Menu

Community Mental Health and Wellbeing Service (known as Live Well Kent and Medway) privacy notice

We keep this privacy notice under regular review and was last updated on 15 December 2025

Kent County Council (KCC) respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

Who we are

Wel collect, use and are responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018. We are responsible as ‘controller’ of that personal information.

Live Well Kent and Medway supports adults aged 17 years and above (and also, where applicable, young people aged 14 to 16 years) to improve their mental health and wellbeing so that that individuals can gain the skills to manage their own mental health and reduce access to primary and secondary care.

Under Live Well Kent and Medway, there are two providers who are contracted by us to deliver and provide the above services. These are Shaw Trust and Porchlight, who cover different Kent areas.

Clients will interact with a community link worker who will support the client to access the services they need and hold review meetings with the client on a regular basis.

Client information is stored on Shaw Trust and Porchlight systems to make referrals to supply chain partners and generate ‘wellbeing action plans’. Supply chain partners will also have access to client data via central case management systems (Homeless Link In-Form (Salesforce) database for Porchlight and MPS Iconi for Shaw Trust). Supply chain partners are those who are across the Voluntary Community Sector (VCS) to assist Shaw Trust and Porchlight to support clients under Live Well Kent and Medway.

Our Data Protection Officer is Benjamin Watts.

The personal information we collect and use

Information collected by us

In the course of supporting clients, we collect the following personal information when you provide it to us:

  • Personal information such as your name, and date of birth.
  • In cases where it is relevant to support, with your consent, we could ask for National Insurance Number (helping clients to secure employment) or financial information such a summary of your budget and debts (supporting debt management or budgeting).

We also collect the following ‘special category data’ (personal data which is more sensitive and is treated with extra care and protection) when you provide it to us:

  • Where you are happy to provide it, we also collect data on racial or ethnic origin, religious beliefs, physical or mental health, and sexual orientation.

Why we collect this data

We collect this information, where you choose to provide it, so that we can make sure you receive the right support, for example by making reasonable adjustments such as disability access. It also helps us monitor equality and diversity and ensure our services are reaching people in a way that reflects the communities they serve. This data is provided to Kent County Council in an anonymised format and is used only for statistical and reporting purposes, helping us improve accessibility and inclusivity across our services.

We also obtain personal information from other sources as follows:

  • Adult Social Care or health services (for example, adult social care social workers, GPs, community mental health teams or adult social care commissioned services) where relevant to support or for risk assessment/safeguarding purposes.

How we use your personal information

We use your personal information to offer support on:

  • evidence based activities shown to improve mental health and wellbeing, including individuals and group psychoeducational and psychosocial interventions. Examples include:
    • coping with life courses
    • support to manage specific conditions and improve self-esteem, confidence and assertiveness
    • stress and anger management and relaxation techniques
    • individual and group counselling
    • bereavement and loss counselling
    • art therapy
    • outdoor activities
    • connecting with nature
    • mindfulness
    • empowerment coaching
    • light touch cognitive behavioural therapy.
  • managing money, including debt counselling and benefits advice
  • employment support and guidance
  • housing support and guidance
  • improving relationships and social inclusion
  • lifelong learning and accessing volunteering
  • activity Programme for Young People aged between 14 – 35 who have suffered from a first episode of psychosis
  • 24-7 Telephone and Online Support (Release the Pressure helpline)
  • Mental Health Together Services.

Reasons we can collect and use your personal information

We rely on Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller - as the lawful basis on which we collect and use your personal data.

We rely on Article (9)(2)(h) - processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services - as the lawful basis on which we collect and use your special categories of personal data.

We rely on the health or social care purpose and public health conditions from Schedule 1 of the Data Protection Act 2018 when relying on Article(9)(2)(h) to process your special category data.

We take the following appropriate safeguards in respect of your special category data when relying on the conditions above:

  • This policy is retained throughout the time we use your data and for 6 months after we cease to use it.
  • We have a retention schedule which explains how long data is retained.
  • We maintain a record of our processing in our ‘Record of Processing Activities’ and record in it any reasons for deviating from the periods in our Retention Schedule.

The provision of personal information such as your name, date of birth, contact details, and relevant health or wellbeing information is required from you to enable us to assess your needs, create a support plan, and connect you with the right services through Live Well Kent and Medway.

If you choose not to provide your contact details, date of birth, and relevant health or wellbeing information, we may not be able to deliver the service to you in the way that meets your needs. This information helps us communicate with you, confirm your eligibility, and ensure you receive appropriate support.

How long your personal data will be kept

We will hold your personal information for up to 12 years after the end of the contract between us and the service providers (Shaw Trust and Porchlight).

Where information is held for different time periods:

  • Electronic records are stored on secure systems and are cleansed annually by system administrators.
  • Hard copy records are not retained; they are scanned into the system and then securely shredded.
  • If the contract ends early, all data will be returned to Kent County Council as per the agreement.

Who we share your personal information with

We routinely share your name, date of birth, contact details, and relevant health or wellbeing information with:

  • Shaw Trust
  • Porchlight
  • Voluntary and Community Sector (VCS) organisations who are part of the delivery network, such as MIND and Citizens Advice, when you request support from them
  • relevant teams within KCC, such as Adult Social Care or Public Health, for safeguarding purposes.

Shaw Trust and Porchlight are also considered data controllers for some elements of data processing. Read the Live Well Kent privacy notice.

View a list of our delivery partners, on the Live Well Kent website or contact your Link Worker. This data sharing enables these organisations to provide the right help and support to you at the right time.

We have a data processing agreement in place with Shaw Trust and Porchlight, who process your data on our behalf. They also have agreements with their delivery partners that include data protection, confidentiality, and information security requirements.

We will share personal information with law enforcement or other authorities if required by law or in connection with legal proceedings.

We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9(2)(f) where the processing of special category data is necessary for legal claims or when courts are involved.

We do not routinely transfer your data outside the UK. If data ever needs to be transferred outside the UK or the European Economic Area (EEA), it will be protected by legal safeguards such as contracts with specific clauses to keep your information safe.

Your rights

Under the UK GDPR you have rights which you can exercise free of charge which allow you to:

  • know what we are doing with your information and why we are doing it
  • ask to see what information we hold about you (subject access request)
  • ask us to correct any mistakes in the information we hold about you
  • object to direct marketing
  • make a complaint to the Information Commissioner's Office.

Depending on our reason for using your information you may also be entitled to:

  • object to how we are using your information
  • ask us to delete information we hold about you
  • have your information transferred electronically to you or to another organisation
  • object to decisions being made that significantly affect you
  • stop us using your information in certain ways.

We will always seek to comply with your request. However, we may be required to hold or use your information to comply with legal duties. Your request may delay or prevent us delivering a service to you.

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the United Kingdom General Data Protection Regulation.

If you would like to exercise a right, contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk.

Permission for referrals

While we do not rely on consent as our legal basis for using your information, we will always ask for your permission before sharing your details with other organisations to provide additional support, unless we need to share information to keep you or someone else safe. This may happen if there is a safeguarding concern or risk of harm.

You can change your mind about this at any time by speaking to your link worker or phoning 0800 567 7699.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Who to contact

Contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk.

UK GDPR also gives you right to lodge a complaint with Information Commissioner, who may be contacted via the Information Commissioner's website or call 03031 231113.

Read our corporate privacy statement.