Who are we?

The mission of Blue Smile is to improve the mental health and emotional wellbeing of Cambridgeshire children through expert arts-based therapies.

Blue Smile is the controller for the personal information we process, unless we state otherwise.

You can contact us about data privacy by email, post or phone via the Charity Director, Blue Smile, 47-51 Norfolk Street, Cambridge, CB1 2LD, on email to info@bluesmile.org.uk or call us on 01223 314725.

Registered numbers:

• Charity: 1139279
• Company: 411348 (registered in England and Wales)

The Privacy Statement explains how and why we use your personal data, to ensure you remain informed and in control of your information.

What type of personal information do we collect?

We collect, process and store three main types of personal information:

• clinical records in order to ensure clients are provided with appropriate and supportive services in schools
• recruitment and HR records about our employees, contracted practitioners and volunteers in order to fulfil our record keeping obligations as employers and contractors
• supporter records relating to our fundraising activities in order to comply with legal and financial obligations and to keep them informed

How do we obtain your personal data?

Most of the personal data we process is provided to us directly by you when you:

• use our clinical services
• apply for a practitioner role
• apply for a job or volunteering role
• sign up to one of our trainings
• request information about our activities and services
• make a donation to us
• fundraise on our behalf
• register for an event
• enter into a contract with us
• get in touch with us via phone, website or other method

The type of information we collect will vary according to how you are engaging with us and we always ensure we only collect the information necessary to fulfil this engagement.

Sometimes we collect your personal information indirectly from third-party fundraising organisations including Charities Aid Foundation (CAF), Localgiving and Eventbrite when you use their services to make a donation to us or sign up for events and training. These third parties only share your information with us with your consent. You should check their Privacy Notices when you provide your information to understand fully how they will process your data.

No personal information is automatically collected by Blue Smile as a result of using our website or social media. We only collect data if you choose to interact with us via the website, for example by making a donation or completing a form. 

Our website uses cookies to support functionality and improve the security of the site.  For more information about cookies, please read our Cookies Notice. 

How we handle clinical records

We recognise that the information we collect to support our clinical work is likely to include sensitive personal data so we handle our clinical records very carefully including but not limited to the following ways:

• we obtain consent to process personal data
• for children, we obtain parental written consent and a child’s verbal consent to process personal data
• we keep brief and factual notes on children and families which are handwritten or recorded in our cloud-based clinical data system
• we use a leading Client Record Management database which hosts data using secure, highly reputable Data Centres in the UK 

• all information is kept securely and access is highly restricted to highly trained staff bound by confidentiality agreements
• information may be used for monitoring and evaluation purposes in order to improve current and future delivery of services
• information is anonymised when shared or used for evaluation and reporting
• if diversity information is collected, all reporting will be anonymised
• data are only shared where Blue Smile has a legal obligation to do so or to protect the vital interests of an individual

How we handle HR and recruitment records

We use personal data that you provide to:

• process an application for employment, volunteering, placement or practitioner role: we may process your data to ascertain suitability and for the performance of contract (or prior to entering into a contract)
• share appropriately with the third party, external payroll bureau and pension provider and HM Revenue & Customs
• maintain an employment relationship

The above list is supplied for illustration and is not exhaustive.

How we handle fundraising data

We use personal information to fundraise, process donations and stay in touch with our supporters to:

• thank them and keep them updated on what we have achieved with their support
• let them know about any events or opportunities that may be of interest to them

Any telephone or electronic (email) marketing is only undertaken with your prior consent.  We may process your personal data and send you marketing communications by post when this is in the “legitimate interest” of the charity, for example sending you information about our work that we believe may be of interest to you.   

In order to process donations and communicate with you effectively, we use third parties to store and process personal information linked to our fundraising activities: 

• we use a leading fundraising and donor management database that stores data on servers located in the USA. The transfer of data is protected by the EU-US Privacy Shield Scheme
• we use third-party fundraising organisations to process donations and other payments, including JustGiving, Localgiving and Charities Aid Foundation. Please see their privacy statements for more information. They store and process your data and share personal information with us where you have given consent – including your name, address, email address, phone number, amount of donation, Gift Aid status. We do not receive your payment card details.  
• we may occasionally share data with third-party providers, in which case these “data processors” act only under our instructions and are not permitted to use your information for their own purposes. 

We will never sell your data to third parties, and you will not receive offers or communications from other companies or organisations as a result of giving your details to us.

How long will we keep your information?

We will retain any personal information for no longer than necessary for the purposes for which it was collected, taking into account guidance issued by the Information Commissioner’s Office (ICO).

We will keep your personal information in respect of any financial transaction for as long as the law requires us to for tax or accounting purposes which may be for up to seven years.

Clinical information is deleted/destroyed after seven years.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.

Your right to rectification

You have the right to ask us to correct information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to processing if we are able to process your information in certain circumstances.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or if the processing is automated under, or in talks about entering, a contract.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

Please contact the Charity Director, Blue Smile, 47-51 Norfolk Street, Cambridge, CB1 2LD, on email to info@bluesmile.org.uk or call 01223 314725 if you wish to make a request.

If you and/or your child are being supported within our clinical service, you may choose to speak to the therapist in school who will pass on your request.

If you are a Blue Smile employee, contracted practitioner, or volunteer, you may choose to speak to your line manager or the staff member coordinating your role who will pass on your request.

If you are not happy with the way we have handled your data and are unable to resolve the issue with us personally, you have the right to lodge a complaint with the Information Commissioner’s Office, the UK’s independent body set up to uphold information rights.

You can read more about your rights here: https://ico.org.uk/your-data-matters/

Updates to this statement

We will update this Privacy Statement from time to time so you may wish to check it each time you submit personal information to Blue Smile. This policy was last updated on 2nd February 2024.