Collect less
Ask only for information needed to provide support, operate safely, respond to enquiries or produce approved anonymised insight.
Privacy policy
Your information.
Treated with care.
Support Never Stops is being designed to provide useful, non-judgemental harm-reduction support while collecting as little personal information as reasonably possible. This notice explains the intended approach to privacy across our website and platform.
Privacy by designProtected at every stage
1
Only what is neededPurpose-led collection and clear choices
2
Controlled accessAppropriate technical and organisational safeguards
3
Transparent useClear explanations of processing and sharing
No advertising profilesNo sale of personal data
Draft for formal approval
This page must be finalised before the live service launches.
The legal entity, controller roles, lawful bases, special-category conditions, processor list, international-transfer safeguards and retention periods must be confirmed through the final DPIA, contracts and information-governance review.
Privacy, in straightforward terms.
People may use Support Never Stops at a sensitive or difficult moment. Our approach is therefore built around necessity, transparency, security and respect—not gathering information simply because technology makes it possible.
Explain clearly
Use plain language and provide timely information when someone is asked to share data or choose a referral.
Protect carefully
Apply appropriate access controls, encryption, monitoring, supplier assurance and incident-management arrangements.
Respect choice
Make optional uses clear, support applicable rights and avoid using personal data for advertising or commercial profiling.
Who is responsible?
The answer may depend on how Support Never Stops is provided locally.
For this website and direct enquiries, the data controller is intended to be the legal organisation operating Support Never Stops. Its full legal name, registration details and postal address must be inserted here before publication.
@
Privacy enquiriesinfo@supportneverstops.co.uk
Website and direct enquiries
Support Never Stops will normally decide why and how contact details, website logs and demonstration requests are used.
Commissioned local deployments
A commissioner or provider may be controller, joint controller or instruct Support Never Stops as processor. The local notice and contract will explain the arrangement.
Platform conversations
Just-in-time information should appear before sensitive details are entered, including any local variation in how information is used.
Information we may collect
Different parts of the service need different information.
Not every category applies to every user. Where possible, the service should allow people to receive useful guidance without providing their name or direct contact details.
Website
Technical and usage information
IP address, device and browser information, security logs, page interactions and necessary cookie or session data.
Enquiries
Contact and professional details
Name, email address, organisation, role and anything included in a demonstration, partnership or support enquiry.
Conversations
Information a user chooses to share
Free text about drugs, routes of use, concerns, circumstances, risk indicators, support needs and referral preferences.
Insight
Demographic and service data
Where approved: age band, gender, broad postcode area, substances, routes, referral offered and referral accepted or declined.
Some information may be special-category health data.
Information about drug use, physical or mental health, treatment, overdose risk or support needs may reveal health information. The final service must identify and document both an Article 6 lawful basis and an appropriate additional condition for special-category processing before it begins.
How and why information is used
Every use should have a defined purpose and lawful basis.
The entries below describe the intended processing model. The final legal bases must be approved and matched to the operating and commissioning arrangements.
Purpose
Information involved
Proposed legal basis to confirm
Provide harm-reduction guidanceUnderstand the question, tailor information and identify urgent safety prompts.
Conversation content, selected user route and relevant contextual details.
Controller-specific Article 6 basis plus an Article 9 condition where health data is processed.
Offer local support and referralsShow appropriate services and, only where chosen and supported, pass referral information.
Location or broad postcode, referral choice, contact details and relevant referral information.
Consent, public task, health or social care, legitimate interests or another approved basis depending on the pathway.
Operate and protect the serviceMaintain availability, prevent misuse, investigate incidents and improve reliability.
Technical logs, security events, device information and limited service-use data.
Legitimate interests and/or legal obligations, subject to documented balancing and necessity.
Respond to enquiriesArrange demonstrations and answer professional, partnership or privacy questions.
Name, email, organisation, role and message content.
Steps requested before a contract, contract, legitimate interests or consent where appropriate.
Produce service insightCreate approved aggregate reporting for commissioners and providers.
Minimised, anonymised or appropriately pseudonymised usage, demographic and pathway data.
The approved basis in the commissioning arrangement; outputs should not identify individual users.
AI and conversation processing
Support Never Stops uses AI to generate and organise guidance—not to make clinical diagnoses.
Conversation information may be processed by the approved technology providers needed to operate the platform. Supplier contracts, data residency, access controls, logging, model settings and any use of data for evaluation or improvement must be documented and explained before launch.
- Users should be told clearly when they are interacting with AI.
- Safety rules and human governance should constrain how the system responds.
- The platform should not make solely automated decisions with legal or similarly significant effects.
- Personal conversation data must not be used for unrelated advertising or commercial profiling.
Sharing and processors
Information should only be shared for a defined and approved reason.
We do not intend to sell personal data. We may need to use carefully selected processors or share information with a service where the user requests a referral. Final recipients and suppliers must be listed accurately before publication.
Hosting and platform suppliers
Approved cloud, security, communications and technical-support providers acting under contract and access restrictions.
Local services
Contact or referral information where the person has chosen that pathway and the disclosure is supported by the agreed legal and operational process.
Commissioners and providers
Aggregate or appropriately anonymised reporting intended to show demand, needs, pathways and outcomes without identifying individuals.
Legal or urgent circumstances
Information may be disclosed where required by law or where a valid and documented basis supports action to protect someone from serious harm.
Retention and deletion
Specific retention periods must be agreed before live processing begins.
Retention should be based on purpose, legal duties, clinical-safety requirements, safeguarding, audit needs, contractual arrangements and the sensitivity of the information. Identifiable information should be deleted or irreversibly anonymised when it is no longer required.
Your data-protection rights
Your rights depend partly on the processing and legal basis.
You may have rights to ask for access, correction, deletion, restriction, portability or to object. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.
Be informed
Know what information is collected, why it is used and who receives it.
Access
Request a copy of personal information held about you, subject to applicable exemptions.
Correction
Ask for inaccurate or incomplete personal information to be corrected.
Deletion
Ask for information to be erased where the legal conditions for erasure apply.
Restriction
Ask for use of information to be limited in certain circumstances.
Object
Object to certain processing, including processing based on legitimate interests.
Portability
Receive certain information in a reusable format where the right applies.
Human review
Seek safeguards around solely automated decisions that have legal or similarly significant effects.
To exercise a right or ask a privacy question
Email info@supportneverstops.co.uk. Before launch, this must be supplemented with the confirmed controller’s full contact details and, where applicable, the DPO contact.
International transfers
The final notice must identify whether any supplier accesses or stores personal information outside the UK, the destination and the lawful safeguards used.
Cookies and analytics
Necessary technologies may support security and core functions. Any optional analytics or similar technologies should be explained and, where required, activated only after a valid choice.
Children and young people
Age scope, safeguarding, accessibility and any consent or parental-responsibility requirements must be defined before the service is promoted to children or young people.
Changes to this notice
This page should show an effective date and version. Material changes must be communicated before new processing begins where required.
Questions or concerns
Please contact us first so we can try to resolve the issue.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. The final live notice should include current ICO contact and complaint-route details.
Document statusPrototype privacy notice—requires legal and information-governance approval
VersionDraft 0.1
Effective dateTo be confirmed
Review dateBefore service launch