About us Policies Privacy Notice privacy notice Your personal information is just that; yours. Bipolar UK Limited understands the value we all put on our personal data, which is why we’re careful to protect the information we hold and keep a check to ensure we only hold the data we need. What follows is an overview of how we look after your information and why. We're more than happy to have a chat about data protection or answer specific questions you may have. Please email us on [email protected]. Privacy Principles When will we ask you for information? How do we collect information about you What information we collect Our website provider Cookies If we support you If you support us Getting to know you Sharing your story Our legal basis for processing information What we do to protect your data and how long we keep it Your choice Changes to our privacy notice Contacting us privacy principles We have never sold nor swapped your data – and we won’t do this in the future. Your data is protected within the charity - only team members who need your information can access your information. With every newsletter and fundraising appeal, we make sure you can change your communication preferences or opt out altogether. We’re especially sensitive when engaging vulnerable adults through our services and through our fundraising. We work hard to safeguard your information through security policies and protocols. We understand that data protection is an ongoing commitment, not a static policy. We want to be fair and transparent over our handling of your data We aim only to collect, hold and process what we need and only for as long as we need it when will we ask you for information? We may collect personal information (e.g. your name, contact number or address) from you when you: Join our eCommunity or eCommunity mailing list Use one of our bipolar support services Make a donation or commit to making a future donation Make a purchase from our online shop Enquire about or sign up for a fundraising event Request bipolar support materials from us Apply to volunteer or work with us Request research information Join our bipolar research community how do we collect information about you? Almost all of the information we collect about you comes directly from you. This means that you are able to determine what we do with your data from the very start. You’re most likely to have been in touch via our website or email first, but we also start the data collection process in Support Groups or if we speak on the phone or even face to face. We use third-party companies, such as JustGiving and CAF Donate and payroll giving agencies to collect and process personal data on our behalf. Third party companies only provide us with your data if you have given them permission to do so. Otherwise, your information is anonymised before it is passed to us. what information we collect We try to record what you’re interested in and what moved you to get in touch. For example, if you got in touch to discuss a local Support Group, the relevant service team will ask your permission to keep your information on record, so that they can keep you updated on groups. We keep track of any correspondence and link it to future and past communication. We aim to make a note of what we’ve previously discussed with you (whether by phone, post or email) so that we don’t repeat the same message, or ask you to repeat information you have previously given us. We can tailor our conversations and communications based on what has been said before and the topics that interest you. If you contact our services, or research teams they may collect health information, such as your experiences of bipolar but will seek your consent before recording this. If you contact the fundraising team, they only record that you have bipolar if you freely offer such information and consent to their recording this. The fundraising team cannot see the services teams’ records and vice versa, similarly with research records these are encrypted and only accessed by the research team. Other sensitive data in relation to matters such as ethnicity, sexuality and religion is only collected if you agree to provide it and is processed in an anonymised form in order to analyse the provision of our services and ensure that we are acting in an inclusive and non-discriminatory way. Both services and fundraising teams may take note of where you work if you tell us. Workplace advice team can be given most effectively if we only deliver their most effective advice if they have a clear view of your workplace. The fundraising team are hoping to increase the number of corporate supporters of Bipolar UK and know the most effective way to do so is by galvanising internal champions. If you make a donation, the fundraising team collects financial information, such as debit/credit card details and/or bank details for Direct Debits. The moment debit/credit card information is input into our third-party site for payment, it is shielded from us – we cannot recall the data. Bank details for Direct Debits are securely stored with our processing partners and on our internal, separately secured database. If you’re taking part in an event for us, we may ask for your next of kin contact details in the case of emergency. We will never contact that individual for any other reason without their express permission. If the fundraising team understand that you have the ability to make a large donation, they will run a search on sites like Google, Companies House and LinkedIn for publicly available information to get a better view of your capacity and propensity to make a donation, your interest in mental health and bipolar, as well as your networks. The fundraising team also try to make sure that there isn’t anything they should be aware of that may harm the reputation of the charity by association. The resulting profile is kept on record. More generally, we look at information on our website, including which pages people visit the most or which link in our eNewsletter was most popular. We use services like Google Analytics to help us better understand how our website is used. This means we can look at aggregate data to see any patterns or trends (like a spike in FAQs following Stacey’s story on EastEnders) that can help us measure the success of an activity and better prepare for similar activities in the future. We use anonymised aggregate data, but Google Analytics does offer information on IP addresses our website provider Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider The data that may be available to them include any of the data we collect as described in this policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy. cookies Cookies are used in some areas of the Bipolar UK website to identify your computer to our server and help us to track how many visitors we get. This information is anonymous and cannot be used to track exactly who is viewing what. We use this information to monitor traffic trends and plan development of our website. We use Google Analytics to help us understand how people use our website, see how our visitors find us and identify ways to improve visitor experience. We do not sell this information to third parties. Our website cannot operate effectively without these cookies and by using this website you are agreeing to their use. The only way to avoid using cookies is to either not use this site or to change the settings on your computer to refuse them. However, this may mean some sections of the site will not work properly for you. For information on how to turn off cookies, please see your browser's Help menu or visit All about cookies if we support you The data we collect in order to provide you with bipolar support is managed separately from marketing or fundraising data. Collecting and holding sensitive information is necessary for us to provide you with valuable advice, support and guidance. We also use service data for training, quality monitoring and evaluating the services we provide. When you sign up for our eCommunity we ask you to provide contact and demographic information, so we can reach you if we’re concerned about a post and so we can analyse and understand our service impact. Your posts are not publicly identifiable unless you choose to make them so. When you attend a Support Group, you will be invited to complete a contact consent form. If you chose to complete this form, your volunteer co-facilitator will keep you updated on Support Group news in general and your Support Group in particular and we can provide you with broader updates on the activities of Bipolar UK and its fundraising activities. When using the chatbot, transcripts of your conversations are recorded. This is to allow us to better understand how and why our community uses the chatbot, and to provide service improvements. No identifying data is held unless included by the user as part of their transcript. No data related to booked phone calls is held- all data collected when filling in a call back request is automatically pushed through to a Bipolar UK calendar, and is not held by the chatbot. We analyse service user contact across the charity, looking at whether individuals use more than one service and your journey within the organisation. This is particularly useful for us to be able to monitor our impact. Bipolar UK services are confidential services. We will, however, share what you tell us with someone if: You ask us to get you help because you can't do this yourself. We believe your life and wellbeing is at immediate risk. We believe another person's life and wellbeing is at immediate risk. We are told about acts of terrorism or bomb warnings. We are told about criminal acts or the intention to undertake a criminal act. We always want to give you as much control as possible and will explain our policy to you and tell you if we feel we might need to contact emergency services to help you access support. General and service telephone conversations are automatically and securely recorded. If you contact us by phone we will be able to see your phone number and might use this in the case of any of the above situations. If you contact us by email, we will be able to see your email address and your IP address. if you support us Volunteers Depending on your volunteer role, volunteers are likely to be asked to undergo a DBS check (previously CRB check), renewable every three years. We process DBS checks through Mayflower Disclosure Services Ltd. The DBS check process is set out by the Disclosure and Barring Service, a government body. This process includes specifying what proof of ID and address information is required. We complete the form and authenticate the IDs to Mayflower. Once a DBS check has been cleared and received, we shred and/or delete any personal information but keep the record that a DBS check was made. For many of our volunteer roles, we will ask you to complete a form and references and make notes of our assessment. Both documents, along with your volunteer application form are retained for the lifespan of your engagement within Bipolar UK and for a period of one year thereafter or such longer period as is necessary for safeguarding, legal, contractual or insurance purposes or in case of a claim. Only nominated ‘volunteer coordinators’ within directly relevant services and our central administration will have access to the otherwise restricted files. We keep the personal information of those making unsuccessful applications for 1 year after the date of the application in case there are follow up queries about the process. After that we delete it unless the candidate requests that we keep their details for longer or we need to keep a note that an unsuccessful application was made. Emergency contact information will be asked of you, should you be travelling as part of your volunteer work for Bipolar UK or should you be working alone. For example, if you are travelling to a workplace to give an awareness talk on bipolar. Such contact information is stored for an agreed period and then destroyed. We do not add emergency contact information to our contact database. All service user and volunteer data is held securely and can only be accessed by the relevant service team and (as necessary) IT support. Supporters We store information on our donor database. The secure database is only accessible by the fundraising team and (as necessary) IT support. At a base level, we aim to collect your name and address. This is because we cannot match past or future donation to the same person by name alone and because, should you complete a Gift Aid declaration, HMRC requires full name and address details for a claim to be valid. We also ask for email addresses because it’s a cost-effective way for us to keep in touch. We try to complement postal communication with email communication, but only if you have told us you’re happy for us to email you. If you make a donation by credit/debit card, whether over the phone or online, payment details are sent directly to Stripe, our card payment processing partner. Once the card details are entered, we cannot see or retrieve the information and it is not held on our systems. We do not automatically record and store fundraising calls because of the financial information that may be shared in the course of the conversation. If you set up a Direct Debit, we securely store your details as it is a recurring payment and we need to be able to match future changes (cancellations, upgrades) against account information. Our Direct Debit partners are Go Cardless and Smart Debit. When posting appeals, we hire a mailing house, which combines printing, packing and posting the letters. Mailing houses are contracted on a campaign basis. The mailing house receives the name and address information needed to do their job (via secure transfer) but, by contract, they do not have permission to hold or use the data beyond the lifespan of each job. Please remember to let us know if you move house, even if you have opted out of receiving letters. This is because your Gift Aid declaration is only valid if matched against a current address and we do not currently use Royal Mail’s National Change of Address service. getting to know you We know people support our work for a variety of reasons. It helps us in the fundraising team to understand what those reasons are so we can communicate with you in an appropriate way. For example, if you support our work because you have direct experience of bipolar, you probably won’t get much value from a letter explaining to you what bipolar is – you already know. For us to communicate with you the right way, we do need to have an accurate picture of who you are. This means we may ask you to let us know what motivated you to donate or how you feel about our work. The information you provide offers insight that we analyse to plan our activities. If someone has provided an address in writing we can’t decipher, we’ll use Royal Mail’s address finder service. When we’re sending planned appeals, we’ll use a screening company to check that no one on the list has recently passed away. The last thing we want to do is send an appeal bearing the name of a lost loved one only for their next of kin to receive it. We also analyse email results, such as open rate and click-through. We don’t want to waste anyone’s time on emails that no one is reading, so it’s important to be able to see what messaging people are interested in. We may also look at publicly held information through the charity commission, companies’ house and Google, to better understand you and your philanthropic priorities so that we can be measured in who we approach for substantial support. Research of this kind is important because there is a risk to the charity if we unwittingly align ourselves with someone that would undermine the trust we have built with our service users or damage our reputation. We also don’t wish to waste prospective donors’ time by making uninformed approaches. For instance, there is no point in us writing a letter to someone who has publicly declared that they are solely committed to supporting international development charities. We can only know that by researching the person using publicly held information and storing it against their record so that we don’t have to repeat the research in the future. sharing your story We are grateful to you when you share with us your experience of bipolar. Case studies, quotes and stories bring bipolar to life for people who may not otherwise understand the illness. Sharing your story is a powerful communication tool but we respect the privacy of our service users. Service user case studies and quotes are anonymised, with names and identifying information changed unless you have consented for us to use your real name. We do not otherwise alter the facts of any story, nor do we produce composite service user case studies. We seek express permission to use a supporter’s story before publishing any fund raising or other case study which is not anonymous. Wherever practical, service user and fundraising stories are shown to the subject for prior approval. Your image (photo/video) would only ever be used with your express consent for use in online and offline publications. our legal basis for processing information Our principal reason for collecting and processing information is always to pursue our legitimate interest in carrying out Bipolar UK’s charitable purposes of supporting all those affected by the much misunderstood and devastating condition of bipolar and acting as their voice in the UK. This includes raising funds for those purposes and the other activities described in this policy. We may contact you by post or telephone, unless you ask us not to do so. We will only contact you by e-mail, text or mobile phone if you have consented to our doing so. Sometimes we may also have to process your information in order to fulfil our legal obligations, carry out a contract with you or safeguard your vital interests or those of someone else. what we do to protect your data and how long we keep it We ensure there are clear standard operating procedures in place for handling data. This includes limiting access to personal data to individuals who must log in with a unique username for access. In the interest of security, we do not publicly state our internal technical and operational measures for protecting your data. We will state however that we challenge and review our processes on a regular basis to keep step with changing technology and expectations and we also require all those providing services to us to maintain secure procedures. We may need to disclose details if we are required to by authorities including the police, HMRC and regulatory bodies. The length of time we keep your information depends on its nature and is subject to your rights to request deletion. Generally, information needed to communicate with you is kept until you ask to leave the relevant mailing list or we have reason to believe the information is out of date or erroneous. When you ask us not to contact you then we may keep information needed to check that we do not inadvertently contact you. Service user information may be retained for 5 years or such longer period as is necessary for safeguarding, legal, contractual or insurance purposes or in case of a claim. your choice Whenever we are using your personal data on the basis of consent (e.g. by contacting you by e-mail or text message) you can withdraw that consent at any time. You can ask us to stop processing your personal data for direct marketing and, except to the extent we need your information to process a parallel request from you (e.g. registering for an event), we will stop. You can ask us for a copy of the information we hold about you. If your information is incorrect, out of date or if there is no longer justification for us to hold it you can ask for it to be updated, removed or blocked from use You can also opt out of fundraising or marketing communications at any time. Please contact us on [email protected] or 0333 323 3780 to request that we update your preferences. It’s important to note that we may still have to contact you for administrative purposes. For instance, if your Direct Debit is amended or cancelled, we will write you a letter or email to confirm the action. What information does the Mood Application obtain and how is it used? The Mood App does not provide an option to create an account therefore, we do not store nor have access to your entries and data. Your data are stored only locally on your device and all calculations are done on your device as well. We obtain your email address when you request support via email or customer support contact form. We use your email only to contact you to provide support, feedback or important information. Backup We advise our users to regularly backup their data. Our users can choose to manually export the backup file and store it wherever they want or you can optionally make cloud backups. The cloud backups are kept in users' private cloud space where Bipolar UK have no access. Android Google Drive BackupsAndroid users can optionally backup their data using Google Drive. Their backups are stored in their private Google Drive space and count against their quota. We use a secure connection to your Google Account and data is safely stored in a folder where we nor other apps have access. View Google Privacy Policy at https://www.google.com/policies/privacy/ The email and name permissions within the Android are requested in order to display the account details within the app to inform users about the account which is being used for the backups. The app does not keep email addresses and names within the app. The app asks Google Sign In for a connected account and displays the account info only when accessing the Backup section. Even if the user agreed to anonymous analytics data collection your email address or name is never sent with the analytics data. iOS iCloud BackupsiOS users can optionally backup their data using iCloud Drive. Their backups are stored in their private iCloud Drive space and count against their quota. iCloud secures your information by encrypting it when it's in transit, storing it in iCloud in an encrypted format, and using secure tokens for authentication. For certain sensitive information, Apple uses end-to-end encryption. This means that only you can access your information, and only on devices where you’re signed into iCloud. No one else, not even Apple, can access end-to-end encrypted information. You can find out more about iCloud security and privacy overview at https://support.apple.com/en-us/HT202303 Analytics Our Mood app may collect some anonymised usage data that are essential for us to deliver our services, to understand your needs, and to improve our services. Such as app launches, taps, clicks, scrolling information, in-app purchases, screen visits, session durations, or other information about how users interact with our app. These data are fully anonymised and aggregated and thus not linked to any particular user. The application may also collect crashes and performance reports so we can improve the stability and performance of our app. The application does NOT collect any user-generated content. Such as your name, surname, email, photos, or anything you type within the app. Your entries and memories are truly private and fully under your control. Android We use the following third-party services for our Android app: Google Analytics for Firebase (Google Inc.) This service helps us to collect and analyse usage data in order to understand usage patterns and to improve our Android app. Data collected: various usage and device data such as cookies, unique device identifiers, Android Advertising ID, Firebase installation IDs, Analytics App Instance IDs, usage data, anonymized IP addresses, session durations, device models, operating systems, geography, in-app purchases, first launches, app opens, app updates Data retention: 90 days Firebase Crashlytics (Google Inc.) This service helps us to identify crashes and errors in our app. It helps us to improve the reliability and stability of our Android app. Data collected: Crashlytics Installation UUIDs, crash traces, device models, geography, operating systems Data retention: 90 days iOS We use the following third-party services for our iOS app: Google Analytics for Firebase (Google Inc.) This service helps us to collect and analyse usage data in order to understand usage patterns and to improve our iOS app. No personal data are collected Data collected: various usage data, Firebase installation IDs, Analytics App Instance IDs, anonymized IP addresses, session durations, device models, operating systems, geography, in-app purchases, first launches, app opens, app updates Data retention: 90 days Firebase Crashlytics (Google Inc.) This service helps us to identify crashes and errors in our app. It helps us to improve the reliability and stability of our iOS app. No personal data are collected Data collected: Crashlytics Installation UUIDs, crash traces, device models, geography, operating systems Data retention: 90 days Bipolar UK’s Mood app is for your own use at your own risk and does not constitute or provide medical advice or treatment. Changes to your medication should only be carried out after consultation with your doctor. The Mood App does not offer crisis support. We do provide free Peer Support services, but if you are in crisis it's important you don't wait for symptoms to get worse. Reach out for help now. Or if you need someone to call on your behalf, let them. A crisis doesn't mean you do not deserve help. changes to our privacy notice We may update this notice from time to time as regulation or our internal processes change. If we make a significant change to this notice, we will advertise the amendment on the Bipolar UK website. If you wish to be contacted directly in the event of significant changes to the Privacy Notice, please send your contact details and request to [email protected] contacting us Our Safeguarding Officer is Rosie Phillips who can be contacted via [email protected]. If you want to access the information we hold on you, update information we hold, request or opt out of marketing communications, change the way we process your information or have any question, comment or suggestions about how we look after your personal data, please contact us at [email protected] or Data Protection, Bipolar UK, 32 Cubitt Street, London, WC1X 0LR. If you are not happy with anything do contact us first so that we can resolve any problem or query. You can also get in touch with the Information Commissioner’s Office, using their helpline 0303 123 113 Manage Cookie Preferences