Data Protection Privacy Notice

NWCare Privacy Notice

NWCare is a domiciliary care agency is a regulated service and understands the importance of protecting personal and confidential information and must meet its legal duties. NWCare is 'Data Controller' and a Data Processor as defined in the UK General Data Protection Regulations (UK GDPR) and Data Protection Act 2018 (DPA). This means that if NWCare collects and use personal and sensitive data about individuals it must comply with the requirements set out in the UK GDPR and DPA. Where NWCare is providing domiciliary care on behalf of other organisations, such as HSC Trusts, When NWCare is a "Data Processor", and must follow the procedures and standards as laid down by the Data Controller organisation.

Key legislation includes:

• UK General Data Protection Regulations (UK GDPR)
• UK Data Protection Act (2018)
• Access to Health Records (Northern Ireland) Order 1993 (AHR)
• Freedom of Information Act (2000) (FOI)
• Environmental Information Regulations (2004) (EIR)
• The Human Rights Act 1998 (HRA),
• Relevant health service legislation, and the
• Common law duty of confidentiality

This Privacy Notice is for people whose personal data that NWCare hold and use, applies to all personal data held by third parties on behalf of NWCare and sets out the company approach to the protection of personal information and data. This policy also serves as a 'Privacy Notice' under the UK GDPR.

This Privacy Notice tells you what NWCare will do with your personal information when you contact us or use our services. Given the complexity of NWCare, the requirements of the legislation and our desire to ensure full compliance with the legislation, this Privacy Notice is lengthy. The contents are as follows:

We'll tell you:

• why we are able to process your information
• what purpose we are processing it for
• whether you have to provide it to us
• how long we store it for
• whether there are other recipients of your personal information
• we do not transfer your information to another country
• We do not automated decision-making or profiling

Data Protection Officer

Our Data Protection Officer can be contacted at dataprotectionofficer@nwcare.co.uk

OR via our postal address NWCare, 67-69 Main Street, Ballykelly BT49 9HS - please mark the envelope 'Data Protection Officer'

How do we get information?

Information you provide to us is recorded in your personal file and also on our computer systems. This can include information you provide in person, on an official form (either online or in paper form) or by telephone. Telephones calls are recorded for training and compliance purposes and retained for 90 days.

Most of the personal information we process is provided to us directly by you or by our social care partners, such as:

• You have been referred to our services by an NSC organisation ie. HSC Trusts
• Your information has been passed to us by our partners, such as information from people who care for you, including health professionals and relatives
• You have requested us to care for you
• You have applied for a job with us including references from employers
• You are representing your organisation
• The staff caring for you keep records about your health and any care you receive to ensure that you are provided with the best possible treatment
• The above list is not exhaustive

How your personal information is used. What we do.

Your records are used to direct, manage and deliver the care you receive to ensure that:

• The care professionals involved in your care have accurate and up to date information to and follow on the most appropriate plan for you as instructed
• Helping to review the care given to you to ensure it is of the highest standard. This is done through internal audits, Service User/carer feedback evaluations or external inspections of our services
• Training and educating staff or for audit purposes
• Your concerns can be thoroughly investigated if a complaint is raised
• Appropriate information is available if you require additional support

Who information will be shared with

To help us provide the best care or service for you, we may need to share your information with authorised individuals directly involved in your health and/or social care. We only ever do this if it is needed in your best interests. Your relatives, friends and carers may be given information about you, but only if you agree, or in circumstances where it is necessary to ensure your health and wellbeing or where there are safeguarding concerns.

Personal information is used in the recruitment and selection process, and we may be obliged during employment to share personal information to third party solicitors or courts in the management of legal issues.

Some basic information is shared with us by suppliers and customers. This is largely restricted to contact information and will be used solely as part of delivery and management of contracts and business operations.

How your information helps us improve services

Your information may also be used to help us improve services by:

• Reviewing the care we provide to ensure it is of the highest standard and quality
• Ensuring our services can meet Service User current and future needs
• Investigating Service User queries, complaints and legal claims
• We seek your feedback at regular intervals to ensure the service is implemented in accordance with our contractual obligations

We are a regulated activity therefore it is a legislative requirement to received feedback regarding the service that you receive. Please inform us if you do not wish to participate in service feedback.

Children's Information

We process children's personal data in accordance with legislation and only if they are in receipt of NWCare service.

How long we keep it

Data is kept according to our retention guidelines, which are largely set by statute. We retain information for as long as necessary within our legal guidance. It is in review with the Department of Health (DOH) Good Management, Goods Records(GMGR) and Domiciliary Care Minimum standards Legislation 2021. Retention guidelines are available from the Data Protection Officer.

What are your rights?

Your rights depend on the nature of the data that is held.

Individuals have certain rights under UK GDPR, namely:

• The right to obtain confirmation that their personal data is being processed, and access to personal data
• The right to have personal data rectified if it is inaccurate or incomplete
• The right to have personal data erased and to prevent processing, in specific circumstances
• The right to 'block' or suppress processing of personal data, in specific circumstances
• The right to portability, in specific circumstances
• The right to object to the processing, in specific circumstances
• Rights in relation to automated decision-making and profiling

Detailed guidance on individual rights is available from the Information Commissioner's Office, see: ico.org.uk/for-the-public.

Further details are listed below.

How you can access your data Subject Access Request (SAR)

GDPR gives individuals the right to access information that the Social Care Council holds about them by submitting a Subject Access Request (SAR).

You can submit a request for the data that we hold on you; this is known as a Subject Access Request (SAR). This request can be completed in writing, by email, or verbally. You do not have to make any mention of legislation, or use specific wording, although we may ask you for clarification. The request can be made to any member of staff, who will send the details to the Data Protection Officer, who will coordinate the response. Alternatively, you can contact the Data Protection Officer directly at via dataprotectionofficer@nwcare.co.uk. We will need to confirm your identification in the first instance.

You can also ask a third party (eg a relative, friend or solicitor) to make a Subject Access Request (SAR) on your behalf. NWCare must be satisfied that the third party making the request is entitled to act on your behalf, and it will be your and the third party's responsibility to provide evidence of their authority.

We have to supply the data within one month and, in most circumstances, we cannot charge a fee for this service. If the request is complex, or if we receive a number of requests, we can extend the time limit by a further two months.

The data will be supplied to you in an accessible, concise and intelligible format, usually using the same means by which the request was made; thus if the request has been made by email, the response will be sent by email.

We can refuse to provide the information if an exemption or restriction applies, or if your request is manifestly unfounded or excessive. Each Case will be reviewed on and individual basis by NWCare Data Protection Officer.

Keeping information up to date

NWCare want to make sure that personal information is accurate and up to date. If someone thinks any information is inaccurate and/or incorrect then please contact NWCare and let us know.

Sharing Information and Security of information

NWCare is committed to taking all reasonable measures to ensure the security of all personal information it holds.

The following arrangements are in place:

• All NWCare staff have contractual obligations of confidentiality, enforceable through disciplinary procedures
• Everyone working for the NWCare is subject to the common law duty of confidentiality.
• Staff are granted access to personal information on a need-to-know basis only and our systems and processes permissions reflect that
• NWCare has an independent Data Protection advisor who provides full authoritative advice and recommendations in the field of data protection all Registered Managers are Data Protection Guardian(PDG) who is responsible for ensuring confidentiality and security of information within their branch
• All staff are required to complete information governance, data protection, management of records and confidentiality training every year. The training provided ensures that staff are aware of their information governance responsibilities and follow best practice guidelines to ensure the necessary safeguards and appropriate use of personal information
• A range of policies and procedures are in place

Under the DHSSPS Domiciliary Care Agencies Minimum Standards August 2021 and the Data Protection Act 2018, all our staff are also required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. Equally anyone who receives information from us also has a legal duty to keep it confidential. Any information we share is processed under secure conditions, your personal data is protected, and we ensure that any NHS or care organisation that we share your details with must manage your data in accordance with legislation.

We will share information with the following main partner organisations:

• NHS Trusts
• Other NHS bodies such as ambulance services
• Police (if a crime has been committed) or if we are concerned about your safety.
• Required by a court order
• Necessary to detect or prevent crime, including allegations or suspicions of fraud
• Necessary to protect the public from serious harm, e.g. the protection of vulnerable adults or Children.
• Required for monitoring e.g. by the Public Health Agency (PHA) or Department of Health-pandemic management
• Necessary for the provision of services and information may be shared with other health providers contracted/sub contracted to provide care behalf, such as the independent sector partners
• Necessary to share with other organisations where information is shared as part of a statutory/lawful process.

We will not disclose your information to any other third parties without your permission unless there are exceptional circumstances, such as when the health and safety of others is at risk or where the law requires it.

Sharing Confidential Information Without Consent

It may sometimes be necessary to share confidential information without consent or where the individual has explicitly refused consent. There must be a legal basis for doing so (e.g. to safeguard a child) or a court order must be in place.

In deciding on any disclosure certain considerations and steps need to be taken:

• Discuss the request with the appropriate personnel.
• Disclose only that information which is necessary or prescribed by law.
• Ensure recipient is aware that they owe a duty of confidentiality to the information.
• Document and justify the decision to release the information.
• Take advice in relation to any concerns you may have about risks of significant harm if information is not disclosed.

Requests may be received by other agencies which are related to law enforcement such as:

• The Police or another enforcement agency where the appropriate section 29 request form (in line with the Access to Records Procedure) needs to be submitted from the law enforcement agency in order to consider the request.
• Local and or National Counter Fraud specialists in relation to any actual or suspected fraudulent activity.

NWCare will also take into account all legal and legislative guidance if there is a clear legal basis to share. In some circumstances we are legally obliged to share information. In any scenario, NWCare must meet the criteria that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information. The organisation will ensure that information sharing takes place within a structured and documented process and in line with the Information Commissioner's Code of Conduct and in accordance with the Health and Personal Social service (NI) Order 1972 Children's Order(NI)1995 Department of Health and Social Care Act(NI) 2022, Health and Social Care Reform Act (NI)2009 and Human Rights Act 1998

Data Processors

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

North West Care and Support Ltd utilise the services of 'Mail Chimp' and 'Survey Monkey' to communicate and gather professional information from professional stakeholders/stakeholder agencies, clients, client family members, internal staff and other job applicants who have adopted into communicating and receiving information (in acceptable formats and with professional discretion) North West Care and Support Ltd/North West Care/NWCare. This can be in the format of Newsletters, surveys, questionnaires, feedback forms, ezines, digital postcards and emails.

We will not share your information with any third parties for the purposes of direct marketing.

Disclosure of information

You have the right to restrict how and with whom we share the personal information in your records. This must be noted explicitly within your records so all healthcare professionals and staff treating you are aware of your decision.

By choosing this option, unfortunately it may make the provision of treatment or care more difficult or unavailable. You can also change your mind at any time about a disclosure decision.

THE LEGAL BIT

Your Data Protection Rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.

Your right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests. You can read more about this right here.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

How do I see my information

If you want to see the information, we hold about you or ask about how we use it, you can speak to the person in charge of your care or you can request a copy of your information.

Lawful Basis

The General Data Protection Regulations (GDPR) sets out conditions for lawful processing of personal data (Article 6) and further conditions for processing special categories of personal data (Article 9). These are similar to the conditions in Schedules 2 and 3 of the Data Protection Act 1998 (DPA98) with sensitive personal data now called 'special categories' of personal data. As personal data concerning health is one of the special categories, organisations that process such data must be able to demonstrate that they have met a condition in both Article 6 and Article 9 of the GDPR.

Provision of Healthcare

The conditions that ensure the NWCare processes your personal information lawfully, fairly and in a transparent manner are set out in Article 6 and Article 9 of the UK General Data Protection Regulation. These conditions include, for example, complying with our legal obligations, to meet the vital interests of service users, for public health purposes and to fulfil our duty to provide health and social care services and manage our systems.

The lawful basis for processing special category health data for direct care is that processing is: 'necessary… in the exercise of official authority vested in the controller' (Article 6(1)e). Additionally, sometimes 'processing is necessary for compliance with a legal obligation to which the controller is subject' (Article 6(1)c). For these bases, we need to demonstrate that we do have the official authority. This comes under a variety of legislation, including DHSSPS Domiciliary Care Agencies Minimum Standards 2011, Human Rights Act 1998 and Health and Social Care Reform Act (NI) 2009.

The special category condition for processing for direct care is that processing is: 'necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...' (Article 9(2)(h)).

In addition to a GDPR Article 9 condition for processing, it is also necessary to identify an additional condition in Schedule 1 of the DPA 2018. For the provision of direct care, the relevant condition is 'Health or social care purposes' (Schedule 1, Part 1 (2)).

Where there are concerns about public health, such as for notifiable diseases, then the lawful basis is for processing personal data is: 9(2)(j) '…necessary for reasons of public interest in the area of public health…or ensuring high standards of quality and safety of health care and of medicinal products or medical devices…'

For suspected or actual safeguarding issue we will share information that we hold with other relevant agencies whether or not the individual or their representative agrees. The purpose of the processing is to protect a vulnerable adult.

The day-to-day processing of personal data relating to health care does not rely on consent. The most commonly lawful grounds for processing in a health care setting is as follows: Vital Interests example more info Public Task in the Public Interest As Health Care data is categorised as "special category"; another basis is required for the lawful processing of this data. The most commonly used in health care settings: Vital Interests-Public Interest-Health Public Health.

The processing for the Direct Care of Patients-The legal basis is: Public task – the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law. The Public Task Function is outlined in the Health & Social Care (Reform) Act (NI) 2009

The provision of health or social care or treatment or the management of health or social care systems and services. The service meets the associated condition in UK law, set out in Part 1 of Schedule 1 of the DPA 2018 for Health or social care purposes:2(1) This condition is met as the processing is necessary for health or social care purposes.

We operate mobile phone management for scanning in and out of calls for the provision of our services to service users and for staff payroll purposes. Mobile phones are managed on a mobile device management system for security and encryption purposes, this is a real time platform this is for the purposes of processing call compliance and payroll compliance.

The lawful basis for processing personal information is: 6(1)(c) legal obligation and 9(2)(b) '..is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of ...social protection law in so far as it is authorised by Union or Member State law.

We operate mobile phone management for scanning in and out of calls for the provision of our services to service users and for staff payroll purposes. Mobile phones are managed on a mobile device management system for security and encryption purposes, this is a real time platform this is for the purposes of processing call compliance and payroll compliance. Our lawful basis is above

Where there is a request for personal confidential data from an insurance company, solicitor, or employer (or similar third party) the lawful basis and lawful condition for processing will be explicit consent under both Articles 6(1)(a) and Article 9(1)(a).

Sometimes, we may rely on 6(1)f legitimate interests as a basis for processing carried out not in the performance of our official tasks, such as for system backup and recovery processes.

Service Improvement

The purpose for implementing the above is to maintain and monitor the performance of our services and to constantly look to improve the site and the services it offers to our users. The lawful basis we rely on to process your personal data is either Article 6(1)(a) of the GDPR, for example when we require your consent for surveys, or Article 6(1)(f) which allows us to process personal data when it's necessary for our legitimate interests. You have the right to opt out of your data being processed for these purposes.

We operate mobile phone management for scanning in and out of calls for the provision of our services to service users and for staff payroll purposes. Mobile phones managed on a Mobile device management system for security and encryption this is a real time platform this is for the purposes of processing call compliance and payroll compliance.

For service improvement and compliance all telephone calls in and out of NWCare are recorded for training and compliance purposes these are held in accordance with the retention of records schedules

Representation of Organisation

We process small amounts of data for those representing other organisations, such as partners organisations and suppliers. This will usually be limited to, for example, contact details, as is covered by Article 6(1)b whereby processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.'

Application and Employment

The lawful basis for processing data for job applications and employment is covered by Article 6(1)b whereby processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract', and 6(1)c, 'processing is necessary for compliance with a legal obligation wo which the controller is subject'.

Right to Complain

We work to high standards when it comes to processing your personal information. If you have queries or concerns or remain dissatisfied, please contact us at 02877723514.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner's Office. Please follow this link to see how to do that.

SARs and complaints may be made in writing or verbally. Freedom of information requests must be made in writing. Contact details are as follows:

• Subject Access Requests: dataprotectionofficer@nwcare.co.uk or if you wish to submit a SAR using telephone (call 028 77723415 ask for the manager.
• Freedom of Information requests: dataprotectionofficer@nwcare.co.uk
• Complaints: nwcare.co.uk/contacts

Visitors to our website

Our website uses cookies to enhance your browsing experience. A cookie is a small text file of data stored by our website within your browser. These cookies allow us to distinguish you from other users of our website, which helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

We use a cookie control system which allows you to accept the use of cookies, and control which cookies are saved to your device / computer. Some cookies will be saved for specific time periods, where others may last indefinitely. Your web browser should provide you with the controls to manage and delete cookies from your device, please see your web browser options.

If you have previously browsed to our website and no longer wish to accept cookies, please be aware that some cookies may have already been set. You may delete these cookies at any time via your browser by following these instructions here

You can control cookies via your browser settings by following the instructions at this address, however if you choose to block cookies then your browsing experience may be affected.

Read more about the individual cookies we use and how to recognise them by looking at the table below…

Statistics

NWCare Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

Marketing

NWCare Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third-party advertisers.

Linking to other websites / third party content

We have links to other websites that are connected to North West Care and Support Ltd these include www.nwrec.co.uk – Shared recruitment information is monitored and managed by North West Care and Support Ltd for both NWCare and NWRecruitment using a central CMS administration system.

Data security and protection

We ensure the security of any personal information we hold by using secure data storage technologies and precise procedures in how we store, access and manage that information. Our methods meet the GDPR compliance requirement.

At NWCare we take your privacy seriously. Staff will only access your information on a strict 'need to know' basis or when they engage in your period of care. All staff have a legal duty to keep your information safe and confidential, as does anyone who receives information about you. In line with legislation NWCare has a range of measures and strict standards to protect paper and electronically held information.

Purpose and lawful basis for processing

The purpose for implementing the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The lawful basis we rely on to process your personal data is either Article 6(1)(a) of the GDPR, for example when we require your consent for the optional cookies we use, or Article 6(1)(f) which allows us to process personal data when it's necessary for our legitimate interests. For example, in order to maintain the integrity of our IT systems and the continuity of our business.

What are your rights?

As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

The conditions that ensure that NWCare processes your personal information lawfully, fairly and in a transparent manner are set out in Article 6 and Article 9 of the UK General Data Protection Regulation. These conditions include, for example, complying with our legal obligations, to meet the vital interests of service users, for public health purposes and to fulfil our contractual obligations to provide health and social care services and manage our systems.