Fair processing notices - Active Recovery Exercise Programme

How we use your data

This privacy notice provides you with information on how and why the city council’s Leisure and Wellbeing Service, collects and processes your personal data for the purposes of operating the Active Recovery Exercise Programme (AREP). It covers all data collected directly or provided via a referring organisation. The privacy notice also provides you with information regarding your rights and obligations.

The city council is the data controller for your personal information and is committed to protecting the privacy and security of your personal data when you sign up to take part in the AREP. This is in accordance with the UK General Data Protection and on Regulation (UK GDPR) and Data Protection Act (DPA) 2018 and covers the collection, use, sharing, storage and the erasure of all your data. This Privacy Notice is made in accordance with Article 13 of the UK GDPR.

Data Protection Principles

The city council will comply with data protection legislation which states that the personal information that we hold about you must be:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept securely.

What personal data is collected and how it is used.

Personal data, or personal information, means any information about you from which you can be identified. It does not include data where your identity has been removed (anonymous data).

In order to enrol onto the Active Recovery Exercise Programme, the Leisure and Wellbeing Service will collect, store, and use the following personal information about you including, some sensitive data about your health that is classed as Special Category data and is subject to additional controls.

Data collected will includes:

  • Name
  • Address
  • Phone number
  • E-mail address
  • Emergency contact
  • Date of birth
  • Medical conditions and medication/treatments
  • Body measurements including weight, waist measurments and blood pressure readings
  • Self-Reported Mental Wellbeing score using Warwick-Edinburgh scale

How is your personal information obtained?

We collect personal information directly from you using the following; a self-referral form, face to face induction/reviews, exercise PAR-Q and questionnaires. Sometime we may also collect data from other people such as your key worker which we will discuss with you prior to requesting. Mostly your personal data will be collected through contact with you and provide by you.

 How we will use information about you.

 The situations in which we will process your personal information are listed below.

  • To contact you (by phone, email or post) to arrange an initial and follow-up 1-1 appointments during your 26 weeks Active Recovery Exercise Programme.
  • To registering you as an active participant on the Active Recovery Exercise Programme and provide you with a maximum of 26-week funded access to your selected leisure facility.
  • Information provided by you (via a pre-exercise questionnaire) and which relates to your current health status, will be used to confirm your eligibility to access the programme and to enable authorised programme instructors to provide you with tailored information and guidance about physical exercise and activities that are suitable for your individual needs.
  • To notifying you of any changes to your gym appointments, including reminders and cancellations
  • To contact you to confirm your attendance and your wish to continue accessing the programme. If you failed to attend for a period of 4 -weeks we will attempt to contact you a minimum of three times. If we do not hear back from you to confirm your continued participation in the programme, we will destroy all paper based and electronic data entries held within 12 months.  
  • To send you participant surveys to collect your feedback about the Active Recovery Exercise programme
  • To provide anonymised statistical reports to external partners to further develop the service.

Legal basis for processing your information

We will only use your personal information when the law allows us to, as set out in Article 6 and Article 9 of the GDPR Data Protection Act 2018. Our legal basis for processing your data is:

Personal data

Article 6(1)(e) GDPR provides a lawful basis for the processing of personal data to the extent that “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller “

Special category data

Article 9 (2) (a): our legal basis for processing special category data is explicit consent “the data subject has given explicit consent to the processing of data for one or more specified purposes”

With whom do we share your data?

We receive personal information about you from Stoke-on-Trent Community Drug and Alcohol Service, Concrete and Creating Change Housing Service via the Active Recovery Exercise referral form. This information is shared with the city council with your explicit consent.

Access to your sensitive information, collected at the time of your initial induction is strictly limited to the Active Recovery Exercise Programme team and the specialist instructors delivering activities as part of the programme offer.

We may sometimes share your personal information with third parties where there is a legal requirement to do so. In such instances your privacy rights and the sharing of this information will always be checked before information is shared.

Data may be shared with the;

  • National government department: Office of Health Improvement and Disparities (OHID,) funders of the Active Recovery Exercise Programme
  • Stoke-on-Trent Community Drugs and Alcohol Services, Concrete and Creating Change Housing Management.

Data shared with the above organisations will have all identifiable personal information removed and be used for evaluation purposes only. We do not share your personal information with anyone else without consent unless the law requires us to do so.

All services supporting the self-referral pathway onto the Active Recovery Exercise programme are required to take appropriate security measures to protect your personal information in line with GDPR and Data Protection Act (2018) policies.

How your data is protected?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We limit access to your personal information to those employees who have a business need to process it, in order to meet your Active Recovery Exercise Programme service requirements. Your personal details relating to the programme will be stored on the city council’s secure network drives and electronic membership administration system Gladstone. Information provide via health screening questionnaires will be held in secure lockable storage cabinets with restricted staff access.  

We have in place, procedures to deal with any suspected data security breach and will notify you and any applicable regulator of any such events and where we are legally required to do so.

Data Retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of your personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements. In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Your data will be held on the City Council’s secure network drives for a period of 12 months from your completion of the AREP.

Your data rights

By law you have the rights to: 

  • Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information corrected. It is important that the personal information we hold about you remains accurate and current so please ensure you update us on any changes i.e change of address etc.
  • Request erasure of your personal information. This enables you to ask for your personal information to be deleted or removed where there is no good reason for us to continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Request the restriction of the processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to check its accuracy or the reason for processing it.

No automated data processing is used as part of the Active Recovery Exercise Programme.

Right to withdraw consent

Where you have provided your consent to the collection, processing and transfer of your personal information you have the right to withdraw your consent at any time during the Active Recovery Programme.

If you chose to withdraw your consent we will no longer process your information for the purposes of the Active Recovery Exercise Programme. All personal and special category data held will be securely disposed of within 1 month from the date the request is made, unless we have another legitimate legal basis for not doing so.

Who to contact if you have questions

If you wish to contact us in relation to any of your information rights, email foi@stoke.gov.uk or write to Information Rights Team, Floor 2, Civic Centre, Glebe Street, Stoke-on-Trent ST4 1HH.

Our information rights team can be contacted on 01782 233732 or 235965.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may request specific information from you to help us confirm your identity and ensure your right to access the information. This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you wish to complain about how your personal information has been handled by Stoke-on-Trent City Council, contact the information rights team in the first instance using the details above. If you are not satisfied you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or call 03031231113.