Music for Health Privacy Notice

The purpose of this notice is to explain how Music for Health Ltd processes client personal data to fulfil its data protection responsibilities. It covers all related activities by the staff and associates/consultants of Music for Health, referred to as MFH for the remainder of this privacy notice, as well as anyone making casual enquiries regarding the services being offered by MFH.

The role of MFH in data protection terms is that of a data controller where it determines the purpose and use of personal data collected. Once received, it becomes the responsibility of the MFH privacy officer (PO), supported by an external DPO if required, to ensure it is processed in accordance with the latest UK data protection legislation. The PO can be contacted as follows:

Music for Health Ltd
5 Halliford Drive, Barnham, West Sussex, PO22 0AB
United Kingdom
Website: https://musicforhealthteam.co.uk
Email: dpo@musicforhealthteam.co.uk

Personal data collected

The personal data processed by MFH will only include basic contact information:

  • Names

  • Email addresses

  • Telephone numbers

  • Postal addresses

MFH does not process any special category personal data such as health information, safeguarding notes, or accessibility data.

Confidentiality and security

MFH staff and associates treat all personal data with due respect and in confidence. It is only disclosed to those who need to have it, and the same duty of confidentiality is expected from all third parties with whom MFH shares personal data.

MFH uses reasonable organisational and technical measures to ensure personal data is kept secure. These include:

  • Gmail accounts with two-factor authentication enabled

  • Data storage and hosting on servers operated by 20i Limited in the UK

  • Encrypted backups where appropriate

Although MFH ordinarily processes personal data within the UK, the use of Gmail means that some data may be processed globally. In these instances, MFH ensures that appropriate safeguards are applied in line with UK data protection law.

Lawful basis for processing

MFH will always process personal data lawfully and in accordance with UK data protection legislation. The lawful bases are:

  • Legitimate interests – to respond to general enquiries, promote MFH services, communicate about events, and stay in touch after business commitments have ended

  • Legal obligations – for example, to provide information to HMRC for tax records

  • Performance of a contract – and for steps necessary prior to entering into a contract

  • Consent – for certain types of marketing communications, such as postal invitations to events. Consent can be withdrawn at any time by contacting the PO

MFH does not use automated decision making or profiling.

Data sharing

MFH may share personal data with some or all of the following third parties:

  • HMRC (Inland Revenue)

  • Solicitors appointed by MFH

  • Accountants appointed by MFH (for accounting purposes only)

  • Contractors/associates, who are subject to a data processing agreement

  • Unspecified recipients, but only when compelled to do so for legal reasons

Retention

MFH follows a retention schedule to determine how long it holds different types of personal data:

  • Routine correspondence for casual and contract-related business (hard copy or email): 3 years

  • Personal data about former customers: 7 years after cessation of the contract or last business-related contact, whichever is later

  • Contact data: indefinitely, unless a valid request to erasure is received from the data subject

  • Financial records and invoices (which may include personal data): 6 years after the end of the current tax year of processing

  • By exception, MFH may retain documentation including personal data beyond these periods, but only for a specified purpose and when MFH has a justified legitimate interest or legal obligation

At the end of the retention period, MFH will either return, destroy or delete personal data. If deletion of electronic data is technically impractical, it will be put beyond operational use. Up to 3 months may be allowed to complete these actions.

Your rights

Under the UK General Data Protection Regulation, you have rights over your personal data. These include:

  • The right to be informed – provided through this Privacy Notice

  • The right to access your data (by making a Subject Access Request to the PO)

  • The right to rectification if your data is incorrect or needs updating

  • The right to erasure if MFH no longer has a legitimate purpose to process your data

  • The right to restrict processing in certain circumstances (data will be taken out of operational use until resolved)

  • The right to data portability of personal data you have provided, in a machine-readable format (where applicable)

  • The right to object to processing where MFH has no legal or contractual obligation

  • Rights related to automated decision making and profiling (not applicable as MFH does not use these techniques)

Further details on these rights are available from the Information Commissioner’s Office (ICO): https://ico.org.uk

Raising concerns or exercising rights

To exercise your rights, raise a concern, or make a query about our processing of your personal data, please contact the PO using the contact details above. MFH may ask for proof of ID or other material to verify your identity before addressing your request.

If you are unhappy with our handling of your data, you may contact the ICO directly. However, MFH will always welcome the opportunity to resolve any issues with you first.