CABRINI HOUSE PRIVACY NOTICE

Cabrini House is part of the Diagrama Foundation. As a provider of residential care services it is a controller and a processor of personal and sensitive information. Please be aware that we treat all personal information with the utmost care and attention. We always act in accordance with the laws, only keep what is necessary for performing our functions and will never share your data unless: we are legally obliged to; it is essential to provide you with a service; or you have consented for us to do so.

The purpose of this policy is to give you a clear explanation about how and why we collect and use the personal information you provide to us, according to the different relationships you may have with us.

Sensitive personal data about health, sexual life, race, religion and criminal activity may be collected and will be considered as special category data, which is subject to stringent security and confidentiality measures. In addition to having a lawful basis for holding that information, which we set out below, we hold it because we must process it for the purpose of providing and managing a social care service.

Please know that Diagrama will never sell your personal information to a third party.

As a residential care provider we are governed by many different areas of legislation, including:

  • Health and Social Care Act 2008 (Regulated Activities) Regulations 2014
  • Care Quality Commission (Registration ) regulations 2009
  • Data Protection Act 2018
  • Mental Health Act 1983 as amended by the Mental Health Act 2007

Where legislation requires, we will be obliged to retain personal and or sensitive information for the prescribed amount of time. Please refer to our retention of records policy schedule for further information, which can be made available upon request.

Data Protection regulations ensure we do not keep personal data longer than we should and that we handle data with the respect and care it deserves. If you have any queries about this policy or personal information that we may hold, please contact:

Residential Manager, Cabrini House, 3a Healy Drive, Orpington, Kent BR6 9LB. Tel 01689 891401.

Alternatively you can contact our Head of Human Resources, who has overall responsibility for data protection at:

Diagrama Foundation, Floor 5, Anchorage House, 47-67 High Street, Chatham, Kent ME4 4EE. Email: hr@diagrama.org

Below we have outlined the various different parties whose information we process. Use the links below to pick the role specific to your position for the most relevant section of the privacy statement.

VISITORS TO OUR WEBSITE:

We collect and process the following information on the basis of your consent, obtained when you complete the enquiry form:

  1. Contact details and other information which may be volunteered through our enquiry forms. We retain this information as long as is necessary in order to manage the enquiry effectively at this stage, in accordance with our Retention of Records policy.
  2. Anonymised insights into visitor numbers and trends via Google analytics - this tool measures traffic on our site and may be used to inform our recruitment activities.

Please read the section towards the end of this document which details an individual’s right to access the information we may hold about them and their rights to withdraw consent and have their data erased.

This policy doesn’t cover links to third party websites. We encourage our website visitors to read the privacy statements on other websites visited via Diagrama websites.

INITIAL ENQUIRIES

When we receive an enquiry about a place at Cabrini House from an individual we do not record information at this stage other than basic contact details. We will then refer the enquirer onto their social services department, who will manage the enquiry and assessment process on their behalf.

For enquiries received from local authorities, we will receive a pen picture of the prospective resident – a sanitised, usually anonymous, file which provides a variety of information, some of which may be of a personal nature.

The pen picture may include:

  • Full contact details
  • Basic medical history
  • Brief family history

We have a legitimate interest in using this information to

  • Manage the enquiry and update on progress
  • Deliver support throughout the initial enquiry process
  • Provide information about our services
  • Inform our marketing activities

Sharing of information

Due to the nature of our work we may have to discuss elements of the prospective resident’s personal information with the referring authority. We will not discuss personal information with anyone outside of the enquiry, unless the applicant has given us prior written authorisation to do so or unless we are legally obliged to do so.

Retention of data

Should the enquiry be withdrawn by either party, this information will be destroyed within 1 month of date of withdrawal.

However, we appreciate the need for some enquirers to take time to consider the decision of a residential placement. Therefore, if the enquiry is not withdrawn we retain this information until a decision is made to allow time to take your enquiry forward.

Please read the section towards the end of this document which details your right to access the information we may hold about you, your right to object to processing and have your data erased, if applicable.

PROSPECTIVE RESIDENTS

When a decision is made to consider a placement at Cabrini House we collect and process information about the prospective resident which includes but may not be limited to:

  • Medical history - including any medication
  • Physical capabilities
  • Details of any advocates/appointees/power of attorney
  • Next of kin
  • Date of birth

We are obliged by law Health & Social Care Act to use this information to:

  • Manage the assessment
  • Ensure Cabrini House can fully meet the needs of the prospective resident.
  • Ensure Cabrini House can fully meet the needs of the existing residents.

We also have a legitimate interest in using this information to:

  • Update the applicant (parents or local authority) on progress
  • Provide the applicant with updates on our service, including information about support, activities, events and our wider organisation.

Unless we advise the applicant otherwise, we’ll only collect and process personal information to carry out these functions.

How we store personal information

The prospective resident’s personal information is stored on our secure computer systems which comply with the relevant security standards. Any paper documentation is digitised and stored in this system with the originals being destroyed or returned to you. Phone conversations are not recorded but are noted on their personal file.

We encourage the applicant to inform us of any changes needed to ensure these details are accurate and up to date.

Sharing of information

Due to the nature of our work we may have to discuss elements of the prospective resident’s personal information with the funding authority, who will have asked us to carry out the initial assessment. We will not discuss their personal information with anyone outside of the assessment, unless the applicant has given us prior written authorisation to do so or unless we are legally obliged to do so.

Retention of data

The prospective resident’s personal data is kept on file until a decision is made

  • In the event an assessment does not result in approval/or is withdrawn the prospective resident’s information is destroyed
  • In the event that a placement is no longer available, the prospective resident’s information will be destroyed.

Please read the section towards the end of this document which details the prospective resident’s right to access the information we may hold about the prospective resident and any rights to object to processing, if applicable.

RESIDENTS

When a placement is accepted for a new resident, in addition to the information collected earlier in the assessment process (detailed above) we may also collect:

  • Photos and certificates, records of achievements from previous placement
  • Risk assessments
  • Photographic evidence of their time at Cabrini House
  • Ongoing health history and hospital correspondence
  • Deprivation of liberty requests
  • Family background
  • In depth information on their likes/dislikes/capabilities/development
  • Next of kin details
  • Finance details
  • Appointee details

We are legally obliged in accordance with the Health & Social Care Act to collect, process and share this information to:

  • Manage the transition and settlement process.
  • Deliver care and support to all residents.
  • Provide information about our performance and services to CQC and local authority.
  • Ensure Cabrini House can fully meet the needs of all residents

We have a legitimate interest in using this information to:

  • Produce a personal profile of the incoming resident, which may contain some personal data, to aid a smooth settling-in period, which is shared with staff. The information included on the profile will be discussed and agreed with the incoming resident, if the resident does not have the capacity to understand or give consent then this will fall to their parents or advocate prior to being shared.

We seek the resident’s, appointee’s and parents’ consent to use the following information for marketing purposes including newsletters, advertising and publicity materials.

  • Names
  • Brief case history where relevant (for example where we may wish to demonstrate the positive impact our work has had on an individual)
  • Photographs/video
  • Verbal and written feedback

How we store personal information

Personal information is stored in written care plans which are kept secure in the staff office and can only be accessed by the client the information pertains to and the support workers who care for the client. Phone conversations are not recorded but are noted on personal files.

We are committed to keeping personal details up to date and encourage advocate/parents/next of kin to inform us of any changes needed to ensure these details are accurate.

Sharing of information

This information will only be shared with relevant agencies and third parties in connection with the resident’s care and always in accordance with appropriate legislation.

We will not share a resident’s personal information with any other third party without prior authorisation to do so, unless we have a legal obligation to eg. where there may be a safeguarding risk.

Retention of data

'Residents’ personal data is retained in line with the Records Management Code of Practice for Health and Social Care 2016 (Information Governance Alliance and Department of Health).

  • In the event a resident moves out, a copy of the records will be passed on with them. Cabrini House will retain a copy for 20 years if the service user was accommodated under the Mental Health Act; 8 years if accommodated for safeguarding/adult protection reasons, in accordance with CQC guidance.
  • In the event of a resident’s death records will be kept for 8 years after date of death if resident was accommodated under the Mental Health Act, otherwise for 2 years after date of death, in accordance with CQC guidance.

Please refer to our Retention of Records policy for further details. Please read the section towards the end of this document which details rights to access the information we may hold, rights to withdraw consent and/or object to processing, in some instances.

STAFF AND AGENCY WORKERS

please refer to Diagrama’s Employee Privacy Notice for further information.

RELATIVES

Please be aware that Cabrini House has a legal obligation to the resident and not the resident’s family unless they have power of attorney. The family information is held within the resident’s files, within the resident’s care plan. Information we store may include:

  • Parental information and relevant family information such as birthdays, relationships to family members etc
  • Address and telephone number
  • Details of who to contact in the event of an emergency.

We have a legal obligation to use this information to:

  • Contact someone in an emergency
  • To manage the service, in accordance with regulations
  • Conduct surveys in order to monitor and improve our services

We have a legitimate interest in using this information to:

  • Document the resident’s time with us so they have a detailed record for future reference
  • Deliver support to the resident regarding their placement, for example, helping them to remember significant dates, birthdays etc

We’ll only collect and process personal information to carry out these functions. If relatives ever wish to view the information collected and stored by us they can do so by contacting Cabrini House.

How we store personal information

Personal information is stored in the client’s care plan.

Sharing of information

We are obliged from time to time under the Health & Social Care Act 2008 (Regulated Activities) Regulations 2014 to share relatives’ information with key agency partners such as local authorities, police, legal and health professionals. This information is held as part of the resident’s records and to ensure their placement is as positive as possible and in line with regulations.

Retention of data

Personal data is kept on file for as long as the client is in our care. Any information on family members will therefore remain within the resident’s file and retained for up to 20 years (for service users under the Mental Health Act) or 8 years (for service users under safeguarding/adult protection) after they have ceased to be a resident of Cabrini House.

Please read the section towards the end of this document which details your right to access the information we may hold about you and to object to processing, in some instances.

VISITORS

We are legally obliged to collect information from any visitors to Cabrini House in order to safeguard our residents, in accordance with the Health & Social care Act 2008 (Regulated Activities) Regulations 2014

Information we store may include:

  • Name and reason for visit
  • Photographs/video of their visit, for example at celebrations and events

We have a legal obligation under Health and Social Care Act Regulations to use this information to:

  • Make sure the resident is looked after in a safe and secure home
  • Document the resident’s time with us in their daily diary so they have a detailed record for future reference
  • Safeguard all the residents we look after
  • Provide information about our performance and services to the local authority so they can maintain their own records alongside our own.

We have a legitimate interest in using this information to:

  • Make sure we are providing the best possible service to the resident, for example by using photographs and video to reminisce over past events with residents.

We seek visitors’ consent to use this information for marketing purposes including newsletters, advertising and publicity materials.

How we store personal information:

Visitor information is stored in our log books, recorded in residents’ daily diaries if relevant to that individual, or kept on our secure systems.

Sharing of information

We are obliged from time to time to share visitors’ information with key agency partners such as local authorities, police, legal and health professionals. This information is held to ensure residents’ placements are as positive as possible and in line with regulations.

Retention of data

  • Personal data is kept on our visitor logs for 6 years, in accordance with CQC guidance.
  • Any records of visitors relevant to residents will be kept as part of the resident’s case file for 4 years after last entry, in accordance with CQC guidance.

Please refer to our Retention of Records policy for further details. Please read the section towards the end of this document which details your right to access the information we may hold about you and to object to processing, or to withdraw your consent in some instances.

FUNDRAISERS AND DONORS

If you choose to support us, for example make a donation or register to fundraise we may collect:

  • Your name
  • Your contact details
  • Your date of birth
  • Your bank or credit card details.

We have a legal obligation to use this information to:

  • Comply with fundraising regulations, including Gift Aid laws
  • To detect and reduce fraud and credit risk.

We have a legitimate interest in using this information to:

  • Provide you with the services or information you asked for
  • Administer your donation or support your fundraising, including processing gift aid
  • Keep a record of your relationship with us
  • Ensure we know how you prefer to be contacted
  • Understand how we can improve our services, products or information.
  • Let you know about the progress we are making

If relevant and appropriate we may also record:

  • Information relating to your health (for example if you are taking part in a high risk event)
  • Why you have decided to donate to us. We will never make this question mandatory, and only want to know the answer if you are comfortable telling us.

We will seek your consent to use your information to

  • Ask for future donations or other support.
  • Occasionally, we may include information from partner organisations or organisations who support us in these communications.

We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing.

Sharing of information

If we run an event in partnership with another named organisation your details may need to be shared. We will be very clear what will happen to your data if you register for an event where this may happen.

Some people choose to tell us about their experiences to help further our work. They may take on a role as an ambassador or media volunteer or attend our support-focused events. This may include them sharing sensitive information related to their family life in addition to their biographical and contact information. Please be aware that we will only share your information in these circumstances if we have your consent to do so.

How we store personal information

Your personal information is stored on our secure computer systems which comply with the relevant security standards. Any paper documentation is digitised and stored in this system with the originals being destroyed.

Retention of data

We are legally obliged to keep donation and fundraising records for 6 years in accordance with HMRC guidance.

RIGHTS TO ACCESS YOUR DATA

You have a right at any time to ask us what personal information we hold about you and you can request a copy of your information. This is known as a ‘subject access request’ (SAR). SARs need to be made in writing and we ask that a written request is accompanied by proof of identify. We have one calendar month within which to provide the information requested. Certain exemptions apply. Clients can access the data held in their care plan at anytime, as they have ownership of the care plan and the information contained within it is to support them in the care they are given.

If you need us to correct any mistakes in the information we hold about you, please let us know. In the meantime you have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

  • You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy). During the assessment you will be the source of information and the information should always be accurate.
  • You challenge whether we have a legitimate interest in using the information – During the course of an assessment all information gathered will be of a legitimate interest.
  • If the processing is a breach of the Data Protection Act 2018 or otherwise unlawful
  • If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.
  • If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

RIGHTS TO OBJECT TO PROCESSING. TO WITHDRAW CONSENT AND TO HAVE YOUR DATA ERASED

You do not have the right to object to processing or to have your data erased where we are legally obliged to hold and process your data.

Where we process your data solely on the basis of your consent, you have the right to withdraw your consent for that processing. You can do this by contacting:

Residential Manager, Cabrini House, 3a Healy Drive, Orpington, Kent BR6 9LB. Tel 01689 891401.

You may also have the right to have that data erased (for example where it is solely held and processed with your consent).

Where we process your data because we believe we have a legitimate interest to do so, you have the right to object to this processing. In that case, we will stop using the information unless we can demonstrate a compelling legitimate reason for the processing, which overrides your interests and rights, or where the processing is necessary for us or someone else to bring or defend legal claims.

Please be aware that any objection to processing may end your association with Diagrama in some circumstances.

RIGHT TO DATA PORTABILITY

Please note that rights to data portability do not apply to this service as Cabrini House does not collect your personal data through an automated process.

FURTHER INFORMATION

Privacy notices are long and complicated documents and may not provide detail on all aspects of Cabrini House’s collection and use of personal information. We’re happy to provide any further information or explanation needed. Please contact using the information at the top of this notice.

COMPLAINTS

Cabrini House tries to meet the highest standards when collecting and using personal information. We take any complaints we receive seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading, inaccurate or inappropriate. You can do so by contacting our Head of Human Resources who has responsibility for data protection matters at:

Diagrama Foundation, Floor 5, Anchorage House, 47-67 High Street, Chatham, Kent ME4 4EE. Email: hr@diagrama.org

If you remain unhappy with our response to your complaint you have the right to complain to the Information Commissioners Office by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire<br/SK9 5AF

Changes to this privacy notice

We keep our privacy notice under regular review. We’ll update if we undertake any new or amended processing. This privacy notice was last updated on: 06/08/2018