Privacy Notice

Effective date: 17 September 2018

Under the General Data Protection Regulations we are obliged to tell you how we use your personal Information. Teesside University have engaged SilverCloud to provide an online multimedia self-help programme to Teesside University staff and students. If you wish to use this facility you will be asked to provide certain personal information. You will be asked to provide your University email address. Teesside University controls the personal information provided and SilverCloud processes that information using the online platform. SilverCloud uses sub processors to assist them in providing the online platform, details of these third party processors can be accessed at the following link: https://www.silvercloudhealth.com/privacy/platform/#subprocessors

The personal information that you have provided will be kept on a database which is part of the SilverCloud package and will be accessible by the University and SilverCloud providers. This personal information will be retained for 7 years after which it will be destroyed securely. The information will not be transferred to any other party without your express permission.

If you choose to use the SilverCloud mobile app (available from iOS App Store and Google Play Store) then you can set up app notifications. SilverCloud will not contact you by phone or text (SMS) about SilverCloud or other products.

In order for the University to provide further services to you we will require you to give us further details regarding your health and wellbeing. Details regarding health and wellbeing are considered to be Special Category Data under GDPR. Other forms of Special Category Data are racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing for genetic data, biometric data, sex life and sexual orientation. In order for us to collect this Special Category Data from you we require your explicit consent. You will be asked to acknowledge your consent to us holding this Special Category Data and to the terms set out above, detailing how we hold your other personal information. If you access SilverCloud through attendance at Teesside University Counselling Service, these conditions are covered by signing a form when you attend any counselling sessions. You have the right to withdraw your consent and have your personal information removed from the system at any time. If you wish to have your personal information removed you will need to contact Teesside University.

If as a result of using the SilverCloud service you wish to see a counsellor you will then be asked to fill in an ‘Application to Counselling Form’ a further privacy notice will be provided within that form.

SilverCloud Health provides its platform to many healthcare services and other organisations. In this notice we will tell you how SilverCloud process your personal data on behalf of Teesside University. Teesside University is the ‘data controller’, which means they decide how and why your data is processed, and SilverCloud is the ‘data processor’, which means we follow their instructions.

Further details of how we use your personal information together with a list of your rights under the Data Protection Act 2018 can be found within the University’s Privacy Notice http://www.tees.ac.uk/sections/about/public_information/copyright.cfm?display=privacy

SilverCloud also uses some of your data to understand how the SilverCloud platform is used and could be improved. When we collect or use your data on our own behalf, SilverCloud is the ‘data controller’.

Contact details for SilverCloud are listed at the bottom of this notice.

• How we collect your personal data

  Your data is collected by SilverCloud in a few ways:

  • Data you give directly
  • Data given about you (by a client or supporter)
  • Data we collect automatically when you use SilverCloud

• What personal data we collect and use

  Here is a list of the categories of personal data that are collected and used, with examples. Some of these are optional or depend on SilverCloud's obligations to its customers, including what your service has asked SilverCloud to collect.

  • Contact details
  • Optional personal information
  • Health data
  • Data about your use of SilverCloud
  • Feedback data
  • Data about your background or demographic profile

  Contact details

  Your name, email address, mobile telephone number (for notifications), etc.

  The following types of data will only be collected if SilverCloud has an obligation to do so:

  Your postal address, post code, telephone numbers

  Optional personal information

  Interests, likes/dislikes, profile image, etc.

  Health data

  The SilverCloud customer organization with which you are associated; your SilverCloud programme; answers to psychological questionnaires and calculated results; entries to interactive tools such as a list of problems, recording mood over time, or journal entries; messages between clients and supporters; ID numbers for health records; etc.

  The following types of data will only be collected if SilverCloud has an obligation to do so, or if SilverCloud has your specific consent:

  For referrals, we may collect more data: date of birth, GP name, address, telephone number, national or local ID number.

  Additional health data about your disabilities, conditions, problems or treatments.

  Data about your health is considered ‘special category’ data.

  Data about your use of SilverCloud

  Your invitation, when you first signed up, pages and sections viewed, other actions you take on SilverCloud, emails sent to you, server errors that affect you, etc.

  When you log in and log out, your IP address, browser type and version, time zone and language, notification preferences

  Your login details (username, encrypted password)

  Feedback data

  Your feedback in the “progress points” at the end of each module; User experience questionnaires; Other questionnaires where it is indicated that the recipient is SilverCloud

  Data about your background or demographic profile

  The following types of data will only be collected if SilverCloud has an obligation to do so, or if SilverCloud has your specific consent.

  Age, gender, sexual orientation, ethnicity, religion, etc.

  Data about your racial or ethnic origin, religious/philosophical beliefs, or data about your sexual life or orientation is considered ‘special category’ data.

  Data we do not collect

  Children's data

  SilverCloud is intended for use by adults aged 18 years or over and we do not knowingly collect personal data from people under 16 years of age.

• How and why we use your personal data

  SilverCloud processes your data for specific purposes and where there is a legal basis.

  • Provide SilverCloud platform and programmes
  • Technical support
  • Understanding usage and improving service

  Provide SilverCloud platform and programmes

  SilverCloud collects and processes your data under a contract with the customer organization with which you are associated in order to provide you with secure access the SilverCloud platform and programmes.

  This includes displaying programme pages, recording your activity on interactive tools and features, storing your preferences, sending notifications by email, text or push notification, etc.

  It also includes inviting and managing clients and supporters, supporters reviewing client progress and results, and, if your service requires, working with their health record systems.

  Your service is responsible for determining the purpose and legal basis under which they use your data and have SilverCloud process it.

  Technical support

  SilverCloud provides technical support to your service, and so we will process your personal data if you contact us by telephone, email or through the SilverCloud platform.

  Understanding usage and improving service

  SilverCloud analyses personal data to understand usage and to help us improve the platform and programmes.

  SilverCloud processes data for this purpose on behalf of your service and also on our own behalf.

  Most analysis uses anonymous aggregate data (for example, average length of time spent on the platform). Some analysis uses individual data, with additional safeguards in place such as anonymisation, use of pseudonyms (pseudonymisation) and limiting the set of individual data (data minimization). This analysis may include profiling, machine learning or other techniques.

  Update usage analytics settings

  Legal basis

  Where SilverCloud is processing your data for these purposes on its own behalf it is necessary for our legitimate interests or those of a third party (such as our customers):

  • understand efficiency and effectiveness of SilverCloud’s services
  • identify opportunities for improving services, components or tools
  • provide customers with an understanding of how their use of the service might be improved
  • provide statistical and market data to guide business development
  • identify and understand trends in interactions with the SilverCloud platform
  • information on medical and psychological factors (e.g. existing conditions, previous treatment) helps us to understand the needs and specific contexts of different groups
  • information on demographics (e.g. age, gender, sexual orientation, religion, ethnicity) helps us to ensure that the service and content is effective, representative and sensitive to the diversity of our users.

  We also believe that this processing does not undermine your fundamental rights and freedoms.

  Where we process your special category personal data for this purpose, the processing is necessary for scientific research purposes or statistical purposes (GDPR Art.9(2)(j)), and we ensure appropriate safeguards, mentioned above, are in place.

• Your rights

  You have rights regarding your personal data. If you have any questions please contact your service or SilverCloud.

  Right to information about processing of your personal details

  The aim of this privacy notice is to give you this information.

  Right to access your personal data

  You have the right to know if your personal data is being held, what categories of data are held, and to receive a copy of all data about you.

  Right to change or remove your details

  You have the right to correct any inaccurate data, or remove data if it is not necessary for us to hold it.

  Right to object to processing

  You can object to processing if it could affect your rights, freedoms or interests.

  Right to data portability

  We will provide your data in a portable format.

  Right to lodge a complaint

  You also have the right to lodge a complaint with a supervisory authority, although we encourage you to contact your service first.

  Contact details for the Data Protection Commission can be found at https://www.dataprotection.ie/.

  Other rights

  You may have also heard about the following rights, however we believe they are not relevant to SilverCloud’s use of your data.

  Rights in relation to automated decision making: we do not use automated decision making with legal or other significant effects

• Third parties

  We use third party sub-processors to host the SilverCloud platform and communicate with you.

  Armor

  Armor Defense Ltd, 268 Bath Road, Slough, Berkshire, SL14DX, United Kingdom

  We use Armor Defense to host the SilverCloud platform and database.

  Location of processing: EU

  Armor Terms of Service (See "TERMS OF SERVICE AGREEMENT - EMEA & Asia Pacific")

  Amazon Web Services

  Amazon Web Services EMEA SARL, 5 rue Plaetis, L-2338 Luxembourg

  We useAmazon Web Services to store encrypted backups and send email notifications.

  Location of processing: EU

  AWS Privacy Policy

  Zendesk

  Zendesk International Limited, One Grand Parade, Dublin 6, D06 R9X8, Ireland

  We use Zendesk to handle technical assistance communication.

  Location of processing: US and EU

  Zendesk Privacy Policy

  Links to other websites

  You should also be aware that where you link to another website from SilverCloud, that SilverCloud has no control over that other website. Accordingly, SilverCloud cannot guarantee that the controller of that website will respect your privacy in the same manner as SilverCloud.

• Data security and storage

  We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

  All SilverCloud employees are contractually and ethically bound to respect the confidentiality of any personal data held by SilverCloud.

  SilverCloud maintains ISO 27001:2013 certification.

• Retention of personal data

  Personal Data shall be retained only in accordance with the Data Retention requirements of SilverCloud's Privacy Policy.

• Privacy notice changes

  We will revise this privacy notice when necessary and we encourage you to check back in future for changes.

  24 February 2023

  Update to SMS service provider

Contact

If you wish to contact SilverCloud regarding use of your Personal Data or to exercise your rights, please contact us at:

SilverCloud Health
One Stephen Street Upper
Dublin 8
Ireland

dataprotection@silvercloudhealth.com

SilverCloud's Data Protection Officer (DPO) is BH Consulting:

SilverCloud Health Data Protection Officer
BH Consulting
The LINC Centre
Blanchardstown Road North
Dublin 15
Ireland

dataprotection@silvercloudhealth.com