Participation in this programme is entirely voluntary. You may withdraw at any time without giving a reason. Withdrawing will not affect your benefit entitlements or any other services you receive, though your adviser will inform the referral source that you have chosen to leave the programme.

Crystal Pathways will work with you at your own pace to identify barriers, develop goals, and provide practical support. The pace and nature of support will always be agreed with you.

What data we hold: Your personal details, contact information, assessment and support records, session notes, action plans, and programme outcome data will be held securely on CP Hub, our Salesforce-based case management system.

Legal basis: Your data is processed under UK GDPR Article 6(1)(b) (contract) and Article 6(1)(e) (public task where applicable). Special category data (such as health or disability information) is processed under Article 9(2)(b) or 9(2)(h) as appropriate. Crystal Pathways is registered with the Information Commissioner's Office (ICO).

How long we keep it: Your data is retained for the period required by the programme contract and applicable law, typically seven years after programme completion. You will be notified before any data is deleted.

Your rights: You have the right to access your data, correct inaccuracies, request deletion, restrict processing, and port your data to another provider. To exercise any of these rights, contact Crystal Pathways at any time. Full details are set out in our Privacy Notice, a copy of which is available on request or at crystalpathways.co.uk.

If you agree, Crystal Pathways may contact you after your programme ends to let you know about relevant opportunities such as peer mentor roles, community events, employer taster days, or other support activities that may benefit you.

You can withdraw this consent at any time by contacting us directly or clicking unsubscribe on any communication we send.

As a commissioned provider, Crystal Pathways is contractually required to share participant data with the funder, commissioner, or prime contractor for this programme. Depending on the provision type this may include DWP, a local authority, an NHS body, or a prime contractor acting on their behalf.

What is shared: Referral and start dates, engagement and attendance records, progress against agreed goals, milestone and outcome data (such as employment starts, qualifications gained, or health improvement scores). Sensitive personal or clinical information is not shared without separate specific consent.

How it is shared: Data is submitted securely through CP Hub or approved reporting systems in line with the programme's data sharing agreement and UK GDPR. All third parties are required to handle your data in accordance with the law.

Examples of when this applies: Sharing a support summary with your GP where health concerns arise; liaising with an employer about reasonable adjustments; referring you to a training provider; providing context to a housing officer or social care team supporting you.

Our commitment: We will always discuss with you what information we intend to share and with whom before doing so, unless there is an immediate risk to your safety or the safety of others (see the Disclosure section below). You can withdraw or limit this consent for specific individuals or organisations at any time.

Note: Even if you decline this consent, we may still be legally required to share information in certain circumstances. These are explained in full in the Disclosure section.

With your permission, anonymised and de-identified information may be used to evaluate this programme, produce reports for commissioners, and contribute to wider research into effective support. No personally identifiable information is ever shared for these purposes — your identity cannot be traced from any research output.

This is entirely optional. Declining will have no impact whatsoever on the support you receive.

Safeguarding: If Crystal Pathways becomes aware of a risk of serious harm to you or to another person — including a child or vulnerable adult — we have a legal and ethical duty to take action. This may include contacting emergency services, your GP, or a local authority safeguarding team without giving prior notice. We will always tell you afterwards what we have done and why, unless doing so would put someone at further risk.

Legal requirements: Crystal Pathways may be required to disclose information in response to a court order, police warrant, or other lawful authority. In these circumstances we are legally compelled to comply and are not able to seek your consent first. We will tell you that a disclosure has been made unless legally prevented from doing so.

Serious crime: Where information shared with us indicates a serious crime has been committed or is likely to be committed, we may be required to disclose this to the appropriate authorities.

Public health: In exceptional circumstances, such as a notifiable disease, we may be required to share information with public health authorities.

What this does not mean: We will not share information with your employer, family members, or other organisations simply because they ask. These disclosures apply only to legally or ethically defined situations. In all other circumstances, we will ask you first.

Why we use it: Writing detailed notes during a session splits an adviser's attention and can make conversations feel less natural. AI-assisted note-taking allows your adviser to stay fully present and focused on you, while still maintaining an accurate record of your session.

How it works: The tool listens to our conversation and generates a structured summary for your adviser to review. Your adviser reads, edits, and approves every note before it is saved to your record. Nothing is saved automatically without human review.

Your data is safe: The audio of your session is processed only to generate the note and is then deleted — it is not stored, replayed, or reviewed by anyone. Your data is never used to train AI models, never sold, and never shared with any third party for technology purposes. All processing is carried out under a Data Processing Agreement that meets UK GDPR standards.

This is your choice: If you prefer your adviser to take notes manually, please decline. This will have absolutely no impact on the quality or nature of your support.

Recordings are accessed only by Crystal Pathways management and supervisory staff for the purpose of ensuring quality of support and supporting staff development. They are never shared externally and are stored securely in line with UK GDPR.

Recordings are retained for 12 months and then securely deleted. You may withdraw this consent at any time by telling your adviser or contacting Crystal Pathways directly.

How to raise a concern: If you are unhappy with any aspect of the support you receive, you have the right to raise a formal complaint. You can do this by:

• Speaking directly to your adviser or their manager
• Emailing Crystal Pathways at complaints@crystalpathways.co.uk
• Asking for a copy of our full Complaints Policy, which is available on request

All complaints are acknowledged within two working days and investigated in accordance with our Complaints Policy. You also have the right to escalate any unresolved complaint to the relevant programme commissioner or, where applicable, to the Parliamentary and Health Service Ombudsman or Local Government and Social Care Ombudsman.

Raising a complaint will never negatively affect the support you receive.

ICO registration: Crystal Pathways Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is available on request and on the ICO's public register at ico.org.uk.

Your rights under UK GDPR include:
• The right to access the personal data we hold about you (Subject Access Request)
• The right to correct inaccurate information
• The right to erasure (deletion) in certain circumstances
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time without penalty

To exercise any of these rights, contact Crystal Pathways at data@crystalpathways.co.uk or speak to your adviser. If you are unsatisfied with how your data is handled, you have the right to complain directly to the ICO at ico.org.uk.