When the Home processes your personal data we comply with the Data Protection Act 1998 (“DPA”) the General Data Protection Regulation 2016 (“GDPR”).
Your personal data includes all the information we hold that identifies you or is about you, such as your name, email address, postal address, date of birth, location data, and opinions we document about you. It also includes special categories of data like medical and health records, care plans, and information about your religious beliefs, ethnic origin, race, sexual orientation, and political views.
Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring, and deleting it. We ensure that your information is properly protected and used appropriately.
This privacy notice provides information about the personal data we process, why we process it, and how we process it.
Our responsibilities
The Home is the data controller of the personal data you provide. We are responsible for ensuring compliance with the Data Protection Legislation and handling any requests from individuals exercising their rights under this legislation.
Why do we process your personal data?
We process your personal data to provide you with the services you have requested, fulfill our contractual obligations, respond to your queries or comments, and correspond with you on a daily basis.
We may need personal data from you to meet our legal obligations, enter into a contract with you, or provide you with necessary information. Without this data, we may be unable to fulfill our obligations to you.
We process most of your information based on your consent, our legitimate interests, performance of a contract, protection of vital interests, or, in the case of special categories of data, for the provision of health or social care.
If we obtain consent from you to process your personal data, you can withdraw your consent at any time. This will not affect the lawfulness of any processing we carried out prior to you withdrawing your consent.
Who will receive your personal data?
We only transfer your personal data when necessary. Recipients of your personal data include:
- Healthcare organisations
- Government agencies
- Company auditors
- IT software companies
We don’t transfer your personal data outside of the EEA.
How long will we keep your personal data?
We retain your personal data for seven years after you leave the Home.
This retention period allows us to address any issues or queries that may arise. Your information is securely stored and permanently deleted or destroyed after this period.
If we need your consent to process your personal data, any information we use for this purpose is kept until you withdraw your consent, unless we are entitled to retain the personal data on other legal grounds.
What are your rights?
You have several rights regarding the personal data we hold about you. These rights depend on the grounds on which we process your data. More information is available from the Information Commissioner’s Office website. These rights apply for the period during which we process your data.
1. Access to your data
You have the right to ask us to confirm that we process your personal data, as well as request access to or copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this privacy notice.
We will provide the information free of charge unless your request is manifestly unfounded or excessive or repetitive, in which case we are entitled to charge a reasonable fee. We may also charge you for multiple copies of the same information.
We will provide the information within one month of receiving your request. If we need more information to comply with your request, we will let you know.
2. Rectification of your data
If you believe the personal data we hold about you is inaccurate or incomplete, you can ask us to rectify it. We will comply within one month unless we have reasons not to, in which case we will inform you.
3. Right to be forgotten
In certain circumstances, you have the right to ask us to delete your personal data. This applies if:
- We no longer need your personal data for the purpose it was collected.
- You withdraw consent where data processing was based on consent.
- You object to the processing, and there are no overriding legitimate interests.
- We have unlawfully processed your personal data.
- Deletion is necessary to comply with a legal obligation.
There are scenarios where we may refuse your request, and we will inform you if this is the case.
4. Right to restrict processing
In some circumstances, you can ask us to suppress processing of your personal data. This means we will stop actively processing it but retain it. This right is available if:
- You believe the data is inaccurate, and we need to verify its accuracy.
- You object to us processing the data, and we are considering whether our legitimate interests override your objection.
- The processing is unlawful, and you request restriction instead of deletion.
- We no longer need the data, but you need it to establish, exercise, or defend a legal claim.
5. Data portability
You have the right to ask us to provide your personal data in a structured, commonly used, and machine-readable format so that you can transmit it to another data controller. This right applies where:
- Processing is based on your consent or performance of a contract.
- Processing is carried out by automated means.
6. Right To object
You can object to us processing your personal data if:
- Processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority.
- For direct marketing purposes (including profiling).
- For scientific or historical research and statistics.
You must have grounds for your objection based on your particular situation. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or if the processing is for the establishment, exercise, or defense of legal claims.
Automated decision making
Automated decision-making means making a decision solely by automated means without any human involvement. Examples include online credit reference checks and automated clocking-in systems.
We do not carry out any automated decision making using your personal data.
Your right to complain about our processing
If you believe we have processed your personal data unlawfully or have not complied with GDPR, you can report your concerns to the supervisory authority in your jurisdiction. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO).
You can contact the ICO on 0303 123 1113 or via their website.
Any questions?
If you have any questions or would like more information about how we process your data, please email gdpr@canfordhealthcare.co.uk.
—
Note: All QCS Policies are reviewed annually, more frequently, or as necessary.
Amended: 02/07/2024 GDPRF06