Privacy Notice

This Privacy Noticetells you what NWCare and Support Ltd ,  NWCare and NWRecruitment will do with yourpersonal information when you contact us or use our services.  Given the complexity of NWCare, therequirements of the legislation and our desire to ensure full compliance withthe legislation, this Privacy Notice is lengthy.  The contents are as follows:

We’ll tell you:

• why we are able to process your information.
• what purpose we are processing it for;
• whether you have to provide it to us;
• how long we store it for;
• whether there are other recipients of your personal information;
• whether we intend to transfer it to another country (we do not!); and
• whether we do automated decision-making or profiling (we do not!).

Data Protection Officer

Our Data Protection Officer can be contacted at NWCare Roe Business Centre Room F2 Killane Road Limavady BT49 0DNor via our postal address. Please mark the envelope ‘Data Protection Officer’.

How do we get information?

Most of the personalinformation we process is provided to us directly by you or by our social care partners,such as:

• You have been referred to our services.
• Your information has been passed to us byour partners, such as results of tests and information from people who care foryou, including health professionals and relatives
• You have requested us to care for you.
• You have applied for a job or secondmentwith us.
• You are representing your organisation.
• The professionals caring for you keeprecords about your health and any care you receive to ensure that you areprovided with the best possible treatment.

How your personal information is used:

Your records areused to direct, manage and deliver the care you receive to ensure that:

• The careprofessionals involved in your care have accurate and up to date information toassess your health and decide on the most appropriate treatment for you
• Yourconcerns can be properly investigated if a complaint is raised
• Appropriateinformation is available if you require healthcare another doctor or are requireadditional support.

How your information helps us improve services:

Your informationmay also be used to help us improve services by:

• Reviewingthe care, we provide to ensure it is of the highest standard and quality
• Ensuringour services can meet service user needs in the future
• Investigatingservice user queries, complaints and legal claims.

Please let us know if you do not wish for us to contact you to ask for your views on our services.

Children’s Information

We do not processchildren’s personal data.  

How long we keep it

Data is keptaccording to our retention guidelines, which are largely set by statute.  Retention guidelines are available from theData Protection Officer.

What are your rights?

Your rights depend on the nature of the data that is held.  Details are listed below.

How you can access your data

You can submit arequest for the data that we hold on to you; this is known as a Subject AccessRequest (SAR).  This request can becompleted in writing, by email, or verbally. You do not have to make anymention of legislation, or use specific wording, although we may ask you forclarification.  The request can be madeto any member of staff, who will forward the details to the Data ProtectionOfficer, who will coordinate the response. Alternatively, you can contact the Data Protection Officer directly atHead office  Roe Business CentreRoom F2 4-6 Killane Road Limavady BT49 0DN. We will need to confirm your identification.

You can also ask athird party (e.g., a relative, friend or solicitor) to make a Subject AccessRequest (SAR) on your behalf. We will need to be satisfied that the third partymaking the request is entitled to act your behalf, and it will be your and thethird party’s responsibility to provide evidence of their authority.

We have to supplythe data within one month and, in most circumstances, we cannot charge a feefor this service.  If the request iscomplex, or if we receive a number of requests, we can extend the time limit bya further two months.

The data will besupplied to you in an accessible, concise and intelligible format, usuallyusing the same means by which the request was made; thus, if the request hasbeen made by email, the response will be sent by email.

We can refuse to provide the information if an exemption or restriction applies, or if your request is manifestly unfounded or excessive.

Sharing Information

Everyone workingwithin NWCare and NWRecruitment  receivestraining and knows that they have a legal duty to keep information about youconfidential. Under the DHSSPS Domiciliary Care Agencies Minimum Standards 2011, Nursing Agencies Minimum Standards and the Data Protection Act 2018, all ourstaff are also required to protect your information, inform you of how yourinformation will be used, and allow you to decide if and how your informationcan be shared. Equally anyone who receives information from us also has a legalduty to keep it confidential. Any information we share is processed undersecure conditions to give you peace of mind that your personal data is protected,and we ensure that any NHS or care organisation that we share your details withhandles your data with the same high level of confidence.

We will shareinformation with the following main partner organisations:

• General Practitioners
• Other NHS bodies such as ambulance services
• Police (if a crime has been committed) or ifwe are concerned about your safety.

We will not disclose your information to any other third parties without your permission unless there are exceptional circumstances, such as when the health and safety of others is at risk or where the law requires it.

Sharing Confidential Information Without Consent   

It may sometimes benecessary to share confidential information without consent or where theindividual has explicitly refused consent. There must be a legal basis for doing so (e.g.  to safeguard a child) or a court order mustbe in place.

Where there is a legal requirement to disclose, for example,a direction under the Health and Social Care Act 2012 or disclosures underpublic health legislation, the lawful basis for processing would be: ‘… forcompliance with a legal obligation…’ (Article 6(1)(c)).  9(2)(b) ‘…is necessary for the purposes ofcarrying out the obligations and exercising the specific rights of thecontroller or of the data subject in the field of …social protection law in sofar as it is authorised by Union or Member State law.’.

For issues such as notifiable diseases, the most appropriatespecial category condition for processing in the face of a legal requirement todisclose is ‘…for the purpose of preventative…medicine…the provision ofhealth or social care or treatment or the management of health or social caresystems and services…’ (Article 9(2)(h)).

In deciding on anydisclosure certain considerations and steps need to be taken:

• Discussthe request with the appropriate personnel
• Discloseonly that information which is necessary or prescribed by law.
• Ensurerecipient is aware that they owe a duty of confidentiality to the information.
• Documentand justify the decision to release the information.
• Takeadvice in relation to any concerns you may have about risks of significant harmif information is not disclosed.

 Requests may be received by other agencieswhich are related to law enforcement such as:

• ThePolice or another enforcement agency where the appropriate section 29 requestform (in line with the Access to Records Procedure) needs to be submitted fromthe law enforcement agency in order for the CCGs to consider the request.
• TheLocal and National Counter Fraud specialists in relation to any actual orsuspected fraudulent activity.

Staff will alsotake into account DHSSPS Domiciliary Care Agencies Minimum Standards 2011,DHSSPSNursing agencies Minimum Standards  andInformation Governance Alliance guidance if there is a clear legal basis toshare.   

In some circumstances we are legally obliged to share information.  In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.  The organisation will ensure that information sharing takes place within a structured and documented process and in line with the Information Commissioner’s Code of Conduct and in accordance with the Health and Social Care Act 2012 and Health and Social Care (Safety and Quality) Act 2015.  

Data Processors

We use dataprocessors who are third parties who provide elements of services for us. Wehave contracts in place with our data processors. This means that they cannotdo anything with your personal information unless we have instructed them to doit. They will not share your personal information with any organisation apart fromus. They will hold it securely and retain it for the period we instruct.

The data is allheld in United Kingdom.  We do notprocess data outside United Kingdom.

North West Care andSupport Ltd utilise the services of ‘Mail Chimp’ and ‘Survey Monkey’ tocommunicate and gather professional information from professionalstakeholders/stakeholder agencies, clients, client family members, internalstaff and other job applicants who have adopted into communicating andreceiving information (in acceptable formats and with professional discretion)North West Care and Support Ltd/North West Care/NWCare. This can be in theformat of Newsletters, surveys, questionnaires, feedback forms, ezines, digitalpostcards and emails.

We will not shareyour information with any third parties for the purposes of direct marketing.

Disclosure of information

You have the rightto restrict how and with whom we share the personal information in yourrecords. This must be noted explicitly within your records so all healthcareprofessionals and staff treating you are aware of your decision.

By choosing this option, unfortunately it may make the provision of treatment or care more difficult or unavailable. You can also change your mind at any time about a disclosure decision.

The Legal Bit

Your Data Protection Rights

Under dataprotection law, you have rights we need to make you aware of. The rightsavailable to you depend on our reason for processing your information.

Your right of access

You have the rightto ask us for copies of your personal information. This right always applies.There are some exemptions, which means you may not always receive all theinformation we process. You can read more about this right here.

Your right to rectification

You have the rightto ask us to rectify information you think is inaccurate. You also have theright to ask us to complete information you think is incomplete. This rightalways applies. You can read more about this right here.

Your right to erasure

You have the rightto ask us to erase your personal information in certain circumstances. You canread more about this right here.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.

Your right to object to processing

You have the rightto object to processing if we are able to process your information because theprocess forms part of our public tasks or is in our legitimate interests. Youcan read more about this right here.

Your right to data portability

This only appliesto information you have given us. You have the right to ask that we transferthe information you gave us from one organisation to another or give it to you.The right only applies if we are processing information based on your consentor under, or in talks about entering into a contract and the processing isautomated. You can read more about this right here.

Lawful Basis

The General Data Protection Regulations (GDPR) sets outconditions for lawful processing of personal data (Article 6) and furtherconditions for processing special categories of personal data (Article 9).These are similar to the conditions in Schedules 2 and 3 of the Data ProtectionAct 1998 (DPA98) with sensitive personal data now called ‘special categories’of personal data. As personal data concerning health is one of the specialcategories, organisations that process such data must be able to demonstratethat they have met a condition in both Article 6 and Article 9 of the GDPR.

Provision of Healthcare

The lawful basisfor processing special category health data for direct care is that processingis: ‘necessary… in the exercise of official authority vested in the controller’(Article 6(1)e).  Additionally, sometimes‘processing is necessary for compliance with a legal obligation to which thecontroller is subject’ (Article 6(1)c). For these bases, we need to demonstrate that we do have the officialauthority.  This comes under a variety oflegislation, including DHSSPS Domiciliary Care Agencies Minimum Standards 2011and Health and Social Care Reform Act (NI) 2009.

The specialcategory condition for processing for direct care is that processing is: ‘necessaryfor the purposes of preventative or occupational medicine for the assessment ofthe working capacity of the employee, medical diagnosis, the provision ofhealth or social care or treatment or the management of health or social care systemsand services…’ (Article 9(2)(h)).

In addition to a GDPR Article 9condition for processing, it is also necessary to identify an additionalcondition in Schedule 1 of the DPA 2018. For the provision of direct care, therelevant condition is ‘Health or social care purposes’ (Schedule 1, Part 1 (2)). 

Where there are concerns aboutpublic health, such as for notifiable diseases, then the lawful basis is forprocessing personal data is: 9(2)(j) ‘…necessary for reasons of public interestin the area of public health…or ensuring high standards of quality and safetyof health care and of medicinal products or medical devices…

For suspected oractual safeguarding issue, we will share information that we hold with otherrelevant agencies whether or not the individual or their representative agrees.The purpose of the processing is to protect a vulnerable adult.

The lawful basisfor processing personal information is: 6(1)(c) legal obligation and 9(2)(b) ‘..is necessary for the purposes ofcarrying out the obligations and exercising the specific rights of thecontroller or of the data subject in the field of …social protection law inso far as it is authorised by Union or Member State law.

Where there is a request for personal confidential data froman insurance company, solicitor, or employer (or similar third party) thelawful basis and lawful condition for processing will be explicit consent underboth Articles 6(1)(a) and Article 9(1)(a).

Sometimes, we may rely on 6(1)f legitimate interests as a basis for processing carried out not in the performance of our official tasks, such as for system backup and recovery processes.

Service Improvement

The purpose forimplementing the above is to maintain and monitor the performance of ourservices and to constantly look to improve the site and the services it offersto our users. The lawful basis we rely on to process your personal data iseither Article 6(1)(a) of the GDPR, for example when we require your consentfor surveys, or Article 6(1)(f) which allows us to process personal data whenit’s necessary for our legitimate interests. You have the right to opt out of your data being processed for thesepurposes.

Representation of Organisation

We process small amounts of data for those representingother organisations, such as partners organisations and suppliers.  This will usually be limited to, for example,contact details, as is covered by Article 6(1)b whereby processing is necessaryfor the performance of a contract to which the data subject is party, or inorder to take steps at the request of the data subject prior to entering into acontract.’

Application and Employment

The lawful basis for processing data for job applications and employment is covered by Article 6(1)b whereby processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract’, and 6(1)c, ‘processing is necessary for compliance with a legal obligation wo which the controller is subject’. 

Right to Complain

We work to highstandards when it comes to processing your personal information. If you havequeries or concerns, please contact us at NWCare and Support Ltd RoeBusiness Centre Room F3 4-6 Killane Road Limavady BT49 0DN and we’ll respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office. Please follow this link to see how to do that.

Visitors to our website

Our website usescookies to enhance your browsing experience. A cookie is a small text file ofdata stored by our website within your browser. These cookies allow us todistinguish you from other users of our website, which helps us to provide youwith a good experience when you browse our website and also allows us toimprove our site.

We use a cookiecontrol system which allows you to accept the use of cookies, and control whichcookies are saved to your device / computer. Some cookies will be saved forspecific time periods, where others may last indefinitely. Your web browsershould provide you with the controls to manage and delete cookies from yourdevice, please see your web browser options.

If you havepreviously browsed to our website and no longer wish to accept cookies, pleasebe aware that some cookies may have already been set. You may delete thesecookies at any time via your browser by following these instructions here

You can controlcookies via your browser settings by following the instructions at this address, however if you choose to block cookiesthen your browsing experience may be affected.

Read more about the individual cookies we use and how to recognise them by looking at the table below….

Linking to other websites / thirdparty content

We have links toother websites that are connected to North West Care and Support Ltd theseinclude www.nwrec.co.uk – Shared recruitment information is monitored andmanaged by North West Care and Support Ltd for both NW Care and NW Recruitmentusing a central CMS administration system.

Data security and protection

We ensure thesecurity of any personal information we hold by using secure data storagetechnologies and precise procedures in how we store, access and manage thatinformation. Our methods meet the GDPR compliance requirement.

Purpose and lawful basis forprocessing

The purpose forimplementing the above is to maintain and monitor the performance of ourwebsite and to constantly look to improve the site and the services it offersto our users. The lawful basis we rely on to process your personal data iseither Article 6(1)(a) of the GDPR, for example when we require your consentfor the optional cookies we use, or Article 6(1)(f) which allows us to processpersonal data when it’s necessary for our legitimate interests. For example, inorder to maintain the integrity of our IT systems and the continuity of ourbusiness.

What are your rights?

As we areprocessing your personal data for our legitimate interests as stated above, youhave the right to object to our processing of your personal data. There arelegitimate reasons why we may refuse your objection, which depend on why we areprocessing it.