Privacy Policy

Change Mental Health respects your privacy and is committed to protecting your personal information. This policy explains what information we collect, why we use it, who we may share it with, how long we keep it and your rights.

It applies when you use a service, contact us, visit our website, make a donation, become a supporter, attend training or an event, apply for a paid or unpaid role, volunteer, raise a complaint or otherwise have a relationship with us.

This is a privacy policy, not a contract. You do not agree to it simply by using our website or giving us information. Where we need consent for a particular operational activity, we ask separately and clearly.

Contents

1. About Change Mental Health
2. Information we may collect
3. Where information comes from
4. Why we use information and our lawful basis
5. Information about people using our services
6. Who we may share information with
7. Security and retention
8. Your rights

About Change Mental Health

Change Mental Health (the data controller) is a national mental health charity providing person-centred and non-clinial support across Scotland. We are a registered Scottish Charity (SC013649), a company limited by guarantee registered in Scotland (SC088179), and authorised and regulated by the Financial Conduct Authority (782332).

Data Protection Officer: Change Mental Health, Suite 4/1 Great Michael House, 14 Links Place, Edinburgh, EH6 7EZ. Email: operations@changemh.org.

Information we may collect

• Identity and contact details;
• referral, service, support, case-note, outcome, risk and safeguarding information;
• relevant physical or mental health and other sensitive information;
• optional equality and demographic information;
• financial, benefits, debt or housing information where we provide advice;
• communications, feedback, complaints and contact preferences;
• donation, membership, Gift Aid, transaction and payment information;
• recruitment, volunteering, references, eligibility and lawful vetting information;
• website, device, browser, cookie and security-log information; and
• stories, photographs, audio or video where there is a clear lawful basis and a separate release where required.

Where information comes from

We may receive information directly from you, from a referrer, from a family member, carer, advocate or authorised representative, from partners involved in your support, from public sources for proportionate supporter or partnership research, and automatically on our website through cookies.

Where information comes from someone else, we normally provide privacy information at the first meaningful contact and within the period required by law, unless an exemption applies.

Why we use information and our lawful basis

We use personal information only where we have a lawful basis. More than one basis may apply.

Purpose	Main Basis
Support, referrals, and case records	Legitimate interests, contract where applicable, legal obligation or vital interests in limited cases. For sensitive information, health/social care, safeguarding, vital interests or legal claims conditions may apply.
Quality, evaluation, and anonymised reporting	Legitimate interests, contract or legal obligation where required. Relevant special-category conditions are used where needed.
Equality monitoring	Legitimate interests and the substantial-public-interest equality monitoring condition where applicable.
Safeguarding, incidents, complaints, and legal duties	Legal obligation, legitimate interests or vital interests, with the relevant safeguarding, health/social care, vital interests or legal claims condition.
Donations, membership, purchases, training, and accounts	Contract, legal obligation, and legitimate interests.
Recruitment and volunteering	Steps before a contract, legal obligation and legitimate interests, with an additional condition for sensitive information where required.
Marketing and supporter communications	Consent or legitimate interests where the law permits, plus the rules on electronic marketing.
Identifiable case studies and media	Consent and explicit consent where sensitive information is included.
Website and digital security	Legitimate interests, and consent for non-essential cookies or similar technologies.

Legitimate Interests

Our legitimate interests may include providing safe and effective support, maintaining accurate professional records, improving services, protecting people, securing systems, preventing fraud, managing the charity responsibly, and communicating appropriately with supporters. We consider the impact on your rights before relying on this basis.

Consent

Where we rely on consent, the request is separate, specific and optional. You may withdraw consent at any time. Withdrawal does not affect earlier lawful use and does not require us to delete information we continue to hold under another lawful basis.

Core service records: We do not normally rely on consent to create and maintain the record needed to provide and manage a service. Refusing an optional consent will not, by itself, present you receiving support.

Information about people using our services

Why We Keep a Record

We keep a proportionate record to understand your needs, provide consistent support, record actions, manage safety, supervise and improve services, respond to concerns and meet legal, regulatory, contractual, and funding requirements.

AdvicePro

Most service user records are stored in AdvicePro, our case management system (CMS), or another approved secure system used by a service. Access is restricted to authorised people who need it. AdvicePro is supplied by Advanced Case Management Solutions Limited and stored customer data in a secure UK data centre.

Sharing Consent with Support

We may share relevant information within Change Mental Health and, where appropriate and lawful, with a referrer, commissioner, NHS or local authority service, or another professional involved in your support. We use consent where consent is the appropriate basis.

We may share without consent where necessary and lawful, including serious risk of harm, safeguarding, emergency, legal or regulatory duties, or legal claims. We consider confidentiality, necessrity, and proportionality.

Case Studies

Agreeing to be contacted about sharing an experience is not permission to publish. Before using an identifiable story, image, recording, or quotation, we explain the proposed use and complete a separate consent or release.

Anonymised Reporting

We use anonymised reporting or aggregated information to assess outcomes, improve quality and report to trustees, funders, commissioners, and regulators. We take steps so individuals are not identified.

Who we may share information with

• authorised staff, volunteers, trustees and professional advisers;
• referrers, NHS services, local authorities, commissioners and support partners;
• funders and regulators, usually using anonymised or aggregated information;
• processors such as AdvicePro/ACMS, IT, website, email, survey, printing, payment and communications providers;
• HM Revenue & Customs where required;
• emergency services, police, courts, safeguarding bodies, legal advisers or authorities where necessary and lawful; and
• a successor organisation in a merger, transfer or restructuring, with safeguards.

We do not sell personal information. Processor contracts require suppliers to protect information and act only on our instructions.

International Transfers

AdvicePro customer data is stored in the UK. Some other suppliers may process information outside of the UK. We use a lawful transfer mechanism and appropriate safeguards, such as adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum.

Security and retention

We use proportionate technical and organisational measures, including role based access, authentication, secure systems, staff training, confidentiality requirements, backups, incident procedures, and supplier checks.

We keep information only as long as needed. A service user case record is generally kept for two years after closure and then deleted or anonymised, unless a lawful reason requires a different period, such as safeguarding, a complaint, legal claim, regulation or commissioning requirement. We may keep a minimal suppression record to respect a request not to be contacted.