Privacy Notice
This page explains what information OSHI collects about you, why we collect it, and what we do with it. We’ve kept it as plain as we can, because you shouldn’t need a law degree to understand what happens to your own information.
The quick version
If you only read one part of this page, read this.
- We only collect what we need to support you, nothing more.
- We will never send you marketing, and we will never sell your data. Ever.
- Sensitive health information is handled with your explicit consent, except where safeguarding law allows a professional to refer someone at serious risk without it.
- Client records are kept for 7 years from our last contact with you. Enquiries that go no further are deleted after 12 months.
- Your information is stored with a small number of trusted providers in the EU, under UK data-protection law.
- You can ask to see, correct or delete your information at any time. Just email help@oshi.org.uk.
Who we are
OSHI is a small community interest company in Hull, and we are responsible for looking after your information.
In data protection law, that makes us the “data controller”: the organisation that decides what information is collected and how it’s used. Our full details:
- Open Source Healing Initiative CIC (“OSHI”), a community interest company registered in England & Wales, company number 13935346
- Registered with the Information Commissioner’s Office (ICO), registration number ZB526479
- Public and operational address: C4DI @TheDock, 31–38 Queen Street, Hull, HU1 1UU
- Registered office: 1–4 Market Place, Hull, HU1 1RS
For any question about your data, contact us at help@oshi.org.uk or call 07507 988 481. We’re a small organisation, so we don’t have a statutory Data Protection Officer, but a real person will answer, and data questions are taken seriously.
What we collect and where it comes from
What we hold depends on how you reached us. Here are the routes, and what each one collects.
The referral form (/oshi-referral-form/). One form for everyone: you can refer yourself, or a professional, family member or friend can refer you. It collects the name and contact details of the person needing support; where someone else is referring, who the referrer is; practical details like the type of support needed and the date of the referral; and some sensitive questions we want to be upfront about: whether you are accessing mental health services, any significant mental health issues, any known history of self-harm or suicide risk, and any known history of violence or sexual offences. We ask everyone the same questions because the answers decide who makes the first call and how they prepare, and “Unknown” is always an acceptable answer. We ask so we can support you safely, not to judge you.
General contact form (/contact/). Your name, contact details and whatever you write in your message.
Phone and email. If you ring or email us, we hold what you choose to tell us, so we don’t ask you to repeat yourself.
The website itself. Like most websites, ours uses a small number of cookies; see the Cookies section below.
Why we use it, and our lawful bases
The law says we need a proper reason, a “lawful basis”, for everything we do with your information. Here are ours, with the legal names alongside a plain-English explanation of each.
| What we do | What data | Lawful basis, in plain English |
|---|---|---|
| Providing recovery support: handling referrals, enquiries and our casework with you | Your name, contact details and the details of the support you need | Legitimate interests (UK GDPR Article 6(1)(f)). We have a genuine, fair reason: providing the recovery support you need or have asked for, in a way you’d reasonably expect. |
| Acting in an emergency | Whatever is needed at the time | Vital interests (Article 6(1)(d)): protecting someone’s life when there’s no time to ask. |
| Handling health and mental-health information | Mental health, self-harm and suicide-risk information on referrals | Explicit consent (Article 9(2)(a)). Normally, the consent declaration on the referral form is your clear agreement. Where someone else made the referral, we also confirm your consent ourselves the first time we speak. Where someone is referred without their consent under a safeguarding or vital-interests duty, we rely on the safeguarding condition (Data Protection Act 2018, Schedule 1 Part 2, paragraph 18: safeguarding of children and of individuals at risk), which UK law provides for exactly these situations. |
| Handling criminal-offence information | The violence and sexual-offence history questions on the referral form | Normally consent (DPA 2018, Schedule 1, paragraph 29). For referrals made without consent, the same safeguarding condition (paragraph 18) as above. |
Two things worth spelling out. First, consent is not our legal basis for the core record of our work with you; that rests on legitimate interests; your explicit consent covers the sensitive health details specifically. Second, the safeguarding condition legally requires us to keep an Appropriate Policy Document, a written statement of how we protect this kind of data, and we maintain one.
Who we share it with
Very few people, and never for marketing. In plain terms: we do not send marketing, and we do not sell your data. Not now, not ever.
To run our service we use a small number of providers, who each handle data under strict agreements:
- HubSpot: our client record system, where referrals and client records are held. We use it purely as a client record system; no marketing is ever sent from it. We hold HubSpot’s data-processing agreement.
- Hetzner Online GmbH: hosts this website and its automatic backups, in Germany.
- Our website administrator: maintains the website under a written data-processing agreement.
- CookieYes: runs the cookie-consent banner on this site.
We may add Cloudflare (a security and performance service) in future; this notice will be updated when we do.
One honest exception: we may share information without consent with the police, social services or a court where the law requires it, or where someone is at serious risk of harm. You can read more on our safeguarding page.
Where your data lives
Your information is stored in Europe with the providers above.
HubSpot holds our records in its EU data centre, and Hetzner hosts the website in Germany — both areas whose data protection is recognised as adequate under UK law. Some of our suppliers are US-headquartered companies; where that’s the case, transfers are protected by the UK Extension to the EU–US Data Privacy Framework or the UK Addendum to standard contractual clauses, the legal safeguards UK law requires.
How long we keep it
We keep information only as long as we genuinely need it, then delete it.
| Data | How long we keep it |
|---|---|
| Client records (HubSpot) | 7 years from last contact |
| Enquiries that don’t become clients | 12 months |
| Website access logs | 6 months |
| Security logs | 30 days |
| Backups | 35 days |
If someone referred you to us
If a professional, or someone who cares about you, referred you to us, we may hold information about you before we’ve ever spoken. Here’s what that means.
What we hold is what the referrer put on the referral form: your name and contact details, and the health and risk information described above. It came from them, not from you. When the referral is made, we ask the referrer to pass you the link to this privacy notice, and the first time we speak we will tell you who we are, what we’ve been told, and what happens next. Every right listed below applies to you in full, from the moment we receive the referral.
Your rights
Your information is yours, and the law gives you real control over it. You can:
- Ask for a copy of the information we hold about you (a “subject access request”).
- Correct it if anything is wrong or out of date.
- Ask us to delete it, in many situations.
- Ask us to pause using it while something is sorted out.
- Object to our use of it where we rely on legitimate interests.
- Take it with you: receive data you gave us in a reusable format.
- Withdraw consent at any time, where consent is what we rely on. That won’t undo anything already done lawfully, but we’ll stop from that point.
To use any of these, email help@oshi.org.uk or call 07507 988 481. We’ll respond within one month, as the law requires.
If you’re unhappy with how we’ve handled your data, we’d genuinely like the chance to put it right first; see our complaints page. You also have the right to complain to the regulator at any time: the Information Commissioner’s Office, at ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Children
Our services are for adults, and this website is aimed at adults.
OSHI provides services to adults aged 18 and over. We follow child safeguarding procedures where a concern about a child arises in the course of our work. We do not knowingly collect information about anyone under 18 through this website.
Cookies
Cookies are small files a website stores on your device. We keep ours to a minimum.
We use essential cookies only, the ones the site needs to function. We do not currently use analytics or advertising cookies. HubSpot sets cookies when the referral form loads. The cookie banner, run by CookieYes, lists the current cookies and lets you make your choices at any time.
Changes to this notice
If anything here changes, we’ll update this page, so this is always the current version.
Significant changes will be flagged clearly on this page.
Last updated: 27 July 2026