A Privacy Notice is a legal requirement when an organisation collects personal data. This is to make sure that individuals understand why we are collecting their data, what we do with it and how long we keep it for.
This Privacy Notice is for children and families who use clinical services at the Anna Freud National Centre for Children and Families (AFNCCF). If you have any questions about the content of this notice you can contact us at:
Anna Freud National Centre for Children and Families, 12 Maresfield Gardens, London NW3 5SU
Tel: 020 7794 2313
Our Data Protection Officer is: Susan Henry
Tel: 020 7794 2313
Information we record
To provide you with the most appropriate and high-quality care we need to collect and process your personal data. This requires us to keep records about you, your health and the services we have (or plan to) provide you with.
Personal information such as details of your health is sensitive data and rightly requires additional protection. Under the General Data Protection Regulation (GDPR) sensitive information is referred to as Special Category Data.
We usually receive your information directly from you. We may also receive referral information from health or social care professional or legal representative on your behalf.
We respect your rights to confidentiality and are careful to only collect the data that is necessary to provide the service you require.
Lawful basis for processing your data
To collect and use your data we need to have a lawful basis for processing. Under the GDPR 2018, we use the following lawful basis to process your data:
- 6(1)(f) Legitimate interests – this is our usual legal basis for processing of your data, as processing is essential for the purposes of providing a safe and effective assessment or treatment service. Note that is purpose does not override your individual rights and freedoms.
- 6(1)(b) Contract – this applies when we have a contract to provide services to you. This may be with a local authority or the legal service commissioning the work. You will usually know if this applies to you but please check with your clinician if you are unsure.
We may also ask you whether we can use your data for training and research purposes, or to contribute to publications. We will never do this without your permission. In these instances, our lawful basis for processing your data is:
- 6(1)(a) Consent – you have agreed to let us use your data. This legal basis offers you additional rights, such as the right to withdraw your consent.
We do not share information without your knowledge or permission unless we are legally required to so. In these instances, our lawful basis for sharing your data is:
- 6(1)(c) Legal obligation – necessary for compliance with the law.
Because we process special category data we are required to comply with additional conditions for lawfully processing your data.
Generally, we rely upon
- 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment
Detailed information about all valid lawful basis for processing data can be found on the Information Commissioner’s Office (ICO) website:
Sharing your data
We understand how important confidentiality is and abide strictly to data protection laws that allow us to share information only with your knowledge and permission, or in rare circumstances when we are legally required to do so or where we consider it to be in your best interest to do so.
To provide you with a safe and effective care, we standardly inform your GP that you are using our service, as necessary and only with your knowledge. We may also share relevant information with other health professionals involved in your or your child’s care, as necessary and only with your knowledge and permission. They have the same duty of confidentiality towards your data.
To develop our understanding of how to best help children and families and to evaluate whether our work is effective, we collect outcome measures from you at various points in your treatment and / or assessment. The scores from the outcomes data are entered into our Patient Outcomes Database (POD) to assist with the evaluation of the data. The data held in this database is pseudonymised which means that all identifying information is removed and replaced with a code, so you cannot be easily identified.
If we are providing a service as part of a contract or commission with another organisation, we may share anonymous evaluation data with the commissioning organisation, which would not contain identifiable information.
Our Parent Infant Project (PIP) is commissioned by the London Borough of Camden. As part of our contractual agreement for providing PIP to Camden families, anonymised aggregate evaluation data is shared with Camden Children's Commissioning on a quarterly basis. No identifiable information is included in this data.
Where the work is carried out to inform on-going legal proceedings or pre-proceedings, the results of the work may be shared with all parties to the proceedings. The exact terms of sharing will always be set out in the Letter of Instruction.
Anybody we share information with has a legal obligation to keep your information confidential.
Where we keep your data
We keep your data, securely, on UK based servers and premises. We do not routinely transfer your data outside the EEA but would do so only with your knowledge and when we are sure appropriate security is in place to keep it safe.
Our IT Provider is UK based with a support office in South Africa, from where they may access our IT systems. A contract in in place to ensure that data security meets GDPR requirements.
How long we keep your data
If you have received a service at our Centre with your child, we will securely retain your case files until your child’s 25th birthday. This is in line with NHS retention periods and we periodically review to ensure it is still appropriate. Case files are securely disposed of at the end of their retention period.
Where we use data for training purposes, the length of retention will be clearly specified when you consent to the use of your data. At the end of this period your data will be securely disposed unless you withdraw your consent earlier, in which case we will stop using the material and dispose of any copies.
Your data rights
The GDPR has been written to ensure that your rights are central to how an organisation manages your data. You have certain rights, depending on the legal basis for processing, that you can exercise at any time.
- The right to be informed – this privacy notice informs you about why and how we use your information.
- The right of access – you may ask us for a copy of the information we hold about you. This is called a Subject Access Request (SAR)
- The right to rectification – if any data about you is inaccurate or out of date you can ask us to correct it.
- The right to erasure – in certain circumstances you can ask us to delete your data.
- The right to limit use of your data – in certain circumstances you can ask us to stop processing your data.
- The right to object to use of your data – this applies in some circumstances.
- The right to data portability – an easily transferable copy of your data, this generally refers to online services, but we can provide a copy.
- Rights in relation to automated decision making and profiling. We do not use automated decision making and profiling.
You can read more about your data rights on the Information Commissioner’s Office website:
You can contact the Data Protection Officer (DPO) if you want to discuss these rights or make a request to see your data. Contact details are at the top of this notice.
Withdrawing your consent
Where we rely on Consent as the legal basis to process your data, you are entitled to withdraw your consent at any time and we will stop processing your data for that purpose. This applies to consent for additional uses of your data, such as for training or research purposes.
Consequences of not providing data
There is no statutory obligation for you to provide us with your personal information. We ask for sufficient information to assess your enquiry or referral for services. If the requested information is not available, we may not be able to decide about a referral or about the most appropriate service for you. It helps us if you can provide the information we ask for, but you are not obliged to provide it.
If you or your child have been referred to our service by legal services or by the request of the courts, you are not obliged to provide us with your personal information. Failure to provide necessary details may however be notified to the legal department referring you or your child.
We do not use profiling or automated decision making when processing your data for any purpose.
We realise this is a long notice with language that you may be unfamiliar with, however, we are legally obliged to tell you a lot of things about you rights and our responsibilities when we process your personal information.
We hope that the information we have provided makes sense but please do ask if anything is unclear. A shorter version of this notice is available at the Centre and any staff member can talk you through the notice and your data rights if you have any questions.