If you want to request further information about this privacy notice or exercise any of your rights, you can email the Data Protection Officer at Care.VNLVK@nhs.net.

If you want access to your care record, please contact us at:

Legal Services
Hever Care Limited
C/O 2 Turnbull Place
Riding Lane
Hildenborough
Kent
TN11 9LN

Care.VNLVK@nhs.net
01732 207 944

We are committed to protecting and respecting your privacy, and we take your privacy very seriously and we recognise the trust placed in us by individuals whose information we process.

To enable us to provide the best health and care we can, we collect different personal data and information required to undertake our activities and aims.

The information below sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about you, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. We are committed to ensuring that we do so in a manner that is lawful and respects your privacy.

We take the protection of your personal data very seriously and respect your privacy in accordance with data protection legislation and best practice. You have rights relating to your personal information. You can find more information about your privacy rights on the Information Commissioner’s Office website www.ico.org.uk.

The Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) directs how we must use the personal information we hold about you.

You have the right to be informed about how and why we process your personal information and any time you give us personal information you have the right to be informed about why we need it and how we’ll use it.

You can find most of the information you need in this Privacy Notice.

If you make a formal Subject Access Request (SAR), we will respond to acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.

We will provide you the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity been verified by us.

In exceptional cases we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.

In most circumstances there will be no charge for this right of access.

Legal Services
Hever Care Limited
C/O 2 Turnbull Place
Riding Lane
Hildenborough
Kent
TN11 9LN

legal@lawyerweb.sparktechwp.com
01732 207 944

If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it at any time for example the spelling of your name or your contact information.

For example, if you are contesting the accuracy of data we are using about you. In such cases we will restrict our processing while we verify the accuracy of the data that we hold.

In addition to the right to restrict the use of your data, you also have a right to object to how we process it in certain circumstances.

You can also ask for certain information about you to be deleted, although this does not apply to health data. In some cases, we will be unable to delete your information if there are statutory grounds to retain it (i.e., HMRC or other legal requirements).

As a registered Company, we are a legal entity, set up to provide goods and services for the purposes of supporting the health and social care system. We act as Health and Care Providers and provide community care services.

As such our business is based upon statutory powers which underpin the legal bases that apply for the purposes of the UK GDPR. We collect and use your personal information under the following primary lawful bases:

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as a Data Controller, and the task or function has a clear basis in law;

Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which we as a Data Controller are subject, for example where we have a specific legal obligation that requires the processing of personal data such as processing Subject Access or Freedom of Information requests;

Article 6(1)(d) – where processing is necessary to protect the vital interests of the data subject or another person, for example the processing is necessary to protect someone’s life.

Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Article 6(1) (a) – where you have given us consent for us to process your personal data for a specific purpose;

Special category data

As part of the Hever Care Limited’s statutory and corporate functions, we process special category data and criminal offence data in accordance with the requirements of Article 9 and 10 of the UK General Data Protection Regulation (‘GDPR’) and Schedule 1 of the Data Protection Act 2018 (‘DPA 2018’).

Where we process special categories data, for example data concerning health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the UK GDPR. Where we are processing special categories of personal data for purposes related to the commissioning and provision of health services the condition is:

Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person. An example of our processing would be using health information about a patient in a medical emergency.

Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

Article 9(2)(f) – for the establishment, exercise, or defence of legal claims. Examples of our processing include processing relating to any tribunal or other litigation. Hever Care Limited may also process personal data for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights.

Article 9(2)(g) – processing is necessary for reasons of substantial public interest.

Article 9(2)(a) – explicit consent – in circumstances where we seek consent, we make sure that the consent is unambiguous and for one or more specified purposes, is given by an affirmative action and is recorded as the condition for processing. For example, for some special projects that we may undertake.

Criminal conviction data

Article 10 UK GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’.

It is important that we inform you about the information we collect and why we collect it.  The information we collect and the reason for collecting it are different for different groups of individuals.

Information can be classed as ‘personal’ for example your name, address or date of birth or ‘sensitive’ e.g., details about your health, race or ethnic origin, sexual orientation.

We do not collect more information than we need to fulfil our stated purposes and will not retain for longer than is necessary.

The list below provides a general overview of the types of information we collect and why, it is not an exhaustive list but gives an indication of the general types of information we collect.

In general, the personal information that we collect, hold and share includes:

• personal information (such as name, date of birth, NHS number, addresses, contact details);characteristics (such as gender, ethnicity, language, medical conditions, nationality, country of birth);
• details of the medical records and health of patients including current and previous GP practice details;
• specific information relation to child protection or safeguarding.

By providing us with your contact details, you are agreeing for us to use these ways to communicate with you about your care, i.e., by letter (address), by voicemail or voice message (telephone or mobile number), by text message (mobile number) or by email (email address).

We understand that sharing information is a sensitive topic, however on occasions it is necessary for us to allow others to see your personal data. We will never sell your information and are committed to being transparent with you about where we legally share information, the reason why and who with. The information below gives an overview of the most frequent sharing that we undertake.

We routinely share information with internal and external health professionals directly involved with your care. We may share your personal information with NHS organisations, or the Local Authority for health and care purposes. This may include NHS Trusts, or other providers of NHS services including for example general practitioners (GPs), ambulance services and primary care agencies.

We may need to share information from your care records with other non-NHS organisations, such as Social Services if you are also receiving care or support from them, to ensure that the services you receive are appropriate.

These non-NHS organisations may include, but are not restricted to:

• Social Services
• Education services
• Local authorities
• The police
• Other independent sector providers.

All members of staff employed by these agencies are bound by the common law duty of confidentiality which means that information that you provide to us must be held in confidence and not shared with anyone else.

On occasions, we will share information with organisations who can provide additional services to deliver positive outcomes for our service users and families, providing substantial benefits and opportunities. We share the minimum information necessary to allow the other organisation (e.g., food banks, meal delivery services, self-management support etc.) to deliver these services. These partners are a key element in helping us to deliver integrated care and meet our common law duty of care.

We will only share information once we have discussed this with you.

We may need to share information from your care record for the purposes of evaluating the quality of care that we provide, for example with professional bodies and regulators in accordance with our statutory obligations.

We may also be asked by other statutory bodies to share basic information about you, such as your name and address – but not sensitive information from your health records. When this happens, it is normally because it will assist them to carry out their statutory duties and it is lawful for us to do so.

On occasions we may be required by law to provide information about you for any of the following purposes:

• the prevention or detection of crime,
• the apprehension or prosecution of offenders, or
• the assessment or collection of any tax or duty or of any imposition of a similar nature.

We are not obliged to inform you when this happens.

Your information may be accessed and shared internally by our staff in the event of routine enquiries, complaints about us or where we are required to do so by law, for example processing subject access requests or Freedom of Information requests, financial transactions, maintaining our accounts and prevention of fraud. This may include members of different departmental admin teams and our IT staff if access to the data is necessary for performance of their roles, the nature of the enquiry or request and it is within the above lawful bases.

Information about the use of our IT systems is shared with technical suppliers for the purposes of support and system administration.

In the event that we share personal data with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

The telephone systems record incoming and outgoing calls for training and monitoring purposes. Access to recordings are restricted. Disclosure will be made in accordance with the Data Protection Act. See the Legal Services contact details at the top of this notice.

All personal information is stored on our IT systems on secure servers or in secure cabinets in protected areas and offices etc. We operate a suite of IT and security policies to ensure your information is kept secure, including appropriate access and auditing controls.

We use antivirus software and firewalls to protect against cyber-attack. Unfortunately, the transmission of information via the internet isn’t completely secure. Although we’ll do our best to protect your personal information, we cannot guarantee the security of information you may send to us that is outside of our security arrangements, for example via your personal email accounts etc.

We also operate strict physical security at all our sites and our employees all receive annual security and data protection awareness training.

Your information is not sent outside the United Kingdom or the European Union unless the recipient has the same level of legal responsibility as we do.

We are fully compliant with the NHS Data Security and Protection Toolkit and publish our assessment annually.

We only keep information for as long as necessary in accordance with legislation or relevant regulations.  Once we no longer need to keep your information, we remove it from our systems or securely dispose of it.

All service user records are destroyed in accordance with the Records Management Code of Practice for Health and Social Care which sets out the appropriate length of time each type of NHS record is retained for.

We do not keep personal records for longer than necessary and all records are destroyed confidentially once their retention period has been met, and we have made the decision that the records are no longer required.

Telephone call recordings are kept for three calendar months.

This privacy notice may change from time to time, for example, if the law around privacy or personal information changes or for operational purposes. We encourage you to check for updates to this notice from time to time.

Hever Care Limited tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading, or inappropriate. We would also welcome any suggestions for improving our procedures.

If you believe that Hever Care Limited has not complied with your data protection rights, you can complain to the Information Commissioner’s Office, their address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by calling 0303 123 1113.