Skip to content
TBYM UK

MHSS REFER

Referral Portal · TBYM

connecting people to support.

Sign in Register your organisation
About MHSS Refer · Security & privacy
refer.tbym.uk
TBYM UK

MHSS REFER

Referral Portal · TBYM

Sign in

Enter your Organisation ID and work email. We'll send you a one-time code — there's no password.

Enter your code

A 6-digit code has been sent to your email. It expires in 10 minutes.

New to MHSS Refer? Register your organisation

About · Security · Agreements · Help

TBYM UK

MHSS REFER

Register your organisation

  1. 1Organisation
  3. 2Agreements
  5. 3Complete

Not sure yet? Read about MHSS Refer first. Registration is free.

Primary contact. This person becomes the organisation's first Administrator and receives the Organisation ID by email.

← Sign in

Service Agreement

Loading…

Data Sharing Agreement

Loading…

✓

Registration complete

Your organisation is registered. Your Organisation ID is:

—

We've emailed it to you with a record of the agreements. You and your team will need it to sign in.

MHSS REFER
Sign in Register

About MHSS Refer

 

Loading…
Register your organisation Sign in

Ready to register?

It takes about five minutes and it's free. You'll get your Organisation ID straight away.

Register your organisation How we keep data safe

Questions? refer-mhss@tbymuk.org · 020 4634 2751

MHSS Refer · Take Back Your Mind UK · Security & privacy
MHSS REFER

Agreements

The agreements behind MHSS Refer

Every organisation that uses MHSS Refer agrees to these two agreements with Take Back Your Mind UK. When they change, every user and organisation contact is emailed what has changed.

Loading…
MHSS Refer · Take Back Your Mind UK · Security & privacy
MHSS REFER
Sign in

Security & privacy

How MHSS Refer protects the people you refer

When you refer someone, you're trusting us with personal details about a person who may be going through a difficult time. This page explains, plainly, how MHSS Refer is built to protect that information — and what we ask of you.

A one-way system

MHSS Refer is deliberately closed and one-way. Once a referral is submitted, nobody at your organisation — including the person who submitted it — can view, search, download or change it. The portal only ever shows you counts.

That means a lost laptop, a shared login or a compromised account at a referring organisation cannot be used to read back the people that organisation has referred. The confirmation email you receive names the person by first name and initial only.

Signing in

  • No passwords. Each sign-in needs your Organisation ID, your work email and a fresh 6-digit code sent to that inbox. Codes expire after 10 minutes and work once.
  • Brute-force protection. A code is cancelled after 5 wrong attempts, and code requests and guesses are limited per account and per connection.
  • No account fishing. The sign-in screen gives the same answer whether or not an email is registered, so it can't be used to discover who uses MHSS Refer.
  • Short sessions. You're signed out after an hour of inactivity and after 8 hours regardless. Removing a user, or de-registering an organisation, ends their access on their very next click.
  • Session cookie only. Your session is held in a single cookie marked Secure, HttpOnly and SameSite=Strict: it travels only over HTTPS, only to this site, and can't be read by any script on the page.

In transit and in the browser

  • HTTPS everywhere, enforced with HTTP Strict Transport Security, so browsers refuse to connect without encryption.
  • A strict Content Security Policy. The site runs only its own code: no third-party scripts, trackers, analytics, adverts, fonts or embeds, and it can't be framed by another site.
  • Request checks. Every request is checked to have come from this site's own page, and requests from anywhere else are refused before they reach our systems.
  • No cookies beyond sign-in. The only cookie is the strictly necessary session cookie, removed when you sign out.

Where referrals go

  • Referrals are stored in TBYM's secure case-management records, which only authorised TBYM staff and volunteers can access, and handled under UK GDPR and the Data Protection Act 2018.
  • The back end only accepts requests that come through this site and carry a secret key, so it can't be called directly.
  • Everything you type is validated and length-limited, and stored as plain text so it can never run as a formula or code.
  • Our notification emails are sent over the verified tbymuk.org domain.

Accountability

Security events — sign-ins, codes sent and locked, users added, changed or removed, organisation changes, registrations and de-registrations — are recorded in an audit log with the time, the account and the connection they came from. The log records that a referral was made and by whom, never who it was for.

Your organisation's contact address is emailed whenever its details change, and both the old and new addresses are told when the contact email changes.

What we ask of you

  • Only refer someone with their informed consent, and tell them their details are being shared with TBYM.
  • Give access only to people at your organisation who need it, and remove people promptly when they leave.
  • Never forward sign-in codes. TBYM will never ask you for one.
  • Sign out on shared computers.
  • Tell us straight away if you think something has gone wrong.

Report a concern

If you think an account has been misused, a referral was sent in error, or you've found a security problem, contact us at refer-mhss@tbymuk.org or call 020 4634 2751. Security researchers: see security.txt.

MHSS Refer · Take Back Your Mind UK · About
MHSS REFER
Dashboard New referral Users Organisation

Support

Email us 020 4634 2751 Live chat

MHSS Refer

About Security & privacy Agreements

Dashboard

Your organisation's referral activity.

–
Total referrals
–
This month
–
In progress
–
Completed

Referrals by month

Status breakdown

    Counts only. For the privacy of the people you refer, referral details can't be viewed once submitted.

    Quick actions

    +New referral 👥Manage users 💬Live chat 📞Phone us

    New referral

    Refer someone to Take Back Your Mind UK's Mental Health Support Service.

    1Service user

    We use it to send contact instructions if we can't reach them by phone.

    2How they'd like to be contacted
    3Anything else we should know (optional)

    0 / 5000

    4Consent

    I confirm that I have received consent from the service user to share their personal information with Take Back Your Mind UK for the purpose of providing mental health support services.

    Cancel
    ✓

    Referral submitted

    Thank you. It's with our team now, and we'll be in touch with them soon. We've emailed you a receipt.

    Back to dashboard

    Users

    Everyone who can sign in for your organisation. Remove people as soon as they no longer need access.

    Add a user

    Referrers submit referrals. Managers can also manage users. Administrators can also edit the organisation's details and de-register it. New users are emailed how to sign in.

    NameEmailRoleAddedStatusActions
    Loading users…

    Organisation

    Your organisation's details and account.

    Details

    We email the organisation's contact address whenever these details change.

    Account

    Organisation ID
    Your role

    Agreements

      Read the current agreements

      De-register organisation

      De-registering immediately removes access for every user and ends your Service Agreement and Data Sharing Agreement with TBYM. It can't be undone. People you've already referred will continue to be supported.

      Working on it…