Third Party Privacy Policy

Third Party Privacy Policy

Your privacy is important to us. When we process your personal data, we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy legislation.

Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.

Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it.

This privacy policy provides information about the personal data we process about you, why we process it and how we process it. It applies to our care home service users, users of any other care services we provide and their families, representatives and attorneys.

Our responsibilities

Humberside Independent Care Association Limited T/a HICA Group (company number: IP27662R) and with a registered office address of Unit 1-4 Anchor Court, 160 Francis Street, Hull, HU2 8DT (referred to throughout this privacy policy as “The HICA Group”, “us”, “our” and “we”) is the controller of the personal data you provide.

The HICA Group is an organisation specialising in care and support solutions for older people and individuals with learning difficulties. This privacy policy applies to any individual receiving care services from The HICA Group (together with their families, representatives, attorneys or deputies), as well as any other third party whose personal data is processed by the HICA Group such as visitors to our website, individuals applying for employment within The HICA Group, third parties that assist The HICA Group in delivering services and individuals on mailing list.

HICA’s Data Protection Officer (DPO) is Natalie Dangerfield, Head of HR. The DPO’s role is to monitor and advise HICA on meeting its data protection and data processing responsibilities. If you have any queries regarding our processing of your personal data, the DPO can be contacted via hr@hica-uk.com or by calling 01482 581000.

HICA’s Caldicott Guardian, responsible for the confidentiality and sharing of health and social care related data is Heather Joy, Director of Operations.

WHAT DATA DO WE PROCESS ABOUT YOU?

Service Users

We may collect, use, store and transfer the following kinds of personal data about you:

Identity Data: including your name, marital status, title, date of birth, gender and NHS number.
Contact Data: including your address, email address and telephone number.
Financial Data: including your bank account details and/or card details, bank statements, credit information and details of any funding/grants to which you are entitled (depending on how your residency fees are to be paid) and details of your personal spending allowance.
Family and Support Data: including contact details of your family members, next of kin, GP, representative, attorney, deputy and other supporters.
Care Data: including details of your care plan, assessment of needs and capacity, your lifestyle and likes/dislikes, ethnicity, religious and cultural information, information relating to any special care requirements, details of any safeguarding requirements, details of any accidents, incidents, complaints or testimonials occurring during your period of residency, records of daily activities or trips taken during your period of residency and, where your care is being transferred from another care home or care provider, your previous care plan/records.
Medical Data: including your medical history, hospital records and other medical results/information that we need access to be able to provide you with appropriate care and support.
Other: including information required by regulatory bodies and photos and videos used for marketing material where we have the requisite consent.

Families, Representatives, Attorneys, Deputies and other Supporters of a Service User

We may collect, use, store and transfer the following kinds of personal data about you:

Identity Data: including your name, marital status, title, date of birth, gender and the nature of your relationship with the service user.
Contact Data: including your email address, address and telephone number.
Financial Data: including your bank account details and/or card details, bank statements, credit information and details of any funding/grants you may have received (depending on how the service user’s fees and/or personal allowance are to be paid).
Other: including Power of Attorney or Deputyship information, details of any interaction you have with The HICA Group (such as enquiries, concerns, complaints and testimonials), information required by regulatory bodies and photos and videos used for marketing material where we have the requisite consent.

There are a number of reasons for which we may need to process your personal data (including special categories of data) including:

where you are one of our service users, to fulfil our obligations in our contract with you;
in order to provide health or social care services;
to protect your vital interests where you are unable to provide consent (for example, providing information to the emergency services in a medical emergency);
where the processing is required to fulfil a legal obligation imposed upon us;
for our legitimate interests, including the provision of care and support to our service users;
where you have provided explicit consent for us to do so; and
where we need to process your personal data for reasons of public health (for example to track or limit the spread of a pandemic).

Third Party Service Providers, Suppliers and Business Contacts

If you work for one of our suppliers or are one of our business contacts, we usually process your name and business contact details, such as your business email address and phone number and the address of your organisation. We process the information on the grounds of our legitimate interests in maintaining our relationship with you.

In limited circumstances, we may be required to process payment information including bank account details where we are paying your invoice and this will be done on the grounds of fulfilling our contract with you (although typically this will be a business bank account and, therefore, will not constitute personal data.

Visitors to our premises

We may process your name and contact details where you sign into access our premises and this will be done on the grounds of our legitimate interests in knowing who is on the premises at any given time for security and safety reasons.

We also use CCTV in and around our premises for the purposes of crime prevention, detection and health and safety. CCTV footage of you may therefore be captured if you reside at or when you visit one of our care homes. The use of CCTV by The HICA Group is limited to public areas of the care homes only and will not extend to the private rooms of service users or staff changing areas.

We retain CCTV images for 31 days or for such other period of time that we are required to retain images to assist with any ongoing investigations or incidents.

Website Visitors

Where you contact us to raise enquiries about the services we provide, we may collect data about you to allow us to respond effectively. The personal data collected is likely to be limited to your name and contact details, such as your email address and phone number, and any personal data voluntarily offered as part of your enquiry.

We process your information on the grounds of consent or our legitimate interests in responding to any enquiries raised and to manage/maintain our relationship with you.

To help us improve our website and the products and services we offer, we collect data about the ways in which you use our website. This includes, for example, technical data such as your IP address, which is collected through our use of cookies. More information (including the retention period for each cookie) can be found in our cookie policy, available here:

https://buckshawretirementvillage.com/privacy-policy/

https://hica-uk.com/cookies-policy/

Candidates

If you apply for a job vacancy with us, or speculatively send us your CV, the personal data that we are likely to process about you includes:

identity data such as your first name, middle names, last name, marital status, title, date of birth and gender;
contact data such as your postal address, email address and telephone numbers;
background data such as your education, career background and work experience;
personal information such as your skills and qualities; and
any other information that you include on any CV, application or covering letter you send to us.

We process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview), we will do so in accordance with our legal obligations. If you provide special categories of data to us which we have not requested, we will process it on the grounds of your consent because you have voluntarily provided the information to us.

OUR COLLECTION OF YOUR PERSONAL DATA

We use different methods to collect data from and about you as set out below.

Service Users

Direct interactions

You may give us your personal data by filling in forms upon signing a contract to become a service user, by corresponding with us by post, phone, email or otherwise, or in the course of day-to-day life as a service user at one of our care homes or other services we provide.

Via third parties

In certain situations, we may also receive your personal data from third parties. This could include (but is not limited to) information provided by:

your family, supporter or attorney;
your GP or any other NHS trust or health and social care organisation that is involved in your ongoing care including the emergency services;
people or organisations who provide services on our behalf at our care homes, for example hairdressers, chiropodists, physiotherapists and third parties that provide entertainment to our service users;
the Care Quality Commission;
the Court of Protection;
any body or individual responsible for providing funding for your residency fees or personal allowance;
where you have appointed an advocate, from the advocate or the company for which they work;
clinical commissioning groups and integrated care systems;
Government departments including Social Services;
local authorities and councils; and
any care homes at which you have previously resided or other service providers that have provider you with other care services.

Families, Representatives, Attorneys, Deputies and other Supporters of a Service User

Direct interactions

You may give us your personal data by filling in forms provided by us to you as a result of your relative residing at one of our care homes, filling in our visitors book, by corresponding with us by post, phone, email or otherwise, or in the course of day-to-day life when visiting a service user at one of our care homes or liaising with us in relation to such service user.

Via third parties

In certain situations, we may also receive your personal data from third parties. This could include (but is not limited to):

the service user to whom you are related or are supporting;
if the service user you are supporting has appointed an advocate, from the advocate or the company for which the advocate works;
clinical commissioning groups and integrated care systems;
the Court of Protection;
Government departments including Social Services;
the Care Quality Commission; and
any previous care homes at which the service user you are supporting has previously resided or service provider that has delivered care to the service user.

Third Party Service Providers, Suppliers and Business Contacts, Visitors to our premises, Website Visitors

In most cases we will collect your data via direct interactions with you but in limited circumstances your data may be collected from other sources (e.g. your website or other internet sources).

Candidates

We receive personal data directly from you when you contact us in respect of a specific vacancy or with a speculative approach. We may also receive information about you from recruiters and agencies that provide temporary workers.

WHO WILL RECEIVE YOUR PERSONAL DATA?

Your personal data is only transferred to the extent that it is necessary in relation to our provision of services.

Service Users

Recipients of your personal data may include:

third parties responsible for safeguarding or assisting with your care (for example, your GP, local authority, the Care Quality Commission, relevant NHS Trusts, NHS Digital, Public Health England, housing associations and the emergency services);
your family members, representatives, attorney, deputy and/or other supporter;
third party organisations responsible for funding your care;
clinical commissioning groups and integrated care systems;
Integrated Care Boards;
third parties that manage our housing portfolios
Government departments including Social Services;
the Court of Protection;
people or organisations who provide services on our behalf at our care homes or otherwise assist with service delivery e.g. hairdressers, chiropodists, physiotherapists and third parties that provide entertainment to our service users;
if you are considering appointing or have appointed an advocate, the advocate and/or the company for which the advocate works;
third party providers of IT software and applications;
third party payment processors;
legal advisors to the extent they need to see your personal data to provide us with legal advice; and
third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

Families, Representatives, Attorneys, Deputies and other Supporters of a Service User

Recipients of your personal data may include:

the service user with whom you have a relationship;
third parties responsible for safeguarding or assisting with our service user’s care (for example, the service user’s GP, local authority, the Care Quality Commission, relevant NHS Trusts and the emergency services);
the service user’s family members, representatives, attorney, deputy and/or other supporter;
third party organisations responsible for funding the service user’s care;
clinical commissioning groups and integrated care systems;
the Court of Protection;
Government departments including Social Services;
if a service user has considered appointing or has appointed an advocate, the advocate and/or the company for which the advocate works;
third party providers of IT software and applications;
third party payment processors;
legal advisors to the extent they need to see your personal data to provide us with legal advice; and
third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

Third Party Service Providers, Suppliers and Business Contacts, Visitors to our premises, Website Visitors

Recipients of your personal data may include:

third party providers of IT software and applications;
third party payment processors;
service users, their families or supporters;
other organisations assisting with the delivery of our services or care;
legal advisors to the extent they need to see your personal data to provide us with legal advice; and
third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

Candidates

We may provide feedback to you via the recruiter or agency that recommended you to us.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

We do not transfer your personal data outside of the EEA.

HOW LONG WILL WE KEEP YOUR PERSONAL DATA?

Service Users and Families, Representatives, Attorneys, Deputies and other Supporters of a Service User

At the point you are no longer a service user with us, your file will be securely archived at the next available opportunity. We will retain your personal data for a maximum of 8 years from the date your file is archived. We retain your information for this period in line with the requirements of legislation and codes by which we must abide and in case any issues arise following the end of your residence with us or in case there are any queries about the period in which you were residing with us. Your information will be kept securely at all times in line with our policies that relate to data protection and IT security. Following the end of the 8-year period, your files and personal data we hold about you will be permanently deleted or destroyed.

We retain CCTV footage for a period of 31 days after which it is permanently deleted unless it is relevant to a crime, incident or other event that has arisen in which case we will retain it for as long as required in relation to such crime, incident or event.

If you require any further information regarding the timeframes for which your personal data will be retained, please contact hr@hica-uk.com.

Third Party Service Providers, Suppliers and Business Contacts

Your personal data is retained for the duration of our relationship with you or the organisation for which you work. Please let us know if you leave the organisation or if your details change. If we receive notification from you or your organisation that you no longer work at that organisation, or if we no longer maintain a working relationship with your organisation, we will delete your information from our system.

If we are corresponding with you as a potential supplier, we will retain your details until we receive notification from you or your organisation that you no longer work at that organisation or until we no longer correspond with the organisation for which you work.

Candidates

If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 6 months from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.

MARKETING

We occasionally send newsletters or updates with what events are taking place within our care homes or any other events which we are hosting. We only send you marketing if we are entitled to do so under data protection and privacy legislation, which usually means we either have your consent to send you marketing or we send it to you because you are one of our existing customers. You can unsubscribe to our marketing communications at any time, either by clicking “unsubscribe” in any marketing email we send to you or by emailing hr@hica-uk.com.

WHAT ARE YOUR RIGHTS?

You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/).

These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you, we will let you know.

Please note that if you are a family member or supporter of a service user or former service user and you wish to make a request on behalf of a service user or former service user, we will need:

written consent from the service user that they agree to you making the request on their behalf and, if applicable, accessing their personal data, together with confirmation from a medical professional (or other third party who we deem suitable) that the service user has the requisite mental capacity to provide consent; or
confirmation from a medical professional (or other third party who we deem suitable) that the service user or former service user does not have the requisite mental capacity to provide consent, together with a copy of a Lasting Power of Attorney pursuant to which you are entitled to make such request on the service user or former service user’s behalf and, if applicable, access their personal data.

If you are unable to meet the criteria set out above, we will not be able to respond to the request you have submitted on behalf of the service user or former service user.

Access to your data

You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this fair processing notice.

Rectification of your data

If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to rectify that information.

Right to be forgotten

In some circumstances, you have the right to ask us to delete personal data we hold about you.

Right to restrict processing

In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data but we do not have to delete it.

Data portability

You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.

Right to object

You are entitled to object to us processing your personal data:

if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
for direct marketing purposes (including profiling); and/or
for the purposes of scientific or historical research and statistics.

We do not intend to use your personal data for marketing or scientific or historical research and statistics.

AUTOMATED DECISION MAKING

Automated decision-making means making a decision solely by automated means without any human involvement.

We do not carry out any automated decision making.

QUESTIONS OR CONCERNS

If you think we have processed your personal data unlawfully or that we have not complied with the UK GDPR, please get in touch with us at hr@hica-uk.com so we can help. You can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website – https://ico.org.uk/concerns/