Privacy Policy

We are committed to safeguarding the privacy of our website visitors and service users.

This policy applies where we are acting as a data controller with respect to the personal data of our website visitors and service users; in other words, where we determine the purposes and means of the processing of that personal data.

1. WHO ARE WE AND WHAT IS ELEMENTAL?

1.1 We are In Your Element Ltd, t/a ‘Elemental’ a company registered in Northern Ireland, with registered number: NI619268. Our offices are at 1-3 Guildhall Street, Derry, BT48 6BB (we, us, our).

1.2 We provide an online platform (Elemental) which facilitates the provision of social prescription services by enabling health and social care professionals to set up patient profiles, make instant referrals to referral handlers (social prescribing link workers) and onward connections to community providers, and enables the exchange of notes about patients to help assess the social prescription services being provided. In some instances, Elemental can also be accessed directly by individuals who would like to Self-refer to a social prescription hub and review their progress for themselves using our analytics tools and graphs. Any reference herein to our Services means the provision of Elemental.

1.3 In each case, we make Elemental available to designated users because we have been contracted to do so by a body such as a Voluntary Community Social Enterprise (VCSE) provider, healthcare provider, a private surgery, an NHS trust or a housing association which is responsible for running a particular Social Prescription Programme. Any reference in this privacy notice to our Client will be a reference to the body that engaged us to provide Elemental to you.

2. WHAT IS THIS NOTICE?

2.1 In order to provide our Services, we may need to process Personal Data from time to time (that is information from which an individual can be identified). This Personal Data may be about you or other people. This notice explains how we use the Personal Data we hold. Elemental enables Users to collect and share data. This notice only deals with our use of Personal Data. Recipients of any Personal Data transferred or accessed using Elemental (which may include a Client and/or other Professional Users) are not bound by this privacy notice.

(i) Before you decide to take part in a Social Prescription Programme, please ask your healthcare professional or social prescribing hub who might be given access to your data, and how that data may be used.

(ii) If you upload Personal Data on to Elemental, it is up to you to make sure the recipient of any Personal Data you’ve sent will use the information as you intend.

(iii) Since we are providing Elemental on the basis of the instructions we receive from our Client, our Client (or any third party designated by our Client) may access any Personal Data (whether relating to Patients or to other Professional Users) uploaded on to Elemental.

2.2 We might need to change this privacy notice from time to time. If we do, we will let you know. So please do keep an eye on our notice before sending us any Personal Data or uploading it on to Elemental.

2.3 All of the defined terms in this notice are explained in paragraph 14 below. If you have any questions about this notice, feel free to send us an email to dpo@elementalsoftware.co.

3. WHO DO WE HOLD PERSONAL DATA ABOUT?

3.1 We hold Personal Data about the following groups of people:

(i) Client and Prospective Contacts: that is key contacts within our clients and prospective clients’ businesses;

(ii) Professional Users: that is anyone who uses Elemental in a professional or work capacity. This can be broken down into the following categories:

(a) Administrative Users: those people designated to use Elemental in order to manage and/or evaluate an aspect of our Client’s Social Prescription Programme.

(b) Referring Agents: those individuals designated to provide social prescription referrals as part of a Client’s Social Prescription Programme. This might be a general practitioner or a health or social care professional.

(c) Referral Handlers: these are ink or support workers designated to use Elemental as part of a Client’s Social Prescription Programme.

(d) Community Providers: that is anyone involved in providing programmes, activities, events or services in the community, who have been designated to provide services to Patients in connection with a Client’s Social Prescription Programme.

(iii) Patients: that is anyone who has agreed to receive social prescription services as part of a Client’s Social Prescription Programme, whether through a healthcare professional or a Self-referral.

(iv) Users: we may also collect usage data about anyone who accesses our website and/or Elemental. This data will only include data about how a user interacts with our software.

4. ARE WE A CONTROLLER OR A PROCESSOR?

(i) Client and Prospective Client Contact Data: We are a Controller in respect of any Personal Data which we collect about our Clients and Prospective Clients. This is because we collect the data for our own business purposes and we make decisions about how best to use that data to achieve our aims of running an effective business.

(ii) Professional User Data: We are a Processor in respect of any data relating to Professional Users, which is uploaded on to Elemental (or provided to us for the purposes of setting up the individual as a user). We will only use this data to facilitate the Services we have agreed to provide to our Client. Upon expiry of the relevant Client contract, we will cease to make any further use of any such Professional User Data.

(iii) Patient Data: We are a Processor in respect of any data relating to Patients, which is uploaded on to Elemental (or provided to us in connection with our Client’s Patients for the purposes of a Social Prescription Programme. We will only use this data to provide the Services we have agreed to provide to a Client. Upon expiry of the relevant Client contract, we will cease to make any further use of any such Patient Data.

(iv) Usage Data: We are a Controller in respect of any usage data we collect which relates to how a User of Elemental interacts with our platform. This may include IP addresses, information about devices used to access our software and other technical data. We will only use this data to make sure that our software is being used in accordance with our terms of use.

5. WHAT PERSONAL DATA DO WE HOLD AND WHERE DO WE GET IT FROM?

5.1 We may collect or obtain data about Clients and Prospective Clients in the following ways:

(i) Direct interactions with a Client or Prospective Client: information which a Client or Prospective Client provides us with directly about its key contacts. This may include identity and contact data, as well as information about a client’s transactions with us and an individual’s position in a company.

(ii) Information which we collect from publicly available sources: to help make sure the right people know about what we do, we may carry out research to find out who we think might be interested in using Elemental.

5.2 We may collect or obtain data about Professional Users in the following ways:

(i) Data given to us by Client personnel to facilitate their Social Prescription Programme: We will hold Personal Data about Professional Users primarily because they have been designated by a Client (or Administrative Users or Referral Agents) to take part in that Client’s Social Prescription Programme.

(ii) Direct interactions with Professional Users if they contact us in connection with the functionality of Elemental.

5.3 We may collect or obtain data about Patients in the following ways

(i) A Client or Professional User may provide us with information about Patients designated to take part in their Social Prescription Programme.

(ii) Data added to Elemental by Professional Users: The majority of the data we will store about Patients will be because Professional Users upload it on to Elemental (or pull it over from their own system). This may include contact data (such as name, address and telephone number), NHS number as well as medical history data, case notes, attendance notes and reasons for referral.

(iii) Data which a Patient uploads on to Elemental if they self-refer set up and use an account. This may include name and contact data (such as address and telephone number). It could also include health metrics or other information about a Patient’s health or well-being, reasons for referral which they upload on to their Elemental account.

5.4 We may also collect usage data when a User accesses our software This may include IP address, login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform and other technology on the devices used to access Elemental. This data may be collected through the cookies we use or other technology. If you would like to know more about our cookies policy, please click here

5.5 We may also collect, use and share Aggregated Data which we collect from interactions with our Clients or any Users of Elemental. Aggregated Data may be derived from Personal Data but it does not include any data which can be used to identify anyone. The type of information we might collect includes demographic information and statistical data which may help us to identify broad trends in social prescription referrals. We may use this information to help us learn how we can improve Elemental or better support our clients or to enable research to be conducted into the value and benefit of social prescription.

6. HOW DO WE USE THE PERSONAL DATA WE HOLD AND WHAT IS OUR LAWFUL BASIS FOR DOING SO?

6.1 We use data about Clients and Prospective Clients for the following purposes:

(i) To provide our services to our Clients. This may include agreeing the parameters of the Social Prescription Programme, facilitating the set-up and managing payment. This use is necessary to perform our contract with a Client or to take steps necessary to enter into a contract.

(ii) To manage our relationship with our Clients and Prospective Clients. This may include notifying Clients or their personnel of updates to our services or software or updates to our privacy notice. This use is necessary to perform our contract with a Client or to take steps necessary to enter into a contract.

(iii) For Administration and Dispute Resolution purposes. This may include processing Personal Data to meet our internal administration requirements and for matters such as dispute resolution. This is necessary to protect our legitimate interests of running our business.

(iv) For marketing purposes. From time to time we might contact Clients and Prospective Clients by telephone or email about updates to our services, new features or functions or new products we are bringing out. Our marketing may be tailored on the basis of what we think your interests are (from looking at past transactions and interactions). We will always include the right to opt out in any such correspondence. Generally we will rely on the fact that this is necessary to protect our legitimate interests of running our business, however where required by law we will obtain your consent.

6.2 Any information (including Personal Data relating to Professional Users or Patients) which has been uploaded on to Elemental or provided to us for the purposes of facilitating a Social Prescription Programme, we hold as a Processor. We will only use this data in accordance with our Client’s instructions. This means that the Client responsible for setting up the relevant Social Prescription Programme will have access to and be able to control who else has access to, and what uses are made of, any of the information uploaded on to Elemental (including case notes and referrals). If you would like more information, please contact us at dpo@elementalsoftware.co. Please note that in order to comply with our request we may need to pass your request on to our Client. We will let you know if this is the case, and only do so with your consent.

6.3 We may use Usage Data t Such use is necessary for us to achieve our legitimate interest of protecting theo monitor account usage, manage disputes and improve our service. integrity of our software. If a User does not use Elemental in accordance with our terms of use, we may cease allowing them to access Elemental and we may inform the relevant Client.

7. WILL WE DISCLOSE PERSONAL DATA TO ANYONE ELSE?

Data Processors

7.1 We may disclose any Personal Data that we hold to our employees as well as other third parties who we engage to help us provide our Services. For example, we use third parties to provide the following services for the following services:

  • Email Provider
  • Host Server provider
  • Marketing Database Provider (in respect of Client and Prospective Client Data only)
  • Patient Assessment Indicator tools

Any such parties contracted by us will be acting as our Processors and will be subject to strict contractual requirements only to use Personal Data in accordance with this privacy notice. If you would like more information about third party processors used by us, please contact us at: dpo@elementalsoftware.co.

Other Disclosures

7.2 We may also disclose Personal Data if:

7.2.1 we are under a duty to do so in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements or to protect the operation of our website, or the rights, property, or safety of us, our users, or others; or

7.2.2 to any buyer if we sell, transfer or merge parts of our business or our assets. If a change happens to our business, then the new owners will only be entitled to use Personal Data in accordance with the provisions set out in this privacy notice.

Disclosures in connection with the Social Prescription Programme

7.3 We provide Elemental as a service to our Clients, who are responsible for running the Social Prescription Programme. This means that the relevant Client will have access to any and all information which we hold on their behalf (which will include personal data relating to Patients and Professional Users as well as case notes and specifics of referrals, interventions and their efficacy). Our Clients are not bound by the provisions of our privacy notice and may use the data accessed in accordance with their own policies and procedures. If you would like to know more about how any data you upload might be used, please contact us at dpo@elementalsoftware.co and we will pass your query on to our Client.

7.4 If you Self-refer, we will transfer your details to the nearest social providing hub and the Client responsible for running it. This privacy notice only deals with how we handle Personal Data. Neither our Clients nor any social prescribing hubs are bound by the terms of this notice. If you have any questions about how your data may be used by the party responsible for running the relevant Social Prescription Hub, please contact us at dpo@elementalsoftware.co and we will pass your query on to the relevant party.

7.5 Elemental enables Professional Users to disclose and share information with each other about a Patient’s progress in connection with a particular Social Prescription Programme. The decision to transfer Patient Data is made by the Professional Users themselves or by a Patient (who has opted to Self-refer). We’ve put together an infographic that might help to explain the process. Please click here to access. If you have any questions about who your data might be transferred to if you take part in a Social Prescription Programme, please ask the Referring Agent or Referral Handler. If you don’t know who that is, feel free to send us an email at dpo@elementalsoftware.co and we will pass your query to our Client for them to contact you directly.

8. WHAT SECURITY PROCEDURES DO WE HAVE IN PLACE?

8.1 It is our policy to ensure that all Personal Data held by us is handled correctly and appropriately according to the nature of the information, the risk associated with mishandling the data, including the damage that could be caused to an individual as a result of loss, corruption and/or accidental disclosure of any such data, and in accordance with any applicable legal requirements.

8.2 There are some steps you can take to help make sure that your data is protected. For example:

(a) if you are a Professional User contacting us with a query or complaint, only ever give us your work details rather than your personal contact details;
(b) if you are sending any financial details or sensitive information, consider sending it in separate emails or encrypted, password protected documents; and
(c) make sure that you keep any passwords associated with your Elemental account secure.

9. WHERE DO WE STORE THE PERSONAL DATA WE COLLECT?

9.1 For Clients based in the EU, we only use servers in the EU (and the UK). Our current host servers are provided by Amazon Web Services, whose servers are based in Dublin and London.

9.2 Some of our processors may be based outside the EEA. We will only use processors who ensure that they have adequate safeguards in place to protect Personal Data relating to you.

9.3 If you are based outside the EEA and would like further information about where we hold your data, please contact us by email: dpo@elementalsoftware.co.

10. FOR HOW LONG DO WE STORE PERSONAL DATA?

10.1 Our retention policies for Client Contact Data are as follows:

(a)we may store data related to financial transactions for up to 7 years to ensure that we have sufficient records from an accounting and tax perspective;

(b)we may archive data relating to negotiations, contracts agreed, payments made, disputes raised and your use of our software for up to 6 years to protect ourselves in the event of a dispute arising between you and us;

(c) we may retain data which is held for marketing purposes for up to 5 years from the date of termination of our contract with our Client (unless the relevant Data Subject requests erasure of their data prior to that date);

(d) we may store aggregate data without limitation (on the basis that no individual can be identified from the data).

10.2 We will retain Prospective Client Contact Data for up to 1 year from the point of collection or last interaction. If a Prospective Client becomes a Client, the retention policy set out in paragraph 10.1 shall apply.

10.3 Any Professional User Data and Patient Data will be returned to the relevant Client or deleted upon expiry or termination of our contract with the relevant Client.

10.4 We may retain Usage Data for a period of up to 6 years after expiry of the relevant Client contract in case of any disputes arising.

11. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PERSONAL DATA WE HOLD?

11.1 You have the following rights in respect of any Personal Data we hold which relates to you and which we hold as a Controller.

(a) Right to be informed: the right to be informed about what Personal Data we collect and store about you and how it’s used.

(b) Right of access: the right to request a copy of the Personal Data we hold, as well as confirmation of:

(i) the purposes of the processing;
(ii) the categories of personal data concerned;
(iii) the recipients to whom the personal data has/will be disclosed;
(iv) for how long it will be stored; and
(v) if data wasn’t collected directly from you, information about the source.

(c) Right of rectification: the right to require us to correct any Personal Data we hold about you which is inaccurate or incomplete.

(d) Right to be forgotten: in certain circumstances, the right to have the Personal Data we hold about you erased from our records.

(e) Right to restriction of processing: the right to request us to restrict the processing carried out in respect of Personal Data relating to you. You might want to do this, for instance, if you think the data we hold is inaccurate and you would like to restrict processing the data has been reviewed and updated if necessary.

(f) Right of portability: the right to have the Personal Data we hold about you transferred to another organisation, to the extent it was provided in a structured, commonly used and machine-readable format.

(g) Right to object to direct marketing: the right to object where processing is carried out for direct marketing purposes (including profiling in connection with that purpose).

(h) Right to object to automated processing: the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects (or other similar significant effects) on you.


11.2 If you want to avail of any of these rights, you should contact us immediately at dpo@elementalsoftware.co. If we are not the Controller, we will need to transfer your request to the Controller – but we will only do so with your consent. If you do contact us with a request, we will also need evidence that you are who you say you are to ensure compliance with data protection legislation.

12. WHAT HAPPENS IF YOU NO LONGER WANT US TO PROCESS PERSONAL DATA ABOUT YOU?

12.1 If we are holding Personal Data about you as a Processor, we will need to transfer your request to the Controller who has engaged us to provide our Services – that will be our Client. They will be able to inform you of the impact of erasing the data they hold.

12.2 If we are holding Personal Data about you as a Controller, we will comply with your request unless we are unable to do so. We will inform you if this is the case and explain the reasons.

13. WHO DO YOU COMPLAIN TO IF YOU’RE NOT HAPPY WITH HOW WE PROCESS PERSONAL DATA ABOUT YOU?

13.1 If you have any questions or concerns about how we are using Personal Data about you, please contact our Data Protection Officer immediately at our address (see paragraph 1.1 above) or by email to dpo@elementalsoftware.co. If we are processing Personal Data about you on behalf of our Client, we will need to pass your complaint to our Client – we will only do so with your consent.

13.2 If you wish to make a complaint about how we have handled Personal Data about you, you may lodge a complaint with the Information Commissioner’s Office by following this link: https://ico.org.uk/concerns/.

14. WHAT DO ALL OF THE DEFINED TERMS IN THIS PRIVACY NOTICE MEAN?

14.1 Throughout this notice you’ll see a lot of defined terms (which you can recognise because the first letter is capitalised). Where possible, we’ve tried to define them as we go, but we thought it might be useful to have a glossary as well. Anywhere in this notice you see the following terms, they’ll have the following meanings:

Client means the party responsible for running a Social Prescription Programme for which Elemental is being made available;

Client Contact Data means Personal Data about key contacts in our Clients’ businesses;

Controller is a legal term set out in the General Data Protection Regulation (GDPR), it means the party responsible for deciding what Personal Data to collect and how to use it;

Elemental means the online platform which facilitates the provision of social prescription services;

Data Subject means the individual who can be identified from the Personal Data;

Patient Data: that is Personal Data about any individuals who have been identified to receive social prescription services as part of our Client’s Social Prescription Programme or Self-referral which has been uploaded on to Elemental or provided to us for the purposes of the Social Prescription Programme;

Personal Data means data which can be used to identify a living individual. This could be a name and address or it could be a number of details which when taken together make it possible to work out who the information is about. It also includes any information about the identifiable individual;

Processor is another legal term set out in the GDPR, it means the party who has agreed to process Personal Data on behalf of the Controller and in accordance with their instructions;

Professional Users means any or all of the following groups of individuals:

  • Administrative Users: any individuals who have been designated to use Elemental in order to manage any aspect of a Client’s Social Prescription Programme.
  • Referral Agents: any individuals who have been designated to provide social prescription referrals as part of a Client’s Social Prescription Programme. This might be a general practitioner.
  • Referral Handler: any link or support workers who have been designated to use Elemental as part of a Client’s Social Prescription Programme.
  • Community Provider: any individuals involved in providing programmes, activities, events or services who have been designated to provide services to Patients in connection with a Client’s Social Prescription Programme.

Prospective Client Data: that is Personal Data about our key contacts in the businesses of prospective clients;

Self-refer or Self-referral means a Patient using a self-referral web form for the purposes of joining a Social Prescription Programme;

Social Prescription Programme means a programme implemented by a VCSE provider, clinic, trust, housing executive or other body to assess a Patient’s social, emotional and practical needs and make referrals to non-clinical services within a Patient’s community; and

User means a user of Elemental or our website.

Last updated: 27-06-2020

Fancy A Demo?

Let’s discuss your plans for mobilizing your communities and explore if and how we can help pop your details and we’ll call you back within 24 hours.

All fields are required.
Full Name
This field is for validation purposes and should be left unchanged.

Newsletter

Subscribe to our newsletter and stay up to date with everything Elemental delivered straight to your inbox. Unsubscribe whenever you want.

All fields are required.
Full Name
This field is for validation purposes and should be left unchanged.

Jennifer and Leeann

Someone’s health and wellbeing can be affected by where they live, what they do for a living, their income or their early childhood background experiences. This in turn leads to some stark, and often avoidable health differences.

We founded Elemental to play an active part in halting health inequalities through the social prescribing movement. Our technology helps communities to be better connected, build resilience and bring real precision to the measurement of the impact of community investment.

We work with organisations that want to continue to invest in their communities but want to be much better at measuring impact and outcomes.

We believe this is a powerful route out of health inequality.

CEO & Co-Founder, Jennifer Neff
COO & Co-Founder, Leeann Monk-Ozgul

Jennifer and Leeann

A message from our founders