As part of the services we offer, we are required to process personal information about our colleagues, the people we support and, in some instances, the families and representative of the people we support. “Processing” can mean collecting, recording, organising, storing, sharing or destroying data.

We are committed to being transparent about why we need your personal information, what we do with it, with whom we share it with, for how long we keep it and what legal rights you have. This information is set out in this privacy notice.

In order that we can provide a safe and professional service, we need to keep certain records about you. We may process the following types of data:

• Your basic details and contact information e.g. your name, residential address, email address, telephone number date of birth and next of kin and emergency contact information;
• Your financial details e.g. details of how you pay us for your care or details of your funding arrangements.

We also record the following data which is classified as “special category”:

• Health and social care data about you, which might include both your physical and mental health data, including:
  • information regarding prescriptions and medication;
  • MAR chart results;
  • details of health conditions, care provided and equipment used as part of your care/treatment;
  • care needs assessment records;
  • daily records; and
  • information on social care and GP involvement regarding your mental and/or physical wellbeing.
• We may also record data about your race, ethnic origin, sexual orientation or religion.

The information may be collected from:

• You or your legal representative(s); or
• Third parties (for example healthcare providers).

We do this face to face, via phone, via email, via our website, via post, via application forms and via apps.

We need this data so that we can provide high-quality care and support.

We process your data (which may include special category data):

• where applicable, to allow us to perform our contract with you;
• because we have a legal obligation to do so – generally under the Health and Social Care Act 2012 or Mental Capacity Act 2005;
• because it is necessary due to social security and social protection law (generally this would be in safeguarding instances);
• because it is necessary for us to provide and manage children’s care, health and social care services;
• where we are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations; and
• for the establishment, exercise or defence of legal claims.

Third party organisations we might share your data with include:

• other parts of the health and care system such as local hospitals, the GP, the pharmacy, social workers, clinical commissioning groups, and other health and care professionals;
• the relevant Local Authority;
• health or social care staff under a commissioned arrangement;
• organisations we have a legal obligation to share information with, e.g. for safeguarding, the CQC;
• the police or other law enforcement agencies;
• our professional advisors;
• third party service providers;
• your family or representatives ; and
• third parties in the context of the possible sale or restructuring of our business.

As part of our work providing high-quality care and support, it might be necessary that we hold the following information on you:

• Your basic details and contact information e.g. your name and residential address, email address and telephone details.

The information may be collected from:

• You or your legal representative(s); or
• Third parties (for example healthcare providers or the person we are supporting).

We do this face to face, via phone, via email, via our website, via post, via application forms and via apps

We process your data because we have a legitimate business interest in holding next of kin and lasting power of attorney information about the people who use our service and keeping emergency contact details should these be required.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you.  We may do this for research and statistical analysis purposes.

Third party organisations we might share your data with include:

• other parts of the health and care system such as local hospitals, the GP, the pharmacy, social workers, and other health and care professionals;
• the relevant Local Authority;
• health or social care staff under a commissioned arrangement; the police or other law enforcement agencies;
• our professional advisors;
• third party service providers; and
• third parties in the context of the possible sale or restructuring of our business.

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential patient information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/.

• We use various systems to ensure the people we support receive the best care and support possible.
• Some of these systems may have a degree of automation, for example, where data is input into a platform to identify the most appropriate professional to provide care based on your needs
• NO decisions on your care are taken without human intervention.

We do not routinely transfer the personal information we collect about you outside of the UK. If in the future, we do need to transfer information outside of the UK, we shall do so to country/countries deemed to provide an adequate level of protection for your personal information or put in place appropriate measures to ensure that your personal information is treated by the third parties in a way that is consistent with and which respects UK law on data protection. Further information can be requested from the Data Protection Officer.

You have certain rights, in relation to your personal data as summarised here.  For more information on your rights, please see the contact details at the bottom of this notice:

• Right to be informed – you have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights, which is why we are providing you with this privacy notice.
• Right of access – you can request access to your personal data.
• Correcting or erasing your information – where we hold information about you that is inaccurate or incomplete, you have the right to ask us to rectify or complete it and in certain circumstances you may ask us to erase it.
• Right to restrict processing – you have the right to restrict some processing of your personal information, which means that you can ask us to limit what we do with it.
• Right to data portability – you have the right to obtain from us and re-use your personal information for your own purposes. This only applies, however, where the processing is carried out by automated means, to personal information that you have provided to us yourself (not any other information) and where the processing is based on your consent or for the performance of a contract.
• Right to withdraw consent – in the limited circumstances where you may have provided your consent to the processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

In addition to the above rights, you also have the right to object to certain types of processing, in certain circumstances; including sometimes where we are using it solely for the purpose of our legitimate business interests.

Please note that these rights are not necessarily absolute. There are some exemptions that may apply in certain circumstances.

If you have questions on these rights or to exercise any of these rights you can contact us.

• Information Commissioner:  https://ico.org.uk/
• Care Quality Commission: https://www.cqc.org.uk

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, you may contact the DPO at dataprotectionofficer@sonderwell.co.uk. You have the right to make a complaint at any time to the UK data protection regulator with respect to data protection issues. The regulator’s address is:

Information Commissioner’s Office

Wycliffe House

Walter Lane

Wimslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/

The relevant contact details will be those for the entity that you have engaged as a service provider. The details are:

We may update this privacy notice from time to time. An up to date copy can be found at www.sonderwell.co.uk or on request from dataprotectionofficer@sonderwell.co.uk