Joy Care Solutions Ltd ("Joy Care", "we", "us" or "our") is committed to protecting your privacy and handling your personal information lawfully, fairly and transparently. This policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
As a provider of regulated care services, we are also required to keep certain records by the Health and Social Care Act 2008 and the regulations made under it, and we are inspected by the Care Quality Commission (CQC).
1. Who we are
Joy Care Solutions Ltd is the data controller for the personal information described in this policy. We are a Care Quality Commission registered health and social care organisation providing domiciliary (home) care and supported living services across Buckinghamshire and surrounding areas. Our CQC Provider ID is 1-23448879338.
Our contact details are:
- Post: Joy Care Solutions Ltd, 2 Morello Close, Aylesbury, HP18 0WT
- Telephone: 01296 255581 or 07504 993 375 (mobile)
- Email: info@joycaresolutions.com
Our Registered Manager is responsible for data protection within the organisation. You can contact them using the details above, marking your message "Data Protection".
2. Who this policy applies to
This policy applies to personal information we hold about:
- people who receive, or are being assessed for, care and support from us ("service users");
- family members, friends, carers, advocates and other representatives of service users;
- people who make a referral or enquiry on behalf of someone else;
- health and social care professionals and staff at other organisations we work with, such as GPs, community mental health teams, local authorities and hospitals;
- people who apply to work for us, and our current and former staff;
- visitors to our website and people who contact us through it.
3. The information we collect
The information we collect depends on our relationship with you. It may include:
Service users
- Identity and contact details: name, date of birth, address, telephone number and email address.
- NHS number and details of your GP and other professionals involved in your care.
- Health information: diagnoses, medical history, medication, allergies, mental health history, risk assessments, mobility and equipment needs, dietary needs and other information needed to plan and deliver your care safely.
- Care records: assessments, care and support plans, daily care notes, medication administration records, incident and accident reports, safeguarding records and reviews.
- Personal circumstances: living arrangements, family and support network, preferences, routines, communication needs, cultural and religious needs and life history where relevant to your care.
- Information about your capacity to make decisions, any Lasting Power of Attorney, deputyship or advance decisions, and any best-interests decisions made on your behalf.
- Financial information needed to invoice for care, such as funding arrangements and payment details.
- Details of complaints, compliments and feedback.
Family members, representatives and referrers
- Name, relationship to the service user, contact details and preferred contact method.
- Information you give us about the person you are enquiring or referring on behalf of.
- Details of any legal authority you hold to act on someone's behalf.
Professionals
- Name, job title, organisation and work contact details.
- Records of our correspondence and joint working in relation to a service user.
Job applicants and staff
- Name, contact details, CV, employment history, qualifications, training records and references.
- Right-to-work documents, Disclosure and Barring Service (DBS) checks and professional registration details.
- Health information relevant to your fitness to work, and equality monitoring information where you choose to provide it.
Website visitors
- Information you submit through our contact, referral, assessment and careers forms.
- Technical information such as IP address, browser type and pages visited, where cookies or analytics are used (see section 13).
4. How we collect your information
We collect information:
- directly from you, for example when you contact us, complete a form on our website, take part in an assessment or receive care;
- from family members, carers or representatives acting on your behalf;
- from health and social care professionals and organisations involved in your care, such as your GP, hospital discharge teams, community mental health teams, social workers and the local authority;
- from our own staff as they deliver and record your care;
- from referees, the Disclosure and Barring Service and other checking bodies in relation to job applicants and staff.
5. How we use your information
We use personal information to:
- respond to referrals and enquiries and arrange assessments;
- assess needs and risks and plan, deliver, monitor and review safe and person-centred care and support;
- administer medication safely and keep accurate records of care given;
- communicate with you, your family or representatives and the professionals involved in your care;
- identify and respond to safeguarding concerns, incidents, deterioration in health and emergencies;
- meet our legal and regulatory obligations, including to the Care Quality Commission and local authorities;
- invoice and collect payment for services and manage funding arrangements;
- investigate and respond to complaints, and improve the quality of our services;
- recruit, vet, train, supervise and manage staff;
- run and secure our website and respond to messages sent through it.
We do not sell personal information and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.
6. Our lawful bases for processing
Under UK GDPR we must have a lawful basis for using personal information. We rely on:
- Contract (Article 6(1)(b)): to provide the care and support services agreed with you or on your behalf, and to manage payment.
- Legal obligation (Article 6(1)(c)): to keep the records required of a regulated care provider, respond to the Care Quality Commission and safeguarding authorities, and meet employment, tax and health and safety law.
- Vital interests (Article 6(1)(d)): to protect your life or someone else's in an emergency.
- Public task (Article 6(1)(e)): where we deliver care commissioned by a local authority or the NHS in the exercise of their statutory functions.
- Legitimate interests (Article 6(1)(f)): to run our organisation effectively, respond to enquiries, keep our website secure and improve our services, provided your interests and rights do not override these.
- Consent (Article 6(1)(a)): in limited situations, such as sending you marketing or newsletters, or using your photograph. You can withdraw consent at any time.
7. Health and other special category data
Much of the information we hold about service users is "special category" data, including information about health, mental health, disability, race or ethnicity, religion and sexual orientation. Where we process this information we rely on an additional condition under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018, most commonly:
- Health or social care (Article 9(2)(h)): the provision of health and social care and the management of care services, carried out by or under the responsibility of professionals who owe a duty of confidentiality.
- Safeguarding (Schedule 1, paragraph 18): protecting individuals at risk from neglect or physical, mental or emotional harm.
- Vital interests (Article 9(2)(c)): where you are physically or legally incapable of giving consent in an emergency.
- Equality of opportunity (Schedule 1, paragraph 8): for anonymised equality monitoring.
- Explicit consent (Article 9(2)(a)): in limited cases where none of the above applies.
We also process information about criminal convictions and offences for staff and applicants, through DBS checks, because the law requires us to do so for people working in regulated care roles.
9. International transfers
We aim to store personal information within the United Kingdom. Some of our service providers may process information in other countries, including the European Economic Area and the United States. Where this happens we make sure appropriate safeguards are in place, such as a UK adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
10. How long we keep your information
We keep personal information only for as long as we need it for the purposes described in this policy and to meet our legal and regulatory obligations. Our retention periods follow the Records Management Code of Practice for Health and Social Care and other applicable guidance. As a guide:
- Care records for adults: 8 years after care ends, or longer where required, for example following a serious incident or where records relate to a person who lacked capacity.
- Safeguarding, incident and complaint records: generally 8 years, or longer if linked to legal proceedings.
- Enquiries and referrals that do not lead to a service: up to 12 months.
- Financial and invoicing records: 6 years after the end of the financial year to which they relate.
- Staff records: 6 years after employment ends; some records, such as pension and certain health and safety records, must be kept longer.
- Unsuccessful job applications: 6 months after the recruitment decision, unless you ask us to keep your details for future vacancies.
- Website form submissions: deleted from our form provider once transferred to our secure systems, and no later than 12 months after receipt.
When information is no longer needed we delete or securely destroy it.
11. How we keep your information secure
We take appropriate technical and organisational measures to protect personal information, including:
- secure, access-controlled digital care-record systems with individual staff logins and audit trails;
- encryption of data in transit and at rest where supported by our systems;
- role-based access so staff see only the information they need to do their job;
- confidentiality clauses in all staff contracts and mandatory data protection and information governance training;
- secure storage and disposal of any paper records;
- procedures for identifying, reporting and managing personal data breaches, including notifying the Information Commissioner's Office and affected individuals where required.
12. Your rights
Under UK GDPR you have the following rights in relation to your personal information:
- Right to be informed: to know how we use your information, which this policy explains.
- Right of access: to receive a copy of the personal information we hold about you (a "subject access request").
- Right to rectification: to have inaccurate or incomplete information corrected.
- Right to erasure: to ask us to delete your information in certain circumstances. This right does not apply where we must keep records by law, which is the case for most care records.
- Right to restrict processing: to ask us to limit how we use your information in certain circumstances.
- Right to data portability: to receive information you provided to us in a machine-readable format where we process it by automated means on the basis of consent or contract.
- Right to object: to object to processing based on legitimate interests or public task, and to direct marketing at any time.
- Right to withdraw consent: where we rely on consent, at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us using the details in section 17. We will respond within one month, which may be extended by up to two further months for complex requests. We will not normally charge a fee. We may need to verify your identity, or your authority to act for someone else, before we respond.
Where a service user lacks the capacity to exercise these rights, a person with appropriate legal authority, such as an attorney under a Lasting Power of Attorney for health and welfare or a court-appointed deputy, may exercise them on their behalf.
13. Website, forms and cookies
Forms. Our contact, referral, assessment and careers forms are processed by Formspree, a third-party form service, which transmits your submission to us by email. Formspree acts as our processor and stores submissions temporarily. Please do not include detailed health information in a web form. Give us a brief outline of support needs and we will collect further details securely during an assessment.
Cookies. Our website uses only the cookies and local storage that are strictly necessary for it to function, such as remembering your menu or theme preference. We do not currently use advertising or third-party tracking cookies. If we introduce analytics cookies in future we will update this policy and ask for your consent where required.
Embedded content. Our contact page includes a Google Maps embed. When you load that page Google may collect technical information about your visit in accordance with Google's privacy policy.
Links. Our website may link to other websites, including the Care Quality Commission. We are not responsible for the privacy practices of other sites.
14. Job applicants and staff
If you apply to work with us we use your information to assess your application, carry out the checks required for people working in regulated care, including references, right-to-work and enhanced DBS checks with adult barred-list checks, and to comply with our legal obligations as an employer. If your application is unsuccessful we keep your details for 6 months and then delete them, unless you ask us to keep them for future vacancies. Current and former staff are given a separate, more detailed staff privacy notice.
15. Children
Our services are for adults aged 18 and over. We do not knowingly collect personal information from children through our website. Where a child is part of a service user's household or support network and we need to record limited information about them for the purpose of safe care, we do so under the same safeguards described in this policy.
16. Changes to this policy
We review this policy at least annually and whenever our practices or the law change. The date at the top of this page shows when it was last updated. Where changes are significant we will tell service users and their representatives directly.
17. How to contact us or complain
If you have any questions about this policy, want to exercise your rights or are unhappy about how we have handled your information, please contact our Registered Manager:
- Post: Data Protection, Joy Care Solutions Ltd, 2 Morello Close, Aylesbury, HP18 0WT
- Telephone: 01296 255581 or 07504 993 375 (mobile)
- Email: info@joycaresolutions.com
We will try to resolve any concern promptly. You also have the right to complain to the UK supervisory authority for data protection, the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF