East Dunbartonshire Association for Mental Health (EDAMH)

Last updated: 28 October 2026

1. Introduction

East Dunbartonshire Association for Mental Health (EDAMH) is committed to protecting your privacy and handling your personal information lawfully, fairly, securely and transparently.

This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, contact us, make a referral, access our services, volunteer, work with us, donate to us or otherwise interact with our organisation.

We recognise that people who use our services may share highly personal information about their mental health, personal circumstances and experiences. We treat this information with particular care and respect.

This policy should be read alongside any service-specific privacy information we provide when collecting information from you.

2. Who we are

East Dunbartonshire Association for Mental Health (EDAMH) is a Scottish charitable organisation providing community-based mental health support and recovery-focused services.

Our contact details are:

East Dunbartonshire Association for Mental Health (EDAMH)
Suite 7, Enterprise House
Strathkelvin Place
Kirkintilloch
G66 1XQ
Scotland

Telephone: 0141 955 3040
Email: info@edamh.org.uk
Website: https://edamh.org.uk/

Company number: 201746
Scottish Charity Number: SC029675

EDAMH is responsible for deciding how and why personal information is processed for the purposes described in this policy. We act as the data controller where we determine those purposes and means.

Data protection contact: David Scarry via email at DavidScarry@edamh.org.uk

3. What personal information do we collect?

The information we collect depends on how you interact with EDAMH and which services you use.

Information about people accessing our services

Where relevant to providing our services, we may collect:

• Your name, contact details, address and date of birth.
• Referral information and details of the organisation or person referring you.
• Information about your mental health, wellbeing, support needs and recovery goals.
• Information you choose to share about your personal circumstances, relationships and experiences.
• Information relevant to safeguarding, personal safety and risk assessments.
• Records of assessments, support sessions, agreed actions, referrals and progress.
• Information needed to coordinate support with other organisations, where appropriate.
• Information about accessibility requirements and communication preferences.

We aim to collect only information that is relevant and necessary for the purpose for which it is required.

Information from website visitors and people contacting us

When you contact us by website form, email, telephone, post or other means, we may collect your contact details, the content of your enquiry and any other information you choose to provide.

Please consider carefully what sensitive information you include in an ordinary website enquiry. If you need to discuss personal circumstances, we can advise you about an appropriate way to contact the relevant team.

Information about staff, volunteers and applicants

Where applicable, we may collect information needed to recruit, employ, manage or support employees, volunteers, trustees and job applicants. This may include contact details, employment history, qualifications, training records and other information relevant to the relationship.

Additional information, including criminal record or health information, will only be processed where appropriate and legally permitted.

Information about donors, supporters and partners

Where applicable, we may collect contact details, donation records, correspondence, event participation information and communication preferences to administer donations, maintain relationships and meet our legal obligations.

Website and technical information

When you visit our website, technical information may be collected, depending on the website’s configuration. This may include:

• IP address and device or browser information.
• Pages visited and interactions with website features.
• Approximate location derived from technical information.
• Website security logs and diagnostic information.
• Cookie and similar technology data, subject to applicable requirements.

The precise information collected depends on the tools, services and technologies operating on our website.

4. Where do we obtain personal information?

We may obtain personal information directly from you, including when you complete a referral form, contact us, attend an appointment or participate in a service.

Where appropriate and lawful, we may also receive information from:

• A professional or organisation making a referral.
• Health, social care or other support services involved in your care.
• Family members or other representatives, where appropriate.
• Employers, referees or recruitment agencies in relevant employment matters.
• Service providers and technology platforms supporting our operations.
• Public authorities or other organisations where there is a lawful reason to obtain the information.

Where information is provided by another person or organisation, we will explain the relevant arrangements where required by law.

5. Why do we use your personal information?

We use personal information only for defined and legitimate purposes, which may include:

• Assessing referrals and determining whether our services are suitable.
• Providing individual and group support and helping people work towards their recovery goals.
• Delivering relevant programmes, including our Violence Against Women Recovery Project and CEDAR-related services, where applicable.
• Maintaining appropriate support records and coordinating services.
• Protecting people from harm and meeting safeguarding responsibilities.
• Responding to enquiries, requests and complaints.
• Administering recruitment, employment and volunteering.
• Managing donations, fundraising, events and organisational relationships, where applicable.
• Managing and securing our website and information systems.
• Evaluating our services, preparing reports and meeting funding or contractual requirements.
• Complying with legal, regulatory, accounting and reporting obligations.
• Protecting the rights, safety and legitimate interests of individuals and our organisation.

Where possible, information used for research, evaluation or reporting will be aggregated or anonymised so that individuals are not identified.

6. Our lawful bases for processing information

Data protection law requires us to have a lawful basis for processing personal information. The appropriate basis depends on the circumstances and purpose of the processing.

Depending on the activity, EDAMH may rely on one or more of the following:

Consent: Where you have freely agreed to a specific use of your information and consent is the appropriate legal basis.

Contract: Where processing is necessary to enter into or perform a contract with you.

Legal obligation: Where we must process information to comply with a legal requirement.

Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your rights and freedoms. We will consider the impact on individuals before relying on this basis.

Public task: Where processing is necessary for a task carried out in the public interest or under official authority, where the relevant legal requirements are met.

Vital interests: In limited circumstances where processing is necessary to protect someone’s life or other vital interests.

We will identify the appropriate lawful basis for each relevant processing activity rather than assuming that one basis applies to everything we do.

Special category information

Some information we handle, particularly information about mental health, physical health and certain personal circumstances, may be classed as special category personal data and receives additional legal protection.

Where we process special category information, we must have both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9, together with any additional requirements under the Data Protection Act 2018 where applicable.

Depending on the circumstances, these conditions may include explicit consent, provision of health or social care, substantial public interest or another applicable statutory condition.

The specific condition will depend on the purpose and circumstances of the processing. We will not assume that providing a mental health support service automatically permits all uses of health information.

Where criminal offence information is processed, we will apply the additional requirements that govern that information.

7. Who do we share personal information with?

We do not sell personal information.

We may share relevant information with other organisations or individuals where there is a lawful and necessary reason to do so. This may include:

• Health and social care professionals involved in coordinating your support.
• Local authorities, health and social care partnerships and other public bodies.
• Organisations making referrals or supporting the delivery of our services.
• Other service providers where a referral or coordinated support arrangement is appropriate.
• Funders, commissioners, auditors or regulators where disclosure is necessary and lawful.
• IT, website hosting, email, record-management and other service providers acting on our behalf.
• Professional advisers, insurers or legal representatives where appropriate.
• Police, emergency services or safeguarding authorities where required by law or justified to protect people from serious harm.

We will limit disclosures to the information reasonably necessary for the relevant purpose and apply appropriate safeguards.

Where we rely on consent for sharing information, we will explain what is being shared, with whom and why, as appropriate. Other disclosures may be based on a different lawful basis and may not require consent.

We will not treat your participation in a service as blanket permission to share all your information with other organisations.

8. Confidentiality and safeguarding

We understand the importance of confidentiality, particularly when people discuss their mental health, relationships or experiences of abuse.

Access to service-user information should be restricted to authorised people who need it to perform their responsibilities.

There may be circumstances in which we need to share information without your consent, for example where we have a legal obligation to do so or where sharing is necessary and lawful to protect you or another person from serious harm.

Where appropriate and safe to do so, we will explain the reasons for a disclosure. We will consider the circumstances carefully and share only what is necessary.

If you have concerns about confidentiality, please speak to the staff member supporting you or contact our data protection contact.

9. How do we protect your information?

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.

Depending on the information and systems involved, these measures may include:

• Restricting access to authorised personnel.
• Using passwords, access controls and other security measures.
• Providing relevant confidentiality and data protection training.
• Using appropriate security measures for electronic and paper records.
• Reviewing the security arrangements of organisations processing information on our behalf.
• Applying appropriate procedures for sharing, retaining and disposing of records.

No method of electronic transmission or storage is completely secure. However, we work to ensure that personal information is protected in a manner appropriate to the risks involved.

10. How long do we keep personal information?

We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of applicable legal requirements, contractual obligations, safeguarding needs and legitimate organisational requirements.

Different categories of information may need to be retained for different periods. These may include service-user records, referral forms, employment records, financial information, correspondence and website logs.

When information is no longer required, we will securely delete, destroy or anonymise it, as appropriate.

===EDAMH

11. Transfers of personal information outside the UK

Some of the organisations providing website, email, cloud storage or other technology services may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that the transfer complies with applicable data protection law and that any required safeguards are in place.

These safeguards may include an applicable adequacy regulation, an approved transfer mechanism or another lawful transfer route, together with any additional protections required by law.

We will provide further information about relevant transfers where required.

12. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Ask us to delete personal information where the legal conditions are met.
• Restriction: Ask us to restrict how we use your information in certain circumstances.
• Data portability: Request certain information in a reusable format where the right applies.
• Object: Object to processing based on legitimate interests or to certain other processing where the law provides this right.
• Withdraw consent: Withdraw consent where we rely on consent as our lawful basis. This will not affect processing that took place before consent was withdrawn.
• Complain: Raise a concern with us or complain to the relevant data protection regulator.

These rights are subject to legal conditions and exceptions. For example, we may need to retain certain records to meet legal obligations or establish, exercise or defend legal claims.

We will explain our decision if we cannot fully comply with a request, where required by law.

13. How to exercise your rights

To make a data protection request, contact EDAMH using the details in Section 2 and explain what you would like us to do.

We may need to verify your identity before providing information or acting on your request. If you are acting for another person, we may also need to confirm that you have the authority to do so.

We will respond within the applicable statutory timeframe. Under the usual UK GDPR rules, this is one month, although certain requests may be subject to a lawful extension.

There is generally no charge for making a request. We may charge a reasonable fee or refuse to act where the law permits this, for example in the case of manifestly unfounded or excessive requests.

14. Website cookies and similar technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences, maintain security or understand how visitors use the site.

The specific cookies and technologies in use depend on the website’s current configuration.

Where required by law, we will obtain your consent before using non-essential cookies or similar technologies. You should be able to make an informed choice and change your preferences.

You can also manage cookies through your browser settings, although blocking certain cookies may affect website functionality.

For further information, please refer to our cookie notice or cookie preference settings, where available.

15. External websites and third-party services

Our website may contain links to external websites or services operated by other organisations.

When you follow an external link, that organisation’s privacy policy and data-handling practices will apply. EDAMH is not responsible for the privacy practices of external websites that we do not operate.

We recommend checking the relevant privacy information before providing personal information to another organisation.

16. Marketing and communications

We may contact you about enquiries, services, events or other matters relevant to your relationship with EDAMH.

Where we send fundraising, promotional or other direct marketing communications, we will comply with applicable data protection and electronic marketing requirements.

We will seek consent where required and provide an appropriate way to opt out of marketing communications. You can also contact us to update your communication preferences.

Opting out of marketing will not prevent us from sending essential administrative messages relating to a service or other existing relationship where appropriate.

We will not use confidential information shared for mental health support to target marketing without a lawful basis and appropriate safeguards.

17. Children’s and young people’s information

Some of our programmes may involve children or young people, including services such as CEDAR.

Where we process children’s or young people’s information, we take particular care to protect their privacy, consider their understanding and circumstances, and comply with applicable legal requirements.

We will explain how information is used in an age-appropriate way where appropriate. We will also consider safeguarding responsibilities, confidentiality and the circumstances in which information may need to be shared.

Where required, we will obtain appropriate authorisation or consent and follow relevant service-specific procedures.

18. Automated decision-making

EDAMH will not subject individuals to solely automated decisions producing legal or similarly significant effects unless the applicable legal requirements are met.

If we introduce such processing in the future, we will provide the information required by law, including information about the process and relevant rights.

19. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our services, the information we process, our systems or applicable law.

The latest version will be published on our website, with the revision date shown at the top of the policy. Where required, we will provide additional information or notify affected individuals about significant changes.

20. Contact us or make a complaint

If you have questions about this policy, wish to exercise your data protection rights or have concerns about how we use your personal information, please contact:

East Dunbartonshire Association for Mental Health (EDAMH)
Suite 7, Enterprise House
Strathkelvin Place
Kirkintilloch
G66 1XQ
Scotland

Telephone: 0141 955 3040
Email: info@edamh.org.uk
Website: https://edamh.org.uk/

If you are unhappy with our response, you can contact the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Website: https://ico.org.uk/
Telephone: 0303 123 1113

You can find further information about your rights and how to raise a concern on the ICO website.