CYP privacy notice children

CYP privacy notice children

Who we are and what this notice is for

We are ICS Operations Limited trading as Xyla – CYP. We are part of the Acacium Group of companies.

We deliver digital assessments and interventions for children and young people aged between 5 and 25 who are experiencing mild to moderate mental health difficulties. When we do that we may need to collect and use certain information about you (known as ‘personal data’). We must make sure that we use your personal data in accordance with the law and this notice sets out how we do that.

Designed for young people, by young people

We understand how vital customer engagement is and, from the outset, enlisted a group of young volunteers to help us design and develop an accessible service that truly meets their needs.

We heard how important privacy and confidentiality are to them, that the service must feel customisable, and that the language must not feel dismissive. Their insights have been invaluable, and their involvement continues to guide us as we develop the service further.

What we do

Working together with local health services, we’re able to provide experienced teams of clinicians to deliver high-quality, safe and effective digital interventions.

Upon receiving a referral for assessment and/or treatment from one of our partner organisations, it will be reviewed by our team within 48 hours.

Reducing wait times for mental health support in the UK has become vital. Our service will allow children and young people who need intervention to access it quickly. Key features include:

•           Accessibility via a smartphone, tablet or computer

• Choice of appointments, mainly after school and at weekends

• Clinicians who speak many different languages

Get in touch

If you want to know more about what personal data we have about you how and why we use it, or if you want to raise any other questions, then do drop us a line.

If you are under 13 your parent or carer would need to do this. If you are 13 or over then you can write to our data protection officer yourself

Tracy Cherrington: DPO@acaciumgroup.com

We think it would be best if you discussed this with your parent or carer first, and that you copied them into any emails you send.

Personal data – what’s that?

What we mean is any information that could be used to identify you. At its simplest this could be just your name and address; or, it could include a telephone number, email address, a picture or recording of you.

As we might be supporting you, there are things our healthcare professionals would need to know to help them do that. This could be quite sensitive details about what has happened and how you are doing.

Here below you will find some of the personal data we use:

Basic details	Name, address, email address, NHS number, date of birth, gender, phone number, GP surgery, school, ethnicity, language, religion, carer, next of kin, other person / professional relationships
Contact history	Details of contact we have had with you, referrals received, assessments, treatment appointments and any other form of contact (e.g. phone call to book).
Medical information	Notes and reports about your mental health and any relevant assessments by our healthcare professionals.   Details of your mental health condition and treatment given   Information about historical health conditions which relate to your mental health.   Relevant information from people who care for you and know you well such as health care professionals and relatives

We will only collect and process the minimum amount of personal data necessary to achieve the specified purpose, which is to provide you with safe and effective care.

We will notify you via this privacy notice of any changes to the purpose for which data is collected.

We do not use automated systems, such as AI, to analyse your personal data, assess your behaviour, predict your individual preferences, or make decisions about you without human intervention.

Why do we take this information?

We use the information for the sole purpose of providing the best care and support that we can. This might also include being able to evaluate the quality of support we have given and audit our practices.

Where do we get your personal data from and what do we do with it?

We get information mainly from you, but also if you are under 13 then your parent or carer has to give it to us on your behalf. We don’t buy lists of names. If you are being supported by us then we might take information from, for example, your school which would help us to help you as best we can.

We may also get some information from your GP, local authority, or social care services. We’d only take this if we had your (or your parent/carer’s) permission to do that.

So:

• You might get in touch with us to find out about our services.

• You might need a little bit of help yourself and maybe someone has contacted us for you.

• When you are in touch with us we will sometimes ask you for personal data. As explained above personal data means things like your name, your age, where you live and how we can contact you.

• But that’s only if you are over 13. The first thing we would want to know, and check, is how old you are.

• If you are under 13 then we have to ask a parent or carer, or another adult who looks after you to give us that information for you. We tell them how we keep that information safe in our other ‘Privacy Notice’ – it is a bit longer than this one! They can ask to see any of that information, at any time.

• If you are 13-18 then you can give us permission (or, ‘consent’) to record some data about you depending on what we are doing and hold on to it for as long as we need to.

• If you are getting support then your healthcare professional will sit down with you and explain all of this and check that you agree, that you know what your rights are, and that you understand what we do with your personal data – it is about you after all!

• It is really important to know that we are really careful with this information.

• Everyone here is trained in safeguarding which means that we know how to keep you safe and that includes how we keep your information safe. We don’t share it unless you tell us we can (unless we are really worried about you), and we store it safely.

How long we keep your data for

We have thought a lot about how long we should hold on to personal data. We believe it is only as long as you would consider reasonable, or where we have to because of the law.

We have a list of how long we keep all information and what we do with it (delete or archive) when its time is up! We keep it very safe on our systems, just like you would expect us to.

Your rights

You have all the same ‘rights’ concerning your personal data as adults do – this is a very good thing. There are lots of rights and you can see them here.

If you are under the age of 13 all the above rights still apply to you – your parents or guardians who have parental rights, can exercise these rights on your behalf.

If you want to know more, have a look at our general Patient Privacy Policy.

How to complain

If you (or your parent/carer’s) have any concerns about our use of your personal data, you can get in touch with us using our contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

At the ICO’s address

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Calling the ICO’s Helpline number: 0303 123 1113

Or visiting the  ICO’s Website: https://www.ico.org.uk/make-a-complaint

Updates of this Policy

We regularly review and update this privacy notice as needed. We recommend that you regularly review this privacy notice to ensure you have the most up to date information.

This privacy notice was last updated on 30/04/2025