Privacy notice
PRIVACY NOTICE
About us
This Privacy Notice explains the nature of the personal information AnDY (Anxiety and Depression in Young People) Research Clinic collects about the participants and service users (as either the participant/ service user or your child/child you are accompanying” as their parent/guardian, hereafter referred to as “You” or “Your”) in their Clinic and explains how Your data is used and Your rights under data protection laws.
AnDY Research Clinic assesses and treats young people aged between 5-17 for anxiety and depressive disorders and OCD, and undertakes research into the development, maintenance, and treatment of such disorders.
The University and the Henley Business School are Data Controller (We or Us) in respect of the information that We process about You . Our contact details are The University of Reading, Information Management and Policy Services, Whiteknights House, Shinfield Road, Whiteknights, READING, Berkshire, RG6 6UR, United Kingdom. Tel: +44 (0) 118 378 8981.
Your privacy is important to Us, so if there is anything in this privacy notice that is unclear or you do not understand, please contact Our Data Protection Officer at: imps@reading.ac.uk
Data we collect about you
AnDY Research Clinic was opened as an independent, University-run research clinic based in the School of Psychology and Clinical Language Sciences at the University of Reading in December 2016 with the following aims:
- To improve the understanding of anxiety disorders and depression in young people
- To improve the treatment of anxiety disorders and depression in young people
- To improve access to treatment for young people suffering with anxiety or depression
- To undertake or support research into the above.
While AnDY Research Clinic conducts research into the development and treatment of these disorders, they also offer assessments and treatment for children and young people who are experiencing difficulties with anxiety, depression, or OCD.
We, the University of Reading, operate a number of different websites and pages that support and enhance engagement with Us and our services, both for the benefit of students and other visitors. Some of those websites or webpages may be specific to a certain department, subsidiary or specific activities conducted across Our campuses- and may have additional information about how they collect and use personal data for their specific purposes. We encourage you to read those carefully in addition to this notice.
Information that We collect directly from You
We ask You for a range personal information when you use the services of AnDY Research Clinic. This information includes :
- Name
- Date of birth/age
- Postal address(es)
- Contact telephone(s) (where applicable)
- Email address(es) (where applicable)
- Unique identifiers (NHS numbers and where taken part in research, Research Participant ID)
- Video recording (of therapy sessions, processed only upon receiving written consent)
- Care records
- Nationality/Domicile
- Ethnicity
- Mental Health (status, medical records conditions, to include disability)
- Physical Health (status, medical records conditions, to include disability)
- Dietary requirements
- Sexual Orientation/Sexual life
- Genetic Data (including DNA data) (not routinely collected and processed only upon receiving further consent)
- Biometric data (such as facial image or fingerprint data) (not routinely collected and processed only upon receiving further consent)
This information includes the service user’s parents’/guardians’:
- Postal address(es)
- Contact telephone(s)
- Educational records (level of last study)
- Employment status (to calculate socioeconomic status (SES) for inclusion in research publications)
- Nationality/Domicile
- Ethnicity
Information that We collect indirectly about You
We may receive personal data about You if You are referred to Us from third parties such as the NHS (National Health Service), GPs (General Practitioners), CAMHS (Children and Adolescent Mental Health Services), outpatient services, schools, local authority services, children’s services and VCSE (voluntary, community or social enterprise) organisations.
We collect personal data in order to:
– Provide psychological assessments and brief psychological treatments to children and young people (participants/service users) who are experiencing difficulties with anxiety and/or depression,
– Undertake and support University and NHS research to improve the understanding and treatment of anxiety disorders and depression in young people,
– Communicate with You about the services provided or research You participated in, and
– Provide You with support tools and services.
COOKIES on our website
Cookies are text files placed on your computer to help us analyse how users use our website. A cookie is a small data file able to track the online movements of an individual. This information could potentially be used to build an online profile of individuals and uniquely locate them in the world.
For further information on cookies visit www.allaboutcookies.org or www.aboutcookies.org.
If You prefer not to receive cookies while browsing our website, You can set Your browser to refuse cookies that are stored on your computer; the above websites tell You how to do this. You do not need to have cookies turned on to use or navigate through most parts of our website, although some functionality may be lost.
Cookies
Our website uses session cookies to ensure that you have a good experience. These cookies contain a unique number, your ‘session ID’, which allows our server to recognise Your computer and ‘remember’ what You have done on the site. The benefits of this are:
- You only need to log in once if You are navigating secure areas of the site
- You are able to use interactive elements of the site, such as forms
- Our server can distinguish between your computer and other users, so You can see the information that you have requested.
- The following table gives details of the different types of cookies that might be used during a session
Google Analytics
We use Google Analytics to help us to understand how you make use of our content and work out how we can make things better. These cookies follow your progress through our website, collecting data on where You have come from, which pages you visit, and how long You spend on the site. This data is then stored by Google in order to create reports. These cookies do not store Your personal data.
The information generated by the cookie about Your use of the website, including your IP address, may be transmitted to and stored by Google on servers in the United States. Google may use this information for the purpose of evaluating your use of the website, compiling reports on website activity for us and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate Your IP address with any other data held by Google.
The Google website contains further information about Analytics and a copy of Google’s privacy policy pages.
Other parts of the University’s website also store cookies on your computer to track user traffic patterns. We do this to see how the website is used, to determine page popularity, to help security and for general statistical purposes. Some of this information may be held on servers in locations outside the EEA. Where personally identifying information is involved, data will only be held in locations that are deemed to have adequate protections for personal data.
Legal basis for processing Your personal information
Processing of Your personal data is required so We can meet our obligations and duties, exercise our powers as a public authority, facilitate research, or support the functions of other authorities that have a public task defined within law or statute.
We will be processing Your data on the basis of the performance of our public tasks under the University Charter where:
- You provide personal information in order for us to contact You or provide You with support tools and other information.
We will be processing Your (or Your Child’s/Child you are accompanying) data on the basis of the health or social care UK GDPR Article 9(2)(h) and Section 11 of the DPA 2018 where:
- You provide mental/physical health information, care records, genetic and biometric data in order for us to provide psychological assessments and psychological treatments to you.
Where You provide Us with special category (sensitive data) including information on Your ethnicity, disability, or medical conditions, We will be processing Your data for reasons of public interest where for the purposes of equality of opportunity or treatment and where we use or share this for the purposes of research.
Where applicable We will also process Your personal data for the purposes of safeguarding of children and individuals at risk.
Where purposes are required by law, We will process Your data on the basis of a legal obligation.
Who we may share your data with
The University will not sell, license, or trade your personal information..
We will not share your personal information with others unless there is a partnership agreement in place, including those for research purposes (e.g., with NHS partners, other universities or institutions), or where We are required to do so by law for safeguarding responsibilities in accordance with national guidance (for example, Working Together to Safeguard Children).
Service users referred to Andy Clinic by NHS service providers
Where You are referred to Us from third parties such as the NHS (National Health Service), GPs (General Practitioners), it is routine practice to share Your personal information with the referring party. Where possible, we inform You about with who and why We are sharing Your data.
Services users that are self-referred
Where You are self-referred to our services or are not referred via an NHS provider, we will share personal data such as age, gender, ethnicity, and contact information, and health information which will include medical history, treatment data, test results, and health outcomes with Berkshire Healthcare NHS Foundation Trust (BHFT) for research purposes.
The aim of this research is to develop targeted psychological interventions for diverse children and young people with mental health difficulties including anxiety, depression, and OCD. The information shared will only be accessible to authorised BHFT personnel. All individuals with access to Your information will be bound by strict confidentiality obligations and the obligations under the UK GDPR (General Data Protection Regulation). All shared data will be stored securely and accessed only by authorised personnel.
When Your information is shared with BHFT, You will become a registered BHFT patient. This will allow BHFT to record You as a participant in NHS-supported research carried out by the AnDY Research Clinic in partnership with BHFT. Keeping accurate records of people who have taken part in NHS-supported research helps BHFT secure future funding for research carried out in partnership with the AnDY Research Clinic.
Your rights
Right to Object to sharing of your personal data with the Berkshire Healthcare NHS Foundation Trust if You are self-referred or not referred from NHS service providers:
You have a right to object to the sharing of Your personal data at any time. If you wish to exercise this right, please contact us at andyadmin@reading.ac.uk. Please be advised that this right may not be possible to uphold in some circumstances where information has already been shared or used in research up to the point of Your objection .
Under data protection law You also have the right to:
- Withdraw Your consent where that is the legal basis of our processing
- Access Your personal data that We process
- Rectify inaccuracies in personal data that We hold about You
- Be erased, that is your details to be removed from systems that We use to process Your personal data
- Restrict the processing in certain ways
- Obtain a copy of your data in a commonly used electronic form; and
Please see the ICO website for further information on the above rights:
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with your request in these circumstances.
More information on making a request under Your rights can be found here.
If You would like to exercise your rights, or have any concerns regarding how We have handled Your personal information please contact our Data Protection Office at imps@reading.ac.uk
Some rights are dependent on the lawful basis for processing your information. If We have legitimate grounds to not carry out Your wishes, these will be explained to you in response to your request.
You also have the right to complain to the Information Commissioner’s Office.
Retention of your data
We will retain Your data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements and no more than 20 years or 10 years after data subject’s death which is the standard set by NHS England’s Records Management Code of Practice.
To determine the appropriate retention period for personal data, We consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of Your personal data, the purposes for which We process Your personal data and whether We can achieve those purposes through other means, and the applicable legal requirements.
Information used for the purposes of research in the public interest may be retained for longer periods with appropriate safeguards for the protection of personal data in place.
In some circumstances We may anonymise Your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case We may use this information indefinitely without further notice to You.
How we protect your data
Your personal information is stored securely within the University and our staff are trained about the secure handling of personal information. We may also use third party providers to deliver our services, such as externally hosted software or cloud providers. Where we do this, We have measures and terms in place with those providers to ensure that they also protect Your data.
Keeping your information up to date
The accuracy of Your information is important to us. You can update Your information, including your contact details, at any time. If you need to update the details We hold about you, or believe We hold inaccurate data, You can contact AnDYadmin@reading.ac.uk.
Questions about this notice
If there is anything in this notice that You are unclear about, please contact our Data Protection Officer, on the contact details below, who shall be happy to answer any queries You may have concerning this privacy notice or the way in which We process Your personal data.
By mail: Information Management and Policy Services,
Whiteknights House
Shinfield Road
Whiteknights
READING
RG6 6UR
UK
By email: imps@reading.ac.uk
By phone: 0118 378 8981
Complaints can be referred to the Information Commissioners Office, the independent body who oversee Data Protection compliance in the UK.
Web: https://ico.org.uk/
Changes to this notice
We keep our privacy notice under regular review to ensure best practice and compliance with the law. This privacy notice was last updated on 13/12/2024.
We may change this privacy notice from time to time. If We make significant changes in the way we treat Your personal information We will make this clear on https://www.reading.ac.uk/ and may also inform You directly.
How to contact us
If you have any questions about this notice, our University Data Protection Officer can be contacted at: IMPS, University of Reading, Information Management & Policy Services, Whiteknights House, Shinfield Road, Whiteknights, READING, RG6 6UR, UK
Telephone: 0118 378 8981
Email: imps@reading.ac.uk