UK social care services
This privacy notice sets out the data processing practices carried out through the activities of the UK care services of Leonard Cheshire.
We support individuals to live, learn and work as independently as they choose, whatever their ability. Led by people with experience of disability, we are at the heart of local life - opening doors to opportunity, choice and support in communities around the globe.
Our social care services do this through providing a range of social care services across the UK designed to support people towards greater independence.
Where Leonard Cheshire is the controller or joint controller of your data, it will be used and held in accordance with General Data Protection Regulation (GDPR) and the Data Protection Act (DPA) 2018. In some instances, we may be a processor of your data on behalf of a third party.
This privacy notice explains why we need personal information about our customers, how we will use it and the circumstances under which we will share it with others.
If you have any requests concerning your personal information or any queries with regard to these practices, please speak to your Service Manager. You can also contact our Information Governance Manager at firstname.lastname@example.org if you would prefer.
The purpose of processing
When we talk about 'purposes' this means the reasons why we collect information. Following a review of the reasons we process your data we have set out two purposes under which we process data about you.
Customer assessment and support
We process data about you in order to provide person-centred, safe and responsive care and support. There are a range of different processes which fall under this purpose:
- Managing referrals
- Preparing quotes, contracts and exceptions
- Needs assessment, care planning and review
- Monitoring health conditions
- Managing medication administration
- Safeguarding and critical incidents
- Dealing with complaints and appeals
- Supporting benefits and DWP claims
- Paying for third-party services
- Managing spending, transfers and payments
- Advocacy and legal guardianship
- Working with family and friends
- Managing visitors to services
- Changing of customer details
- Responding to legal enquiries
- Ending contracts
Quality and regulatory compliance
We process data about you in order to ensure our services are meeting the right standards. There are a range of different processes which fall under this purpose:
- Local service audits
- Service quality inspections
- Managing databases and quality information
- Performance reporting
- Managing data breaches
The legal basis for processing
To enable us to provide effective support, we will collect, store and process personal data about you. This may be to meet our obligations under a contract to you and directly with a service commissioner. The GDPR sets out a number of legal bases under which we are allowed to process your personal information. For the data we process about you we rely on three of these legal bases:
- Legal obligation - this applies to any processes where we are required by law to process your information.
- Contractual obligation - this applies to any processes where we are required by contract to process your information.
- Legitimate Interests - this applies to any processes where we have a clear reason and justification for processing your information. Currently this only applies to the use of CCTV and the retention of recordings.
In some cases, the need to store and share information about you will not be covered by any of the legal bases above. In these circumstances, we will obtain your consent unless there is any indication that you cannot provide this. In these circumstances we will:
- Ask a legally appointed person (e.g. with Power of Attorney) who can consent on your behalf.
- Where there is no legally appointed person, we will follow our policies and procedures relating to mental capacity.
If your capacity is known to fluctuate, we will gain consent from you when you are able to provide it. In periods when you are not able to consent, and we need to review or change your care and support arrangements, we will follow our policies and procedures relating to mental capacity and keep a record of this.
What data we need
The people we support are referred to us in a number of ways, and we need to collect personal and some special personal data in order to provide tailored and person-centred support. We collect information in the following ways via referrals to live in one of our services or stay for a short break:
- Self-referrals from individuals.
- Referrals from parents or carers.
- Referrals from third-party organisations, including the NHS, Local Health Boards, Local Authorities and joint commissioning groups.
- Referrals from partner organisations, housing associations, accessible housing registers, and other referral routes.
- Referrals from Leonard Cheshire care services and other Leonard Cheshire programmes.
We will contact you and as many people who hold information about you as possible to gather information on your needs to ensure we can meet these in the best way. At the centre of what we do, however, is ask you what outcomes you would like to achieve and what goals and aspirations you have for life.
Your personal information will include special category data, such as any health information you give us which is processed for health or social care purposes and based on Schedule 1, part 1, paragraph 2 of the DPA 2018.
We will ask for the following personal information:
- Phone number
- Mobile number
- NI number
- Housing situation
- If you have dependent children
- What type of support you need
- Benefits you are in receipt of
- Your health and care needs including how your disability affects you on a daily basis
- Your communication and accessibility requirements
- Other services and support you receive
We will also collect the following special category data:
- The nature of your disability
- Date of Birth
- Marital status
- Ethnic origin
- Sexual orientation
We may need further information from you or other people to ensure we understand your needs for us to support you.
Why we need the data and what we do with it
We need information about you in order to provide safe care and support in a way that best meets your needs and aspirations. We will use this information to complete a Person-Centred Care Plan (PCP) with you.
The data you provide will be shared with others involved in providing care and support. This will include:
- Staff at the service you are being supported by.
- Senior Managers responsible for managing the service.
- External professionals involved in your care and support.
There will be a range of other people who may, from time to time, have access to the data you provide as part of their role in checking the quality of the service we provide. These include:
- Clinical, quality and safeguarding support from Leonard Cheshire who provide internal inspections and audits of our services.
- Other Leonard Cheshire staff engaged in supporting services to meet their required standards.
Commissioners or other Local or Health Authority staff who have a duty to monitor contracts or investigate concerns or complaints.
Inspectors from the national care regulator, who have a statutory duty to inspect services.
Inspectors from Local or Health Authority Commissioners, who have a contractual duty to inspect services.
How long we keep the data
We only process and store your data for the time period specified in our retention schedule (PDF). More information on the retention schedule is available from the Service Manager for your service.
Do we use any data processors?
Data processors are other organisations that process your data on our behalf. We have no data processors that are involved in all our services. However, each service will have a list of organisations that it commissions locally. The Service Manager will be able to tell you if there are any data processors linked to the service supporting you.
Do we make any overseas transfers?
No. All our services operate and store data in the UK.
Do we use any automated decision-making including profiling?
No automated decision-making including profiling is being used for this purpose.