Effective Date: 2nd July 2025

Introduction

At Discussing Mental Health (“DMH,” “we,” “us,” or “our”), the confidentiality and privacy of all personal, sensitive, and proprietary information entrusted to us is of paramount importance. This Confidentiality Policy establishes the standards and procedures we implement to safeguard such information in accordance with legal, ethical, and regulatory requirements. Our commitment extends to protecting the rights of individuals, maintaining trust with clients and partners, and upholding the integrity of our organisation.
 
1. Purpose

The purpose of this policy is to:

Define the principles governing the collection, use, storage, sharing, and disposal of confidential information;
Ensure the consistent and lawful handling of all confidential data;
Protect the privacy of individuals and the commercial interests of DMH by preventing unauthorized access, disclosure, alteration, or destruction of information;
Support compliance with relevant data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
 
2. Scope

This policy applies to all individuals and entities who access, process, or manage confidential information related to DMH’s business activities. This includes, but is not limited to:

All DMH employees, contractors, consultants, and temporary staff;
Business partners, vendors, and third-party service providers engaged by DMH;
Information relating to clients, employees, business operations, financial data, and intellectual property.

Confidential information under this policy includes, but is not limited to:

Personal data and health-related information of clients and users;
Employee personnel records and sensitive HR information;
Financial and operational records of DMH;
Research data, proprietary methodologies, software code, and trade secrets.
 
3. Confidential Information Management

3.1 Storage and Access Controls

Confidential data shall be stored using robust technical controls such as encryption, secure servers, multi-factor authentication, and role-based access permissions.
Physical documents containing confidential information shall be kept in secure, access-controlled environments.

3.2 Access and Sharing

Access to confidential information shall be strictly limited to individuals with an authorized business need.
Any sharing of confidential data must be governed by formal authorizations and documented processes, ensuring compliance with contractual and legal obligations.
Where confidential data is transferred or shared, appropriate safeguards must be employed, including confidentiality agreements, data processing agreements, and secure transmission methods.

3.3 Data Disposal

Confidential information that is no longer required for operational or legal purposes shall be disposed of securely.
Physical materials will be shredded or incinerated, while electronic data will be irreversibly deleted using industry-standard techniques.
 
4. Responsibilities of Employees and Contractors

All personnel must sign a binding confidentiality agreement upon engagement with DMH.
Personnel are required to maintain vigilance in protecting confidential information, including using strong passwords, locking workstations, and securely managing physical documents.
Suspected or confirmed breaches of confidentiality must be reported immediately through the established incident reporting channels.
Personnel must avoid discussing or displaying confidential information in public or unsecured environments to prevent inadvertent disclosure.
 
5. Third-Party Service Providers

All third-party entities processing confidential information on behalf of DMH shall enter into formal agreements that mandate compliance with confidentiality and data protection standards equivalent to DMH’s.
DMH conducts due diligence and ongoing oversight to ensure third parties implement adequate security controls and comply with relevant legal requirements.
 
6. Breach of Confidentiality

Any unauthorized access, loss, or disclosure of confidential information is considered a serious violation and will trigger a formal investigation.
Consequences of a breach may include disciplinary measures for employees, contract termination for service providers, and legal action as appropriate.
DMH is committed to complying with regulatory breach notification requirements and will notify affected individuals and authorities as required by law.
 
7. Data Retention and Secure Disposal

Confidential information shall be retained only for the duration necessary to fulfill its purpose or to meet legal, regulatory, or contractual obligations.
Retention periods will be documented and regularly reviewed to ensure compliance.
Upon expiry of retention periods, data will be securely disposed of to prevent unauthorized recovery or use.
 
8. Compliance with Legal and Regulatory Frameworks

DMH’s confidentiality practices align with all applicable legal and regulatory frameworks, including:
The UK General Data Protection Regulation (UK GDPR);
The Data Protection Act 2018;
Other relevant privacy and data protection statutes.
Our policies and procedures are subject to periodic review and updates to reflect changes in the legal landscape and industry best practices.
 
9. Training and Awareness

DMH provides regular training and awareness programs to ensure all employees, contractors, and relevant third parties understand their responsibilities regarding confidentiality and data protection.
 
10. Contact and Reporting

For questions regarding this Confidentiality Policy or to report concerns, please contact our Data Protection Officer at:
Email: policy@discussingmentalhealth.com
 
Acknowledgment

By engaging with DMH and its services, all employees, contractors, and third-party partners acknowledge their understanding of, and agreement to comply with, this Confidentiality Policy.