Cookies & Privacy Policy
Welcome to Amplify- Privacy Notice
This Privacy Notice is aligned to the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018. These laws are defined in this notice as the Data Protection Laws.
This Privacy Notice applies to personal data collected by Amplify-YP. The Data Protection Laws applies to personal data’, as defined by the Data Protection Laws, which means any information that relates to an identified or identifiable natural person. It does not include data that has been anonymised so that the individual can no longer be identified (anonymous data).
The Short Version
English
What you need to know about privacy:
● Your information will remain confidential. We respect your privacy rights.
● In rare cases, we may need to share data without consent where there is a severe health risk or
we are legally required to.
Española
Lo que necesita saber sobre la privacidad:
● Su información permanecerá confidencial. Respetamos sus derechos de privacidad.
● En casos excepcionales, es posible que necesitemos compartir datos sin consentimiento cuando exista un riesgo grave para la salud o cuando estemos obligados legalmente a hacerlo
Français
Ce que vous devez savoir sur la confidentialité :
● Vos informations resteront confidentielles. Nous respectons vos droits à la vie privée.
● Dans de rares cas, nous pouvons être amenés à partager des données sans consentement lorsqu'il existe un risque grave pour la santé ou lorsque nous y sommes légalement tenus.
Deutsch
Was Sie zum Thema Datenschutz wissen müssen:
● Ihre Angaben bleiben vertraulich. Wir respektieren Ihre Datenschutzrechte.
● In seltenen Fällen kann es erforderlich sein, dass wir Daten ohne Einwilligung weitergeben, wenn ein ernstes Gesundheitsrisiko besteht oder wir gesetzlich dazu verpflichtet sind.
Italiano
Cosa devi sapere sulla privacy:
● I tuoi dati resteranno riservati. Rispettiamo i tuoi diritti sulla privacy.
● In rari casi, potremmo dover condividere i dati senza consenso laddove sussista un grave rischio per la salute o siamo obbligati per legge a farlo.
Chinese (simplified) 中文(简体)
关于隐私您需要了解的信息:
● 您的信息将保密。我们尊重您的隐私权。
● 在极少数情况下,如果存在严重的健康风险或法律要求我们这样做,我们可能需要在未
经同意的情况下共享数据。
Guānyú yǐnsī nín xūyào liǎojiě de xìnxī:
● Nín de xìnxī jiāng bǎomì. Wǒmen zūnzhòng nín de yǐnsī quán.
● Zài jí shǎoshù qíngkuàng xià, rúguǒ cúnzài yánzhòng de jiànkāng fēngxiǎn huò fǎlǜ yāoqiú
Japanese 日本語
プライバシーについて知っておくべきこと:
● あなたの情報は機密として扱われます。 私たちはあなたのプライバシーの権利を尊重しま
す。
● まれに、重度の健康リスクがある場合、または法的に義務付けられている場合、同意なしに
データを共有する必要がある場合があります。
Puraibashī ni tsuite shitte okubeki koto: Anata no jōhō wa kimitsu to shite atsukawa remasu. Watashitachi wa anata no puraibashī no kenri o sonchō shimasu. Mare ni, jūdo no kenkō risuku ga aru baai, matawa hōteki ni gimudzuke rarete iru baai, dōi nashi ni dēta o
1. Important Information and who we are
Amplify-YP is a limited company registered in England and Wales (registered number 12207073).
Amplify-YP is a data controller under the UK GDPR and other applicable data protection laws in the jurisdictions where it operates, including the EU General Data Protection Regulation (GDPR). This Privacy Notice covers global collection and processing of personal data across our areas of operation, including the UK, European Union, United States, and Asia Pacific regions. In delivering services, we may work closely with other healthcare providers and employers who may also be independent data controllers of personal data. We respect privacy rights and are committed to operating at the highest standards when it comes to protecting personal data, no matter where it originates.
We will process your personal data “fairly”, “lawfully” and “transparently”. This means (i) we will be open and transparent about how personal data is used (ii) we will handle data in line with how we say we are going to handle data and (iii) we will only use or process personal data in accordance with the law. To fulfil these requirements, we set out in this Privacy Notice how Amplify-YP collects, uses, retains and discloses personal data. We also comply with applicable confidentiality guidelines published by regulators and professional bodies (e.g. The Health & Care Professions Council Confidentiality – guidance for registrants).
It is important that you read this Privacy Notice so that you understand how and why we are collecting and/or processing personal data about you. If you have any questions, please contact us at the address provided below.
Data Protection Officer
Amplify-YP has appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO at:
Email address: enquries@amplify-yp.com
Postal address:
St James House, 65 Mere Green Road, Sutton Coldfield, West Midlands, United Kingdom, B75 5BY
Telephone number: TBC
Filing a Complain
If you wish to file a complaint about our data processing, please contact our DPO first. You also have the right to lodge complaints directly with the UK Information Commissioner's Office (ICO), the lead supervisory authority for Amplify-YP:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: +44 (0)303 123 1113 Website: https://ico.org.uk
We would appreciate the chance to address concerns directly first, but individuals have the right to
contact the ICO at any time if they prefer.
How is Personal Data Collected?
Amplify-YP is contracted by your employer to provide an Emotional and Psychological Wellbeing service to you. To provide this service we collect information about you which includes personal information about you and about your health and wellbeing. We collect your personal data in a number of ways. These include:
i. Direct interactions
You may give us your identity and contact data by filling in forms or by corresponding with us by post, phone, email, online or otherwise.
ii. our employer’s HR department, your work manager, your work colleagues, other health care professionals and health care providers.
Your manager, HR department or colleague may share correspondence with us (i.e., refer you to our service) on your behalf about your emotional or psychological wellbeing - we may contact you for this reason. If you do not agree to receiving the service when we contact you, we will close the referral.
iii. Others who are involved in meeting your wellbeing needs To effectively support and coordinate your ongoing wellbeing needs, and with your expressed permission (see section 4 below), Amplify-YP will collect information from and/or share information
with healthcare professionals, private medical insurance providers and other health care providers about your care and wellbeing needs.
![Amplify Footer [ 1728 ] (3).png](https://static.wixstatic.com/media/585679_0a34d144961b4c21a6bd89f50fe5bd7a~mv2.png/v1/fill/w_980,h_393,al_c,q_90,usm_0.66_1.00_0.01,enc_avif,quality_auto/Amplify%20Footer%20%5B%201728%20%5D%20(3).png)
3. The Data we collect about you
We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:
i. Identity
This may include your name and age.
ii. Contact details
This may include your address, e-mail address and phone number(s), and place of work. We also process the following special categories of sensitive personal data:
iii. Information about your physical and mental health and patient records:
Information about your physical and mental functioning, any ailments, diseases or disabilities and health data.
iv. Other sensitive data:
This may include, race or ethnicity, religious or philosophical beliefs, political opinions, sex life, sexual orientation and, sometimes, information about criminal offences (if relevant to your wellbeing).
These special categories of sensitive personal data are subject to a higher level of protection.
If you fail to provide personal data
Where we need to collect personal data to perform the terms of the service we are contracted to provide to you, and you fail to provide that data when requested, we may not be able to provide the service.
4. How we use personal data and our legal basis for processing
-What we do
*Use the data provided in referrals, webforms and face-to-face requests provided by the you or from your employer representative (e.g. your manager or HR representative) on your behalf
*Provide our core services of the Emotional and Psychological Wellbeing services:
- Advice & Signposting
- Case management
- Claims and referral advocacy
- Brief emotional containment work
*Contact you regarding the services we provide
*Responding to complaints
*Retain personal data under our data retention policy after the service with you has ended
*Report a crime, a significant risk to self or risk to others or comply with a legal investigation.
-UK and EU Lawful basis
*GDPR Article 6(1)(b) {performance of a contract} - when you or your employer’s representative provides us with your personal data or that of your relative, for instance to obtain advice and signposting, this is a necessary step to perform the contract.
*GDPR Article 6(1)(b) {performance of a contract}
- In providing the core services we are performing the contract with you, our data subject
*GDPR Article 6(1)(a) {Consent}
– we need consent from you to advocate on your behalf with your employer, medical insurance claims and referrals to care and wellbeing services (e.g., to the NHS)
*GDPR Article 9 (2)(h)
– {medical diagnosis, the provision of health or social care treatment or management of health or social care systems or a contract with a health professional} in order to provide emotional containment, preventative advice and support access to appropriate healthcare.
*GDPR Article 6(1)(f) {legitimate interests}
- we may contact you for our legitimate interests so that we can gather more information for the provision of our services, or to deliver those services most effectively; for example, to request you complete a customer service satisfaction survey.
*GDPR Article 6(1)(b) {performance of a contract}
- In responding to complaints we are performing the contract with you, our data subject.
*GDPR Article 6(1)(f) {legitimate interests}
- we need to retain the Investec employee’s personal data for only as long as necessary under the law to protect our legitimate interests. This includes providing your employer with anonymised aggregate data on activity and performance and using such aggregate data to provide analytical insights so your employer can be more responsive to its workforce wellbeing needs.
*GDPR Article 6(1)(c) {compliance with legal obligations}
- we must comply with our legal obligations
*GDPR Article 6(1)(d) {Protect the vital interests of the data subject or of another living person}
- we may need to share information to protect your life or the life of someone else if the person does not have capacity to make that decision; for example, the person is mentally incapacitated and we cannot rely on another lawful basis for sharing.
Copyright © 2024 All Rights Reserved.
US Legal Bases
We process data as allowed under relevant laws such as:
-
State data privacy laws (e.g. California)
-
Laws permitting healthcare data processing
-
Regulations allowing communications and operations for services
Asia-Pacific Legal Bases
We process data based on:
-
Consent from individuals where required
-
Contracts with clients and vendors
-
National laws governing data and healthcare
Where personal data is subject to multiple regional privacy laws, we adhere to the strictest applicable standard.
We may also process your data for the establishment, exercise or defence of legal claims; and in some cases, with your consent.
Please contact the Amplify-YP Data Protection Manager if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table above.
5. Do I have to consent to the processing of my data?
Health data is data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that person's health status.
The conditions under which we seek consent are listed under section 4.
Amplify-YP will also comply with clinical confidentiality guidelines (such as the Health & Care Professions Council) in relation to the sharing of any health records.
6. Confidentiality and patient’s records
In addition to the protections under the Data Protection Laws, your health data are also subject to the Common Law Duty of Confidentiality.
In receiving the referral we assume consent under common law – whether expressed or implied (implied consent means that the subject knows or would reasonably expect the proposed use or disclosure and has not objected)
We may be authorised or required by law, for example under statute, common law (including duty of care) or legal proceedings to share information with statutory authorities. There may also be an overriding public interest, for example where a person is contagious, or the public is at risk, such that there is a public interest in disclosure that overrides the public interest in maintaining confidentiality.
7. Change of Purpose
We will only use your personal data for the purposes described in this Privacy Notice. If we need to use your personal data for an unrelated purpose, we will update this Privacy Notice and notify you in accordance with the Data Protection Laws.
8. Cookies
Cookies are small text files that are placed on your computer, smartphone or other device when you visit our website. We may use cookies in order to improve our services and optimise our website.
For more information about cookies, including how to view the cookies that have been set and how to manage or delete them, please visit www.allaboutcookies.org
9. Data Anonymisation and Aggregation
As outlined in section 4 above, your personal data may be converted into statistical or aggregated data which cannot be used to identify you, and then used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described above.
10. Children
We understand the importance of taking extra precautions to protect the privacy and safety of children. In some situations we may collect information provided to us about family members of referred employees if it is relevant to the wellbeing referral.
If you are a parent or guardian and would like to access, correct, delete or exercise any of your child’s data protection rights, please contact us using the contact details provided in section 1 above. We may need to ask you additional information to confirm that you are the child’s parent or legal guardian.
11. Disclosure of Personal Data
Third Party Recipients
We may share personal data globally with:
-
Healthcare providers, insurers, therapists
-
Suppliers acting as data processors (see list below)
-
Law enforcement, courts, regulators where required/permitted
-
Legal and professional advisors
Our data processors include:
-
Google Workspace for email, calendar, contacts, word processing, online feedback forms and statistical analytics.
-
Pipedrive - The cloud CRM system is used to store our appointment, contact and activity data
-
Tutanota - an end-to-end encrypted email solution for communicating sensitive data with others such as Investec employees; e.g., their health data
-
Wix - for website hosting
-
Acuity Scheduling - for online appointment scheduling
-
Toll Free Forwarding - a virtual call forwarding system to route inbound phone call enquiries through a single phone number to our staff
-
Whereby - secure video calling platform
-
Signal Private Messenger - end-to-end encryption messaging and video calling app
-
Notion - for sharing of internal company business resources and information (i.e., not personal sensitive information)
We generally seek consent before sharing data externally, besides exceptions like healthcare emergencies.
We will not share health data with an employer without consent, unless severe risk is identified. For example, in the UK if there is an imminent and severe risk to self or others, we will make a clinical judgement as to whom to disclose the information under GDPR Article 6(1)(c) (compliance with legal obligation) or GDPR Article 6(1)(d) (protect vital interests).
We may share your personal data with more parties than the ones listed above. Should this be the case, we will inform you of the change in accordance with applicable laws and regulations.
External parties must protect data privacy and only use it per our instructions.
Transfers outside the EEA
Personal data may be transferred globally to parties noted above. For transfers from the EEA to other regions, we utilise mechanisms such as:
-
Standard Contractual Clauses with entities in third countries
-
Binding Corporate Rules for data shared internally
These provide adequate protection for the data per GDPR standards. Other legal safeguards may also apply to legitimise transfers. We take steps to secure personal data no matter where it is processed.
12. Data Security
At Amplify-YP we take our duty to protect personal data and our confidentiality obligations seriously. We are committed to taking all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible, whether computerised or on paper.
Amplify-YP has also appointed a Data Protection Manager (DPM) who has professional experience and knowledge of data protection law, specifically in relation to the type of processing that Amplify-YP carries out.
Everyone who works for us is required to undertake annual information governance and cybersecurity training and is provided with information governance and acceptable usage (of IT equipment) policies that they are required to read, understand and agree to follow. Amplify-YP’s policies ensure the healthcare professionals who provide our services are aware of their information governance responsibilities and follow best practice guidelines ensuring the necessary safeguards and appropriate use of
person-identifiable and confidential information.
Additionally, everyone working for Amplify-YP is subject to the common law duty of confidentiality and standards set by statutory bodies such as the HCPC. Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.
We have put in place appropriate security measures, including encryption and using anonymisation or pseudonymisation processes where necessary, to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those Amplify-YP employees, agents, contractors and other third parties on a “need to know” basis. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach in accordance with applicable laws and regulations.
Data Protection Impact Assessment (DPIA)
We carry out DPIAs on processing that is likely to result in high risk to individuals to help identify and minimise data protection risks.
If you would like a copy of a DPIA that we have carried out, please contact our DPM.
15. Questions?
If you have any questions about our Privacy Notice, information we hold about you or complaints about how we process your personal information please contact the DPM (contact details above). Complaints can also be made to the Information Commissioner’s Office, the UK supervisory authority for data protection issues (www.ico.org.uk).
13. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting/analytics requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available in our retention policy which you can request by contacting our DPM.
14. Your Legal Rights
You have the following rights under Data Protection Laws regarding your personal data. Certain rights may vary slightly by jurisdiction. Individuals should consult the privacy laws applicable to their location for any restrictions or exceptions related to these access rights.
-
Request access to your personal data. The Data Protection Laws gives you certain rights to see the information that Amplify-YP holds about you and why.
-
We will confirm whether we are processing your personal data and we will provide you with
-
additional information including what type of data we have, where we collected it from, whether we send it to others, including any transfers outside the EEA, subject to the limitations set out in applicable laws and regulations. We will provide you free of charge with a copy of your personal data, but we may charge you a fee to cover our administrative costs if you request additional copies of the same information.
-
Request correction of your personal data. You can ask us to correct any incomplete or inaccurate data we hold about you, although we may need to verify the accuracy of the new data you provide to us.
-
Request erasure of your personal data. You can ask us to delete or remove personal data in certain cases, subject to any legal requirements on data retention or exceptions that apply based on your jurisdiction. We will let you know if this is the case, at the time of your request.
-
Object to processing of your personal data. You can object to certain data processing activities, subject to limitations of applicable regional laws and regulations, where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. However, we may not always be able to comply with your request for legal reasons, and we will let you know if this is the case, at the time of your request.
-
Request restriction of processing your personal data. You can ask us to restrict the processing of your personal data in certain cases.
-
Request transfer of your personal data. You can ask us to transfer your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note this right only applies in certain cases.
-
Right to withdraw consent. You can withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to or for you. We will advise you if this is the case at the time you withdraw your consent.
To make a request or exercise any data protection rights, contact our Data Protection Manager with your name, address and proof of identity so we can verify your request.
Additional Rights
Depending on your location, you may have other rights under privacy laws including:
-
Request restriction of processing - You can ask us to restrict use of your data in some cases, subject to exceptions.
-
Request data portability - In some jurisdictions, you can ask for a transfer of your data. Availability of this right varies by region.
-
Withdraw consent - Where consent forms the legal basis for processing, you can withdraw it at any time. Withdrawal impacts the services we can provide in some cases.
-
Other consumer privacy rights not listed may also apply depending on the privacy laws in your specific country or state of residence.