Shout service user privacy and confidentiality policy

Last updated: 19 August 2021

INTRODUCTION; SCOPE

The Mental Health Innovations (“Mental Health Innovations”, “we”, or “us”), Shout 85258 service gives text message support to anyone who is struggling to cope. Trained Shout Volunteers are available round the clock to have conversations with texters in need of support, aiming to create a ‘safe space’ in which texters feel able to discuss difficult topics. Shout Volunteers help texters move to a calm and more manageable state of mind and help them form an action plan. Our Shout Volunteers are trained and supervised throughout their interactions with texters by clinical staff. Mental Health Innovations is a registered charity in England number 1175670. You can find our registered office contact details at the end of this Policy.

Your privacy and the security of information about you are very important to us. Our privacy and security guidelines apply to all Mental Health Innovations employees and Shout Volunteers as well as those who provide technical support and we take these privacy safeguards very seriously.

When you send a message to Mental Health Innovations to initiate a text message conversation, you receive some automated reply messages with a link to our Terms of Service and this Privacy Policy. 

Our Terms of Service explain our service and set out the ground-rules for using it.  Before using or accessing the service we provide (the “Service”), please read both the Terms of Service and this Privacy Policy (the “Terms”).  The Terms govern your access and use of the Service. You may contact Mental Health Innovations by email at info@mhiuk.org if you have any questions about them. 

If you don’t agree to the Terms you may not use the Service. If you no longer wish to receive messages, you may opt out at any time by texting the word STOP. We will confirm receipt of your STOP message and will not contact you further after this. We will not process your data further other than: (i) as part of aggregated, anonymised analyses to improve our service and inform our research; (ii) if you decide to contact the service again in future, we may need to refer back to your previous conversation in order to ensure that we are providing you with appropriate and adequate support; and/or (iii) if required to do so for legal or service quality review reasons.

If you would like us to delete any personal and/or special category data that Mental Health Innovations may hold in relation to you, please text the word LOOFAH. You will be asked to confirm your request before any data is deleted. 

This Privacy Policy will inform you if, when and to whom we disclose your information; it will explain your Data Protection Act 2018 and General Data Protection Regulation (“GDPR”) rights relating to this information and what choices you have in how we use that information. So before using the Service, please read the following.


CONSENT

We send you a link to the Terms including this Privacy Policy in the automated text messages that we send you when you first contact us. In these messages, we ask you to consent to the processing of your personal data for the purposes listed in this Privacy Policy.

BY RESPONDING TO OUR INITIAL AUTOMATED CONSENT MESSAGE AND USING OUR SERVICE, YOU ARE PROVIDING YOUR CONSENT TO MENTAL HEALTH INNOVATIONS: 

(A) PROCESSING AND STORING YOUR PERSONAL AND/OR SPECIAL CATEGORY DATA, INCLUDING YOUR TELEPHONE NUMBER AND ANY INFORMATION YOU CHOOSE TO SHARE WITH US WHEN USING THE SERVICE; 

(B) TRANSFERRING YOUR PERSONAL AND/OR SPECIAL CATEGORY DATA TO SHOUT VOLUNTEERS AND MENTAL HEALTH INNOVATIONS STAFF IN COUNTRIES THAT EITHER HAVE EQUIVALENT DATA PROTECTION LAWS TO THE UK AND ARE DEEMED TO PROVIDE ADEQUATE PROTECTION TO PERSONAL DATA, OR WITH WHOM WE HAVE GDPR-COMPLIANT DATA TRANSFER ARRANGEMENTS; AND

(C) PROCESSING OF YOUR PERSONAL AND/OR SPECIAL CATEGORY DATA BY EXTERNAL IT SUPPORT STAFF LOCATED IN COUNTRIES THAT MAY NOT HAVE EQUIVALENT DATA PROTECTION LAWS, BUT WITH WHOM WE HAVE GDPR-COMPLIANT DATA TRANSFER ARRANGEMENTS,

FOR THE PURPOSES SET OUT IN THIS PRIVACY POLICY, INCLUDING THE PROVISION OF THE SHOUT SERVICE AND THE SHARING OF SUCH INFORMATION WITH THIRD PARTIES WHERE NECESSARY TO KEEP YOU SAFE. 

YOU CAN WITHDRAW YOUR CONSENT TO THE SENDING OF TEXT MESSAGES AT ANYTIME BY TEXTING THE WORD “STOP”.

IF YOU DO NOT CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSES SET OUT IN THIS PRIVACY POLICY, THEN WE RECOMMEND THAT YOU DO NOT CONTINUE TO USE THE SERVICE.


CHANGES TO THIS POLICY

The Policy may be changed from time to time. The most up-to-date Policy will always be the one that is posted here.  Changes to the Policy will be effective immediately upon our posting them here on our website.

If we decide to make any changes which affect how we use your personal data we will place clear notifications on the front page of our website for a minimum of a month prior to those changes being implemented. This is to allow you time to review them here. If you then continue to use the Service after that time we will take it that you agree to those changes. 

On each separate occasion that you first send a message to Mental Health Innovations to initiate a text message conversation, you will receive some automated reply messages with a link to the current Terms of Service and Privacy Policy, which will apply to your use of the Service.

In order to protect your confidentiality, we never initiate direct contact with you. We are therefore unable to notify you directly of any changes to the Privacy Policy. Your use of the Service after any such changes have been posted shall constitute your acceptance of the revised terms.


COLLECTION AND USE OF YOUR PERSONAL AND SPECIAL CATEGORY DATA

When you first message us we will have access to your mobile telephone number. We will retain this as we need it in order to enter into a conversation with you and provide you with the Service. We do not require you to supply any other data in order to access the Service. We do not even need your name. However, your use of the Service may involve the collection of personal data as outlined below.


WHAT PERSONAL AND SPECIAL CATEGORY DATA WE COLLECT

When you first contact the Service, we collect the telephone number through which you contact the Service. In order to make the conversation between you and our Shout Volunteer flow more smoothly you may wish to provide us with your name, but that need not be more than your first name (unless we request otherwise for safeguarding purposes or to protect your vital interests).

In respect of each text conversation, we will collect the following additional data: (a) technical metadata associated with your messages (such as the mobile carrier and message timestamps); (b) a record of your conversation with the Shout volunteer; (c) logs of any action that we are required to take if there is deemed to be imminent risk to you or to someone else, or safeguarding issues arise, or disclosure to third parties is otherwise required (see the section titled “CONFIDENTIALITY AND DISCLOSURE TO THIRD PARTIES” for more information); (d) your location data, if you choose to provide it (see the section of this policy titled “LOCATION DATA” for more information); (e) issues (from a specified list) that are tagged as pertinent to that conversation; and (f) any notes that the Shout volunteer and/or supervisor makes in relation to your conversation; and (g) the content of the post-conversation survey, if you choose to complete one.

When you are in conversation with us you may be upset or in a difficult situation. You may choose to tell us things that are deeply personal to you, that you may never have told another person. This could mean that you may tell us things which involve the following topics:

  • race;
  • ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • health;
  • sex life;
  • sexual orientation; or
  • criminal convictions or offences.

This list isn’t exhaustive, and you can choose to talk with us about anything you would like or need to. However, under the GDPR, the types of information listed above are classed as special category data. That means that we require your explicit consent in order to discuss any of these topics with you and use this information for the purposes described in this policy. In some limited cases where you can’t consent, or where we think your judgement may be compromised, we may need to use this information to protect your vital interests by ensuring you get the necessary support to keep you safe.

At the end of your text conversation, you will be invited to complete a post-conversation survey. This survey includes questions relating to your experience of using the Service and questions that help us to understand more about our texters. Completion of the survey is entirely optional. If you do decide to complete the survey and respond to these questions, we will collect the categories of personal data and special category data you choose to include in your post-conversation survey response.


LOCATION DATA

We do not routinely gather data about your specific location. If you message us, we do not automatically know where you are. There are occasions when we may ask you to give us your location. You are not under any obligation to give it to us. We will only ever ask for it if we feel that we need it to help you. You can find more information about this in the section of this policy titled “CONFIDENTIALITY AND DISCLOSURE TO THIRD PARTIES.”

We do collect general location data such as region and county in our optional post-conversation survey. You are not under any obligation to provide this information to us.  


HOW WE USE YOUR PERSONAL AND SPECIAL CATEGORY DATA

We use your personal data and special category data for the purpose of providing the Service and managing our relationship with you. In addition, we may use your personal data and special category data for other purposes, as described below. 

We use your telephone number in the limited circumstances in which we may need to work with third parties to locate you (see section titled “CONFIDENTIALITY AND DISCLOSURE TO THIRD PARTIES” for more information) and/or for the purposes of identifying you should you use the Service more than once. In the latter case, we do so in order to better support you and to better understand our overall service usage.

When you first message us, we use the information you provide to prioritise incoming messages. We do this by analysing the information you provide to assess whether you require urgent support. This allows us to respond more quickly to those in need of urgent support.

We also keep the text messages sent between you and your Shout Volunteer and the responses that you provided to the post-conversation survey if you chose to complete this. We retain this data because we have a legitimate charitable interest in providing the Service to our users.  In addition, we also use the personal data you provide to us for the following legitimate charitable purposes:

  • Internal purposes such as auditing, data analysis and research to improve our services, as well as ensuring that we are operating the Shout Service safely, effectively and in line with its objectives; .
  • Assessing the effectiveness of the Service and understanding ways in which we could enhance the Service and develop products that may complement the Service.

We also gather statistics relating to operation of the Service and this may include data linked to your text conversation and to your post-conversation survey (if completed). For example, we collect data on conversation volumes, conversation length and conversation substance (issues flagged by Shout Volunteers as relevant to the conversations that they handle), as well as aggregating data on matters such as the age and gender of our texters. This information is necessary for our legitimate charitable interests and helps us to understand overall usage of and engagement with the Service, to analyse relevant trends, to expand the reach of the Service, and to conduct research aimed at improving the quality of the Service. Any data processing for research purposes is conducted in accordance with applicable law. 

We will not share your personal data with any external party apart from in the limited circumstances set out in the following sections. Anonymised conversation data and survey response data (cleared of personal data to prevent identification) may be shared with external parties for purposes including, but not limited to, research into the Service, improvement of the Service, and generation of support for the Service and for Mental Health Innovations. Some of the data insights that we generate may be shared publicly and/or with partner organisations that promote the Shout service but this will only include data that has been aggregated and anonymised. Any data sharing with third parties will comply with the GDPR and any other relevant legislation.


CONFIDENTIALITY AND DISCLOSURE TO THIRD PARTIES

Mental Health Innovations respects and seeks to preserve the confidentiality of people who use our service. This confidentiality is based on the common law ‘duty of confidence’ and is shared between you, the service user and Mental Health Innovations.  Our Shout Volunteers and Supervisors also have an obligation of confidentiality. They will only use and disclose any information provided to them within the rules set by Mental Health Innovations. We do not routinely ask for location information. No identifying information or discussion between you and the service is disclosed to an external third party except in the exceptional circumstances outlined below.

We will always endeavour to get your consent before we contact a third party. However, there are situations, described below, where we will pass on information without consent. This may include where we are under a legal obligation to do so, or we need to share your information to protect your vital interests. 

If we deem that the situation is safe for you, we will work with you in making decisions about involving a third party. We will only share information with people or entities when the law allows us to do so.

We will always think carefully about whether we need to break confidentiality. This is especially important if you are a young person, aged under 18. We may need to break confidentiality and engage with a third party in the following circumstances:

  • We believe that your life is in imminent danger;
  • We believe that you or someone else is at risk of significant harm;
  • You are a young person, aged 17 or under, who is being hurt, abused or neglected;
  • You tell us, or we suspect that you have committed or are about to commit a serious crime; and/or
  • You tell us that you are endangering the safety of another person.

We are also unable to provide confidentiality in the following circumstances: 

  • A message sent to or through Mental Health Innovations contains specific information about a terrorist suspect or terrorist activity that will take place or has taken place in the world. This information must immediately be disclosed to the police;
  • Mental Health Innovations is forced through legal action to disclose specific confidential information; this can include legal action taken under the Data Protection Act 2018 and during criminal investigations.


POLICE, SOCIAL AND MEDICAL SERVICES

If one of our Shout Volunteers, working with their clinical supervisor, identifies imminent risk of harm to yourself or someone else (you have the desire, plan, means, timeframe) or suspects emotional/physical abuse or neglect, they may let you know they’re concerned about your safety. At this point, they might ask you for some identifiable information (such as your age, where you are and your name). If they and their clinical supervisor have concerns about your safety or you share information about the abuse of a child or young person, we may contact the police, medical, or social services. Where possible, we will obtain your consent to contact police, medical, or social services. However, in situations where you are unable to consent, or where we think your judgement may be compromised, we may still contact the police, medical, or social services in order to protect your vital interests and get you the help and support you need.


SHOUT VOLUNTEERS

We operate the Service in conjunction with Shout Volunteers and Mental Health Innovations staff. Any information, including personal and special category data, that you share with us may be viewed by Mental Health Innovations staff or Shout Volunteers for quality control, to contact emergency services or to better assist you with your needs.

If you provide feedback through an anonymous feedback survey, that feedback may also be shared with our staff and Shout Volunteers (albeit on an anonymised basis).


RESEARCH

We have created a formal process for sharing information about our text conversations and Service usage with researchers at universities and other institutions. We typically share anonymised data with trusted researchers when it will result in insights that create a better experience for our service users and/or enable a deeper understanding of the mental health landscape in the UK more generally. We will always follow best practices for sharing data based on the guidance from the institution’s ethics committee, and any relevant legal limitations or security checks.


OUTSIDE RESOURCES

Sometimes, we may provide information to you about another service. We will give you information to help you contact them, but we will NOT give them your contact information. It is up to you if you want to follow our signpost to their service. If you would like to receive support from other services, please note that different rules may apply to their use or disclosure of personal and special category data. We do not control the privacy policies of other services.


SERVICE PROVIDERS

We may share personal data with service providers that perform services on our behalf such as IT service providers, hosting providers and our advisers. For example, we have engaged with Crisis Text Line who provides certain IT services, including technology that allows us to prioritise incoming messages. This allows us to respond more quickly to those in need of urgent support. All service providers have entered into legally binding agreements requiring them to use personal data only as necessary to perform services on our behalf and to implement appropriate data security and confidentiality obligations, in accordance with applicable law.


THIRD PARTY SERVICES 

If you contact us through a third party service your information may be shared between us and that third party. For example, in the exceptional circumstances described above, we and the third party may exchange your location information to contact local police, medical or social services in an emergency.


OTHER THIRD PARTIES; LEGAL PROCESSES 

In certain narrow circumstances, we may disclose personal data that we collect from you to additional third parties if we believe such disclosure is necessary:

  • to comply with the law or in response to a court order, government request, or other legal process, including police investigations;
  • to protect the interests, rights, safety, or property of Mental Health Innovations, its affiliates, employees, or agents, including but not limited to Shout Volunteers.


OVERSEAS TRANSFERS

In order to ensure that we can provide a 24-hour service we use Shout Volunteers and Supervisors who may be based in different parts of the world. The locations include EU countries and New Zealand.  In providing the Service we are supported by technical staff who are based in the United States of America. In order to provide support, in some cases they may have to access material which includes personal data and some of the countries involved (such as the United States of America) do not have data protection laws equivalent to those that we have in the UK. 

Where personal data is transferred to recipients located in countries that have not been recognized as providing an adequate level of data protection (such as the United States of America), we ensure that appropriate safeguards are in place, including by entering into the Standard Contractual Clauses with the data recipients. To obtain a copy of the safeguards we have put in place, please contact us as indicated below.


RETENTION OF INFORMATION

We retain and store two different types of data after our conversation with you. Your personal and special category data, including your telephone number and the record of all the text messages that you exchange with us and any responses provided to the post-conversation survey, will be stored for up to 7 years after you last contact us. Once this time has passed we will permanently delete this data from our records. If you contact us again after this time, you will appear to be a new service user. We will not have any record of our previous conversations with you.

We anonymise the data that is extracted from our conversations with you. This anonymised data will be retained indefinitely. This data is independent of the text record and cannot be attributed to you. We keep this data as it helps us to improve our own services and it contributes to our data set.


HOW WE PROTECT YOUR PERSONAL AND SPECIAL CATEGORY DATA

We take the protection of your data very seriously. We take administrative, technical, and physical measures, to protect your personal and special category data from loss, theft, misuse, unauthorised access, disclosure, alteration, and destruction. We store all information on servers within the UK and we only permit approved employees and third parties, such as our data processors to access those servers.

We employ different security techniques to protect your personal and special category data from unauthorised access, including standard encryption practices. However, perfect security does not exist anywhere, including for text messaging/SMS data. Although we believe we take appropriate measures to safeguard against unauthorised disclosures of information, we cannot assure you that your personal and special category data or communications with Mental Health Innovations will never be disclosed in a manner inconsistent with this policy and make no representations or warranties regarding the sufficiency of our security measures to prevent unauthorised access or interception by third parties.


YOU SHOULD ALSO PROTECT YOURSELF

Always be careful and responsible regarding your personal and special category data.

You might want to delete our conversations from your phone. You might even want to clear us from your history and make sure we are not saved in your contact list.


YOUR RIGHTS REGARDING YOUR PERSONAL AND SPECIAL CATEGORY DATA

If you wish to exercise any of your rights, as listed below please write to us at dataprotection@mhiuk.org or the address below for:

  • Access to your personal data;
  • Objection to processing of your personal data;
  • Objection to automated decision-making;
  • Restriction of processing of your personal data;
  • Your personal data portability;
  • Rectification of your personal data; or 
  • Erasure of your personal data.
  • If you make a request relating to any of the rights listed above, we will consider each request in accordance with all applicable data protection laws and regulations. No administration fee will be charged for considering and/or complying with such a request unless the request is deemed to be excessive in nature. 

Upon successful verification of your identity you are entitled to obtain the following information about your own personal data:

  • The purposes of the collection, processing, use and storage of your personal data.
  • The categories of personal data stored about you.
  • The recipients or categories of recipients to whom your personal data has been or may be transmitted, along with the location of those recipients.
  • The envisaged period of storage for your personal data or the rationale for determining the storage period.
  • The use of any automated decision-making and/or profiling.

You may request that we delete your personal and special category data, such as your name, physical address (if applicable), phone number, and texts/message transcripts by texting in the keyword LOOFAH to 85258, after which you will be prompted to confirm your request.

You can make any of the other above requests by emailing dataprotection@mhiuk.org or by writing to:

Data Protection Officer

Mental Health Innovations

21 Whitefriars Street,

London

EC4Y 8JJ

We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.


COMPLAINTS

If you have any questions or concerns about this Privacy Policy and our privacy practices or if you wish to file a complaint, please contact us by emailing dataprotection@mhiuk.org or by writing to Mental Health Innovations’ Data Protection Officer at the above address.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been processed in a way that does not comply with the GDPR. You can do so by calling the ICO helpline on 0303 123 1113 or via their website.


Data Protection Officer

Contact the Mental Health Innovations Data Protection Officer by emailing dataprotection@mhiuk.org or by writing to:

Data Protection Officer

Mental Health Innovations

21 Whitefriars Street,

London

EC4Y 8JJ