Children and Young People’s Therapeutic Support Service and Kent Therapeutic Alliance privacy notice

We keep this privacy notice under regular review and was last updated on 12 March 2026.

We, and Salus, respect your privacy and are committed to protecting your personal data. This privacy notice will tell you as to how we look after your personal data and about your privacy rights and how the law protects you.

View an easy read version of the Children and Young People’s Therapeutic Support Service and Kent Therapeutic Alliance privacy notice (PDF, 730.2 KB).

Who we are

We have commissioned Salus to deliver the Children and Young People’s Therapeutic Support Service.

Kent and Medway Integrated Care Board (NHS Kent and Medway) have commissioned Salus to deliver the Kent Therapeutic Alliance, in partnership with Spurgeons, Involve, We are With You, Oasis, CHUMS, Young Lives Foundation and Rising Sun.

We, and Salus, collect, use and are responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018. We are responsible as ‘joint controllers’ of that personal information in respect of the Therapeutic Support Service. Salus are responsible as an independent controller for the Kent Therapeutic Alliance.

The Children and Young People’s Therapeutic Support Service will be delivered by Salus. It will provide support to children, young people, and their families living in Kent, who would benefit from support to improve their emotional wellbeing and mental health. Parents and carers with parental responsibility will be asked if they give consent (called a ‘common law consent’) if they would like their child or young person to receive support from the service. Young people who are able to consent for themselves will be able to do so, in line with NHS guidance: Consent to treatment - Children and young people - NHS.

The services may be provided face-to-face or virtually. Salus work closely with us and with partner organisations to ensure we deliver the best possible outcomes for children, young people and families in Kent. We will also ask for consent to collect and share additional personal information if you would like us to support you to access other services or activities that may be helpful.

Our Data Protection Officer is Benjamin Watts. Salus’ Data Protection Officer is Sarah Townsend.

The personal information we collect and use

Information collected by us

If you are a parent or carer with parental responsibility giving permission for your child or young person to receive support from the service (or if you are a young person, consenting for yourself) we will collect personal information when you provide it to us, We will collect:

• the child or young person’s personal details (such as name, address including postcode, contact details, date of birth, school and or education institution, sex, gender identity)
• the parent or carer’s personal details (such as name and email address). If a parent or carer requests to be referred to another service, we may also collect the parent or carer’s date of birth and sex)
• your IP address when an online referral is made by you.

We also collect 'special category data' (personal data which is more sensitive and treated with extra care and protection) when you provide it to us. We will collect:

• race and or ethnicity and cultural background
• relevant health information (such as physical and mental health and special educational needs and disabilities, drug and alcohol use)
• religious or philosophical beliefs
• sexual orientation
• outcomes for children based on wellbeing measures completed (such as strengths and difficulties questionnaires
• the parent or carer’s health information (including mental health, Special Educational Needs or Disabilities), ethnicity and religious or philosophical beliefs) where relevant, if a parent or carer requests to be referred to another service.

We will also collect data which is not classed as special category data but will be treated with extra care, when you provide it to us. We will collect:

• personal identifiers (including the child or young person’s NHS number)
• details of family relationships, including those of extended family and friends
• relevant personal circumstances, including:
  • social care information (if the child or young person is a Child in Need, subject to a Child Protection Plan, looked after, care experienced, for example)
  • unaccompanied asylum seeking child and or young person
  • young carers status
  • domestic abuse (including whether the perpetrator is still living with the child or young person).
• whether the child and or young person is known to the youth justice system
• reasons for support (such as what is working well and what you are worried about).

We also obtain personal information from:

• the NHS, if you do not know your child’s NHS number, we will ask if you consent for us to look this information up using the NHS Spine Portal - NHS England Digital system. Your child and or young person will still be able to access the service if you choose not to provide this information
• the Kent and Medway Care Record (KMCR) to help inform the support we provide to your child, and to help us improve services
• partner organisations for referral and involvement information, where appropriate.

How we use your personal information

We use your personal information to:

• understand your child and or young person’s needs and goals
• plan and provide appropriate emotional wellbeing support to your child and or young person. This may include delivery of virtual support sessions via Microsoft Teams, where appropriate
• monitor your child and or young person’s progress to make sure the support we provide is helpful
• support you and your child and or young person to access other relevant services and activities (with your consent)
• monitor and quality assure how well the service is working. This will include seeking your feedback on the services you and your family have received
• carry out research and evaluation to help us continually improve our services and inform future service provision
• follow statutory safeguarding duties to help keep children, young people and vulnerable adults safe
• prepare information for the courts, if required. This includes preparing information for HM Courts and Tribunals Service, if directed by the courts, where an individual or their family are involved in court proceedings. It may also involve sharing personal information with our legal and professional advisers in the event of a dispute, complaint or claim
• help plan and improve mental health services and policies for children and young people in the UK by sharing data with the national Mental Health Services Dataset, held by NHS Digital (part of NHS England). You can opt-out of this by visiting Opt out of sharing your health records - NHS to record your preferences
• use the Kent and Medway Care Record (KMCR) to help inform the support we provide to your child or young person, and to help us improve services. To find out more about your data in KMCR, read the KMCR Privacy Notice
• support workforce development within Salus. Salus employee trainee clinical behavioural therapists and children’s wellbeing practitioners who are enrolled on university studies to complete relevant professional qualifications. This will include sharing anonymised information and case studies with their university providers to provide evidence of their practice. With consent, this may also involve sharing audio or video recordings of sessions with children and young people.

Reasons we can collect and use your personal information

When we collect your personal data, we rely on the following legal bases:

1. To deliver the service, carry out research and evaluation, share data with the Mental Health Services Dataset and Kent and Medway Care Record and comply with statutory safeguarding duties. Also to share anonymised information about types of support provided to children and young people for the purpose of university study (relating to trainee Cognitive Behavioural Therapists and Children’s Wellbeing Practitioners).

• Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When we collect your ‘special categories of personal data’ (such as health information), we rely on the following legal basis:

• Article 9(2)(h) - processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services. We rely on the health or social care purpose and public health conditions from Schedule 1 of the Data Protection Act 2018 when relying on Article 9(2)(h) to process your special category data.
• To comply with statutory safeguarding duties: Article 9(2)(g) - Reasons of substantial public interest. We rely on the ‘safeguarding of children and of individuals at risk' and 'equality of opportunity or treatment’ conditions from Schedule 1 of the Data Protection Act 2018 when relying on Article 9(2)(g) to process your special category data.

2. To support you with referrals and or social prescribing to other services or activities which may be helpful (which may involve collecting and sharing additional personal data, with your consent); to look up your child or young person’s NHS number using the NHS Spine system; and to take audio and/or visual recordings of sessions with children and young people and share with universities for the purpose of university study (relating to trainee cognitive behavioural therapists and children’s wellbeing practitioners).

• Article 6(1)(a) - Consent: the individual has given clear consent to process their personal data for a specific purpose.

When we collect your 'special categories of personal data' (such as health information), we rely on the following legal basis:

• Article 9(2)(a) – Explicit consent: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where domestic law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

We take the following appropriate safeguards in respect of your special category and/or criminal convictions data when relying on the conditions above:

• we have a retention schedule which explains how long data is retained (see records AS6.6.14 and 6.15). The retention period is in line with the NHS Records Management Code of Practice
• we maintain a record of our processing in our 'Record of Processing Activities' and record in it any reasons for deviating from the periods in our retention schedule.

3. To comply with legal duties, if we are required to prepare information for the courts (for example if you or your family are subject to family court proceedings) and preparing information for HM Courts and Tribunals Service, if directed by the courts, where an individual or their family are involved in court proceedings. Also, to share personal information with our legal and professional advisers in the event of a dispute, complaint or claim.

• Article 6(1)(c) - legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

When we collect your ‘special categories of personal data’ (such as health information), we rely on the following legal basis:

• For special category data: Article 9(2)(f) - Legal claims or judicial acts.

How long your personal data will be kept

We, and Salus, will keep your information securely in line with the retention periods shown below, after which time it is made inaccessible to system users or securely destroyed, unless we are required to.

Who we share your personal information with

In the course of working with you we may collect information from, or share it with, third parties including:

• teams within Salus working to improve outcomes for children and young people where a need for additional support is identified
• teams within our partner organisations (where a need for support from one of the partners is identified):
  • Spurgeons
  • Involve
  • We are With You
  • Oasis
  • CHUMS
  • Young Lives Foundation
  • Rising Sun.
• your child or young person’s school or education setting, where appropriate
• the Kent and Medway Care Record (KMCR). for more information see the Kent and Medway Care Record privacy notice.
• the Mental Health Services Dataset, held by NHS Digital (part of NHS England). This is a national dataset which draws on patient data to inform and improve research, planning, commissioning and policy making. For more information on how your data is used and protected, please visit the Mental Health Services Dataset. You can opt-out of sharing your health records with the Mental Health Services Dataset.
• partner organisations signed up to the Kent and Medway Information Sharing Agreement, where necessary, which may include:
  • health visitors
  • midwives
  • district councils
  • housing providers
  • police
  • school nurses
  • doctors
  • mental health workers.
• with your consent, other organisations who may offer relevant additional support or activities for children, young people, parents and or carers. This could include (non-exhaustive list):
  • Voluntary, Community and Social Enterprise (VCSE) organisations
  • schools
  • health organisations
  • our Integrated Children’s Services including Early Help
  • Kent Family Hub.
• where children and young people receive support from trainee cognitive behavioural therapists or children’s wellbeing practitioners, anonymised information may be shared with the practitioner’s university (Kings College London or University of Sussex) to support their studies. Where audio or visual recordings of sessions may be required, this will only be with your consent.
• if you choose to make a complaint about service delivery received from the Kent Therapeutic Alliance, which cannot be resolved by Salus’ own internal complaints procedure, we may share your personal information relating to the complaint with NHS Kent and Medway (as Commissioners of the Kent Therapeutic Alliance). Complaints received about the Therapeutic Support Service which cannot be resolved by Salus’ internal complaints procedure will be escalated to us, as commissioners of the Therapeutic Support Service. This may also involve sharing your personal information.

We will share personal information with law enforcement or other authorities if required by applicable law.

We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9 (2) (f) where the processing or special category data is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Transferring your information outside of the UK

Salus uses In-Form (Salesforce) which is the electronic record system that allows us to safely store all personal information collected. Salesforce data is held in UK data centres and backed up within the EU. This means that we will transfer your data outside of the UK to the EU for processing. This is based on an adequacy decision by the Secretary of State and safeguards prescribed by the UK GDPR. More information can be found on the UK Information Commissioner's Office website.

Your rights

Under UK GDPR you have rights which you can exercise free of charge which allow you to:

• know what we are doing with your information and why we are doing it
• ask to see what information we hold about you (subject access request)
• ask us to correct any mistakes in the information we hold about you
• object to direct marketing
• make a complaint to the Information Commissioners Office
• withdraw consent at any time (if applicable)

Depending on our reason for using your information you may also be entitled to:

• ask us to delete information we hold about you
• have your information transferred electronically to yourself or to another organisation
• object to decisions being made that significantly affect you
• object to how we are using your information
• stop us using your information in certain ways

We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note, your request may delay or prevent us delivering a service to you.

For further information about your rights, including the circumstances in which they apply, see the guidance from the ICO on individuals’ rights under UK GDPR.

If you would like to exercise a right, contact the Data Protection Team at dpo@salusgroup.org.uk .

Your right to withdraw your consent

Where we rely on your consent to process your personal information, you can withdraw your consent to our use of your data at any time. You can do this by emailing dpo@salusgroup.org.uk .

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Who to Contact

Email our Data Protection Team at dpo@salusgroup.org.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

Contact Salus' Data Protection Officer, Sarah Townsend, through email or post at:

Contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk .

The United Kingdom General Data Protection Regulation also gives you the right to lodge a complaint with the Information Commissioner who may be contacted via the Information Commissioner's website or telephone 0303 123 1113.

Read our corporate privacy statement.