Privacy Policy

1. Who we are

Healing Young Hearts Ltd ("Healing Young Hearts", "we", "us") is a training and consultancy practice working with schools, colleges, local authorities and other organisations across the UK and Ireland.

For the information described in this notice, we are the data controller. That means we decide what personal information is collected and how it is used.

Siobhán Garrett, Director, is responsible for data protection at Healing Young Hearts. We are not required to appoint a Data Protection Officer, but any question about how we handle personal information can be sent to the address above.

2. When a school or organisation is the data controller

Much of our work involves supporting organisations to think about children and young people they are responsible for. Where a school, college, local authority or other organisation shares personal information with us about its pupils, students, service users or staff — for example during a consultancy visit, a case discussion or a supervision session — that organisation remains the data controller and we act as a data processor on its behalf.

In those circumstances we handle the information only on the organisation's documented instructions, under a written agreement that meets Article 28 of the UK GDPR. If you are a parent, pupil or member of staff and you want to know how your information is being used in that context, please contact the organisation directly in the first instance. You are also welcome to contact us and we will help you reach the right person.

The rest of this notice describes the information for which we are the controller in our own right.

3. Information we collect

If you contact us or make an enquiry

• Your name, job role and the organisation you work for
• Your email address and telephone number
• The content of your enquiry and any correspondence that follows

If your organisation books training or consultancy

• Contact details for the people arranging and hosting the work
• Booking details: dates, venue, delegate numbers, agreed scope and fee
• Billing contact details and purchase order references
• Records of correspondence, planning notes and reports arising from the work

If you attend training with us

• Your name, role, setting and work email address
• Attendance records and, where a course is certificated, records of completion
• Any evaluation or feedback you choose to give us
• Any dietary, access or health information you tell us about so we can make reasonable adjustments
• For online sessions, your display name and any messages you send in the chat

If you join our mailing list

• Your name and email address, and optionally your role and setting
• A record of your consent, including the date and the form you used
• Whether our emails were opened and which links were clicked, so we can see what is useful

If you are an associate, supplier or applicant

• Contact and payment details, and records needed to manage the working relationship
• For associates: qualifications, DBS status and insurance details where relevant to the work

If you visit this website

• Technical information such as your IP address, browser type and the pages you visited, collected by our hosting provider in its server logs for security and reliability

Anonymised and aggregated information

We also produce anonymised and aggregated information — for example, the proportion of delegates who rated a session as useful, or summary findings from a belonging audit. This is not personal data in law, because it cannot identify anyone, and we may use it in reports, proposals, evaluations and academic work. If we ever combined it with information that did identify you, we would treat the result as personal data and handle it as set out in this notice.

If you do not give us the information we ask for

Where we need information to deliver work we have agreed to do, or to meet a legal obligation, we may not be able to go ahead without it. We will tell you at the time if that is the case.

4. Where we get your information from

Most of the personal information we hold comes directly from you, when you contact us, book or attend our work, join our mailing list or give us feedback.

We also receive or collect information from:

• The organisation you work for, when it books training or consultancy and gives us delegate lists or contact details for the people we will be working with
• Publicly available sources, such as school and college websites, published staff directories and professional networking sites, where we are identifying the right person to contact about our work. We only use business contact details obtained this way, and we stop contacting you as soon as you ask us to
• Our service providers, such as our mailing list provider, which tells us whether an email was opened or a link followed

5. Why we use your information, and our lawful basis

Under the UK GDPR we must have a lawful basis for using personal information. Ours are set out below.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms. You can ask us for a summary of that assessment, and you have the right to object (see section 14).

If we want to use your information for something else

We use personal information only for the purposes we collected it for, unless the new purpose is compatible with the original one. If we need to use it for an unrelated purpose, we will tell you and explain the lawful basis for doing so. In limited circumstances the law allows or requires us to process information without your knowledge or consent — safeguarding is the main example.

6. Health, access and safeguarding information

Some information is treated as "special category" data under the UK GDPR and needs extra protection.

Access and health needs

If you tell us about a health condition, disability, dietary requirement or access need so that we can make an adjustment for you, we use that information on the basis of your explicit consent (Article 9(2)(a)). We share it only with the people who need it to make the adjustment, and we delete it once the session has taken place.

Safeguarding

Our work is with adults, but it concerns children and young people, and disclosures sometimes arise. If, during a training session, consultancy visit or conversation, we receive information that suggests a child or an adult at risk may be being harmed, we will pass it to the designated safeguarding lead of the setting concerned, and to the relevant statutory services if the setting does not act. We will normally tell you that we are doing this, unless doing so would increase the risk of harm.

Where this involves special category information, we rely on the substantial public interest condition for safeguarding children and individuals at risk (Article 9(2)(g) of the UK GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018). We do not need your consent to make a safeguarding referral, and we cannot agree to keep a disclosure of this kind confidential.

7. Recordings and photographs

We sometimes record online sessions so that delegates who could not attend can catch up, and we sometimes take photographs at in-person training. If a session is being recorded we will tell you at the start, and you can keep your camera off, mute your microphone and change your display name so that you do not appear in it.

We use photographs and recordings in our own promotional material only with your explicit consent, which we ask for separately and which you can withdraw at any time. We do not use images of children or young people in promotional material.

Where a recording captures a delegate talking about their own experience, we treat it as special category information and do not share or reuse it without asking you first.

8. Our mailing list

We send occasional emails about our training, resources and practice. You will only receive them if you have asked to. When you sign up we send a confirmation email and add you to the list only once you click the link in it, so nobody is added by mistake.

Every email we send includes an unsubscribe link, and you can also email us to be removed. Unsubscribing takes effect immediately and does not affect anything else we do for you.

Our mailing list is managed using Mailchimp. Mailchimp records whether emails are opened and which links are clicked, which we use to judge whether our content is useful. We do not sell or rent our list, and we do not share it with any other organisation, including Trauma Informed Schools and Communities UK.

9. Who we share information with

We do not sell personal information. We share it only where we need to:

• Service providers who process information on our behalf under contract, including our email and document provider (Google Workspace), our mailing list provider (Mailchimp, part of Intuit), our records and project systems (Airtable and Basecamp), our accounting system (FreeAgent), our website host (Vercel) and our video conferencing provider (Zoom)
• Our accountant, and HMRC and Companies House where the law requires
• Our insurers and professional advisers, where we need advice or need to notify a claim
• Associate trainers we engage to deliver work for us, who are bound by confidentiality and data protection terms
• Venues hosting our training, where they need delegate numbers, names for signing in, or dietary and access requirements
• Commissioners and funders, where a programme is funded by a local authority or similar body and we report on it. We report anonymised and aggregated findings unless you have agreed otherwise
• Safeguarding and statutory bodies, in the circumstances described in section 6
• A buyer, if the business is ever sold or reorganised

10. Transfers outside the UK

Some of our service providers are based in, or store data in, the United States. Where personal information is transferred outside the UK, we make sure it is protected by one of the safeguards the law allows: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the International Data Transfer Agreement or UK Addendum to the standard contractual clauses. You can ask us for details of the safeguard in place for any particular provider.

11. How long we keep your information

We keep personal information only as long as we need it, and then delete it.

12. How we keep it safe

We use reputable providers, protect our accounts with strong passwords and two-factor authentication, encrypt information in transit and at rest, and limit access to those who need it. Devices are password-protected and encrypted. We review what we hold and delete what we no longer need.

No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner's Office within 72 hours where the law requires.

13. Cookies, this website and other sites

This website does not use tracking or advertising cookies, and it does not profile visitors. Our host records standard server log information, described in section 3, to keep the site secure and running.

If you follow a link from our site to another organisation's site, plug-in or application, that organisation's own privacy notice will apply. We do not control those sites and are not responsible for their privacy practices, so we encourage you to read their notices.

The same applies if you interact with us on social media, or join a session through a third-party platform. Your use of those platforms is governed by their own terms and privacy notices as well as this one.

14. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your information — this notice
• Access a copy of the personal information we hold about you
• Rectification — have inaccurate information corrected
• Erasure — ask us to delete your information, where we have no continuing reason to keep it
• Restrict processing — ask us to pause our use of your information while a concern is resolved
• Object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time
• Data portability — receive information you gave us in a machine-readable format, where processing is based on consent or contract and is automated
• Withdraw consent at any time, where we rely on it. This does not affect anything we did before you withdrew it

To exercise any of these rights, email siobhan@healingyounghearts.com. We will respond within one month. There is no charge. We may ask you to confirm your identity before we release information.

15. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office:

If your query concerns information held about a child by a school or local authority we work with, that organisation is the controller and the complaint should be directed to them.

16. Changes to this notice

We review this notice at least once a year and whenever our practice changes. The date at the top shows when it was last updated. Where a change materially affects how we use information you have given us, we will tell you directly.

17. Contact us

For anything to do with this notice, or with personal information more generally: