, and that confidentiality is maintained.

The Calidcott Guardian ensures that Oakdale can justify the purpose(s) of using confidential information. That it is only used when absolutely necessary. That the minimum personal
information is used for what is required. That access is on a strict need-to-know basis. That everyone understands their responsibilities. That the Oakdale Board understands and complies with the law.

The computer based records system and shared drive Oakdale uses protects all personal information from improper access, use, alteration, destruction or loss. It complies with all data protection laws and guidance to ensure information is protected.

All employees and Associate Practitioners are required to complete training annually to maintain their knowledge of information security.

Oakdale has a transparent and open culture and a process for employees and Associate Practitioners to report data breaches. The governance team and Board ensure all breaches are reported appropriately and investigated. Any lessons learned are communicated and action taken to minimise the likelihood a breach will occur again.

Where a data breach occurs Oakdale uses the Information Commissioner’s Officer (ICO) screening tool to determine if the breach has led to a person’s rights and freedoms being impacted. If there is a high risk to a person’s rights and freedoms, Oakdale will tell them and the ICO about the breach and actions taken.

Cookie Policy
Cookies are files delivered and stored on a person’s computer or smartphone via the websites they browse. They gather data each time a person uses the website and will recognize them. There are different types of cookies, some which are needed or essential to ensure you can use the website easily. Others are cookies that are not essential and can be enabled to gather more specific personal information that companies can use in marketing for example.

Oakdale has disabled all cookies that are non-essential on the website. When a user visits the website this will be explained and they can choose to ‘enable’ non-essential cookies if they choose to.

Oakdale has a Cookie Policy, which explains how we manage cookies in more details, please ask for a copy using the details on page one if you require this.

Oakdale only retains personal information for as long as is reasonable and necessary for the purposes required.

Oakdale must retain personal data for compliance with legal obligations it is subject to or to protect the vital interests or clients or others. The NHS Records Retention Schedule sets out the appropriate timescales data must be kept for dependent on its type. Oakdale has a Document Control Policy which outlines this process. If you would like a copy of this policy please ask Oakdale for this.

Once personal information has been retained for the required timeframe Oakdale will take steps to permanently delete the data from its systems securely.

Under data protection law, Oakdale must ensure that the people (data subjects) whose data they process have their rights explained and upheld. Data Subjects have the right to:

● Right of Access: The right to request a copy of the personal information Oakdale holds about you.
● Right to Rectification: The right to ask Oakdale to change or rectify any personal information held about you that you think is inaccurate.
● Right to Erasure: The right to ask Oakdale to delete/ erase your personal information in certain circumstances.
● Right to Restriction of Processing: The right to ask for restriction of processing in certain circumstances.
● Right to Object to Data Processing: The right to object to the processing of personal data in certain circumstances.
● Right to Data Portability: The right to ask that Oakdale transfer personal information to another organisation, or to the data subject in certain circumstances.
● Rights relating to automated decision making and profiling: The right to know if personal data is being profiled and used in automated decision making. This is where an organisation uses personal data automatically to profile a person and make decisions that may impact on them, for example credit decisions or recruitment tests. Oakdale does not use personal data in this way. More details regarding data subject rights is held within Oakdale’s Data Subject Access Request Policy. If you require a copy please request this via dpo@oakdalecentre.org

People (data subjects) can make a request regarding any of their rights using the contact information held on page one of this privacy notice or via email using dpo@oakdalecentre.org

People are not required to pay a charge for exercising their rights. If a request is made Oakdale will respond within one month.

People’s rights will be considered when a request is received and their rights will differ depending on the lawful basis for which Oakdale is processing their personal information. Oakdale will always explain where it can or cannot agree to a request based on the legal parameters Oakdale must operate within.

If a person has a concern or a complaint about how personal data has been processed at Oakdale, you can contact using the following details:

In writing: 49 Valley Drive, Harrogate, HG2 0JH

Via telephone: 01423 503080

Via email: dpo@oakdalecentre.org

You can also complaint to the Information Commissioner’s Office (ICO) via:

Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: www.ico.org.uk

We use Google Analytics, a web analytics service provided by Google Inc.  Google collects data from every website visit / visitor but it does not store any personally identifiable information. Your IP address is used to determine your physical location but the IP address itself is not data that can be accessed through Google Analytics; all data is aggregated and anonymised.

For more information, please visit the following site https://policies.google.com/technologies/partner-sites