Privacy Policy - Service Users

This privacy policy describes what information we hold about our members and service users, why we hold it, how we hold it and how long we will hold it for. It also explains how you can find out what information we hold about you and who to tell if you wish us to stop holding it.

The type of personal information we collect

The following list gives examples of the data SMHF holds for members and service users.  This list may vary from person to person:

  • Personal contact information
  • Key worker information
  • Next of kin/carer contact details
  • Medical information
  • Sensitive personal information (e.g. ethnic origin, gender, date of birth, disabilities, mental health, triggers, faith, living arrangements, sexual orientation)
  • Support needs
  • Personal information relating to benefits claims etc
  • Pictures and video recordings

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons: so that we can provide you with services, let you know about upcoming activities and any service changes, and so you can tell us what you think about our services, and other services you may use.

We also receive personal information indirectly, from the following sources in the following scenarios:

Organisations providing health and social services who may refer you to us for services.

We use the information that you have given us in order to provide you with services, either face to face, by telephone or by video call, keep you informed by letter and email, and to comply with the law e.g. to keep you safe.  We may also use this information to improve our services.

We may share this information in an anonymised form with our commissioners (e.g. London Borough of Sutton and South West London ICB), for monitoring how our services are used and how effective they are, and for passing on your concerns or praise about other commissioned services you use.

From April 2024 we are required to provide information about people who use our services with the NHS for use in planning.  This is called the Mental Health Services Data Set.  This information is anonymised when it leaves SMHF, but it may be linked with other information the NHS holds about you.  You can decide to opt out of this, please email Mandy Oldfield at for more information.

SMHF is National Data Opt Out compliant; if you have chosen not to share your personal information as part of the NHS National Data Opt Out scheme, we have the processes and systems in place to make sure we respect your wishes and do not share such data about you.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing your information are:

(a) Your consent. You are able to remove your consent at any time. You can do this by contacting Mandy Oldfield at, or by writing to us at the address below.

(b) We have a legal obligation (e.g. health & safety or safeguarding).

(c) We have a legitimate interest – to provide a service to you.

How we store your personal information

Your information is securely stored on CharityLog and in locked filing cabinets where paper copies are needed.  Once information is input into CharityLog, paper copies will be securely destroyed.

We will remove your details from our system within 2 working days of you notifying us that you no longer wish to use our services. If you do not inform us, we will remove your information 12 months after your last use of our services.

Photos and videos will only be used with appropriate consent, which will last for 5 years.  Images will be stored securely on the cloud - using one drive or a similar programme.  After 5 years they will be deleted.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at, or write to the above address if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at, or write to the above address. You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lan

Helpline number: 0303 123 1113

ICO website:


Click on the button below to download a copy of our Privacy Notice for service users.
Privacy notice - Service users