Privacy Notice

Privacy Notice

This Privacy Notice explains how Gracious Ten Healthcare Ltd (“we”, “us” or “our”) collects, uses, stores and discloses personal information in connection with the provision of care and related services, recruitment, and the administration of enquiries, complaints and claims.

We are committed to protecting the privacy and confidentiality of personal information and processing it in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable legislation.

1. Who we are

Gracious Ten Healthcare Ltd is the data controller responsible for determining how and why personal information is processed.

Our contact details are:

Gracious Ten Healthcare Ltd
Unit 211, 69 Steward Street
Birmingham
England
B18 7AF

Email: [email protected]

For matters relating specifically to complaints about the use of personal information:

Email: [email protected]

If you have any questions about this Privacy Notice or how we process personal information, please contact us using the details above.

2. Information we collect and use

Provision of care and services

In connection with the provision and administration of care, healthcare services, pharmaceutical products and other goods or services, we may collect and process:

• Name, address and contact details;
• Gender;
• Date of birth;
• National Insurance number;
• Next of kin and support network information;
• Emergency contact information;
• Health information, including medical conditions, allergies, medical requirements and medical history;
• Information concerning care and support needs, including disabilities, home conditions, medication, dietary requirements and other relevant care arrangements;
• Payment information, including bank or card details where necessary to administer payments, transfers or direct debits;
• Records of meetings, decisions and care-related activities; and
• Information concerning income and financial circumstances where relevant to funding arrangements or personal budgets.

Health information constitutes special category personal data and is subject to additional legal protection.

Recruitment

In connection with recruitment and employment-related activities, we may collect and process:

• Name and contact details;
• Date of birth;
• National Insurance number;
• Passport and other identification information;
• Employment history and references;
• Education, qualifications and training records;
• Right to work information;
• Relevant information obtained from social media where lawful and necessary for recruitment purposes; and
• Information relating to criminal convictions and offences, including information obtained through DBS checks where applicable.

Enquiries, complaints and claims

When dealing with enquiries, complaints or claims, we may collect and process:

• Names and contact details;
• Customer or client records;
• Correspondence;
• Health and safety information;
• Incident investigation information; and
• Accident records and related information.

3. Purposes for which we use personal information

We may process personal information for the following purposes:

• Providing, managing and administering care and other services;
• Assessing and responding to care and support needs;
• Communicating with individuals, their representatives and relevant professionals;
• Managing payments and financial arrangements;
• Maintaining appropriate care, service and administrative records;
• Recruiting and assessing prospective employees;
• Complying with our legal, regulatory and professional obligations;
• Investigating and responding to enquiries, complaints and claims;
• Protecting the health, safety and welfare of individuals;
• Establishing, exercising or defending legal claims and rights; and
• Complying with lawful requirements or requests from competent authorities.

We will only process personal information where there is a lawful basis for doing so and will not use personal information for purposes that are incompatible with the purpose for which it was originally collected, unless permitted or required by law.

4. Lawful bases for processing personal information

Under the UK GDPR, we must have a lawful basis for processing personal information.

Depending on the nature and purpose of the processing, we may rely upon the following lawful bases:

Consent — where an individual has provided valid consent to the processing of their personal information for a specified purpose;

Contract — where processing is necessary for the performance of a contract or to take steps at the individual’s request before entering into a contract; and

Legal obligation — where processing is necessary for us to comply with a legal obligation to which we are subject.

Where another lawful basis is applicable to a particular processing activity, we will rely upon that basis where appropriate.

Special category data

Some of the information we process, including health information, constitutes special category personal data.

Where we process special category data, we will also rely upon an applicable condition under Article 9 of the UK GDPR.

Where applicable to the provision or management of health or social care, this may include Article 9(2)(h), together with the applicable requirements of the Data Protection Act 2018.

Where we process information relating to criminal convictions or offences, we will do so only where permitted by applicable data protection law and where the relevant additional requirements have been satisfied.

5. Where we obtain personal information fromWe may obtain personal information from:

• The individual concerned;
• Family members or carers;
• Schools, colleges, universities and other education organisations;
• Previous employers; and
• Other organisations or individuals involved in providing or arranging care or services, where applicable.

Where personal information is obtained from another source, we will provide the information required by applicable data protection law, subject to any relevant exemption.

6. How long we keep information

We retain personal information only for as long as is necessary for the purposes for which it is processed and in accordance with applicable legal, regulatory and professional requirements.

Our retention periods include:

Care records — retained in accordance with applicable health and social care record-keeping requirements and securely destroyed when they are no longer required.

Enquiries that do not result in the provision of care or services — retained for no longer than 12 months following the conclusion of the enquiry, unless there is a lawful reason for retaining the information for longer.

Unsuccessful job applications — retained for no longer than 6 months following the conclusion of the recruitment process, unless there is a lawful reason for retaining the information for longer.

Financial records — retained for the periods required by HMRC and other applicable financial or legal requirements.

Where different retention periods apply to particular categories of information, we will retain the information in accordance with the applicable statutory, regulatory or professional requirements.

Personal information will be securely deleted, destroyed or otherwise disposed of when it is no longer required.

7. Who we share personal information with

Where necessary and lawful, we may disclose personal information to:

• Local authorities and councils;
• Organisations where disclosure is required or authorised by law;
• Relevant organisations and professionals involved in providing or arranging care and support; and
• Service providers that process personal information on our behalf.

We will only disclose personal information where there is a lawful basis or other lawful authority for doing so and will take appropriate steps to ensure that only information relevant and necessary for the particular purpose is disclosed.

8. Confidentiality

We recognise our legal and professional obligations concerning the confidentiality of personal and health information.

Personal information will only be accessed, used or disclosed where there is a lawful and legitimate reason to do so.

Information may be disclosed where:

• The individual has provided appropriate consent;
• Disclosure is necessary for the provision or coordination of care;
• We are legally required or authorised to disclose the information;
• Disclosure is necessary to protect an individual’s vital interests; or
• There is a sufficient public interest justification for disclosure.

We maintain appropriate measures to protect confidential information against unauthorised access, use or disclosure.

9. Transfers of personal information outside the UK

Where personal information is transferred to, or otherwise processed in, a country outside the United Kingdom, we will ensure that the transfer complies with the requirements of UK data protection law.

Where required, we will implement an appropriate transfer mechanism and safeguards before personal information is transferred internationally.

Cloudflare, Inc.

We use Cloudflare, Inc. to provide website infrastructure and security services, including DNS and firewall/security services.

Organisation: Cloudflare, Inc.
Category of recipient: Web infrastructure and security provider
Country: United States
Transfer mechanism: Applicable UK GDPR international transfer mechanism and safeguards.

10. Your data protection rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of personal information in certain circumstances;
• Request restriction of processing in certain circumstances;
• Object to certain processing of your personal information;
• Request the transfer of certain personal information to you or another organisation; and
• Withdraw consent where we rely upon consent as the lawful basis for processing.

The availability of these rights depends upon the circumstances and applicable legal requirements, and certain exemptions may apply.

Requests concerning your data protection rights should be made using the contact details set out in section 1.

We will respond to valid requests without undue delay and, where required by the UK GDPR, within one month of receiving the request.

11. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects concerning individuals.

12. Complaints

If you have concerns about how we have collected, used or otherwise processed your personal information, please contact us in the first instance:

Email: [email protected]

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/

13. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time to reflect changes to our processing activities, applicable legislation, regulatory requirements or our services.

The most recent version of this Privacy Notice will be made available on our website.