Privacy Policy

Scope and overview

This privacy notice is issued on behalf of the Acacium Group and all its group companies. A full list of our group companies and their trading names can be found on our website: acaciumgroup.com/our-brands/ all reference to the Acacium Group refers to these companies. If you require a printed copy of this privacy notice or our group companies, please contact us using the details below.

When we mention "we", "us" or "our" in this privacy notice, we are referring to any company in the Acacium Group that uses your personal data.

The controller for your personal data is Independent Clinical Services Limited, trading as Thornbury community services.

This privacy notice applies to you when any of your information is supplied to us by the commissioner of your care or by yourself or a family member/guardian. This could be online enquiry through our website or a direct phone email enquiry into providing a care package.

Please contact us using the details below if you have any questions about this privacy notice or personal data we hold about you:

Email us at dpo@acaciumgroup.com

Write to us at:

Data Protection Officer

Acacium Group

9 Appold Street

London

EC2A 2AP

If you have any concerns about the personal data we use about you, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, by contacting them at www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please feel free to contact us in the first instance.

We regularly review this privacy notice and will update it where necessary. We do recommend you regularly review this privacy notice to make sure you have the most up to date information. This privacy notice was last updated on 28 November 2021

	Via their website: www.ico.org.uk
	Call them on: 0303 123 1113

We review and update this statement regularly; this version was written on 1/12/21

What does this privacy notice cover?

It covers the information that we obtain when providing you with care. It allows us to ensure that we send the right people to care for you, and that we plan the right support to meet your needs. This information covers all venues that we are commissioned to provide care or send staff to provide care.

In 2018, the government issued a new version of a law called the Data Protection Act (DPA) which tells businesses how to safely use and look after your information.

We are committed to ensuring that your privacy is protected. If you provide us with personal data, you can be assured that it will only be used in accordance with this privacy notice.

What is the lawful basis for using your personal data?

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data for purposes below. These are commonly called the lawful basis for processing.

Legitimate interests: processing is necessary for the purpose of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. This means we use the information you provided to deliver care to you. We may also share your information with other relevant people who support us in delivering your care. This could be your GP or Social Worker. However, we need to consider your rights and ensure they are protected.

Compliance with the law: this means that we must process your information to demonstrate compliance with our regulatory framework and the law.

Processing is necessary for the provision of a health or social care service: this means that we can process the information that is necessary in order that we can safely provide support to you.

When we provide care for you, we will need to process information relating to your health. This is often referred to as “special category” data. Such data requires a higher level of protection and the law says that we must comply with additional requirements. The special category data we collect is in italics in the table below.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose in this privacy notice.

Please note you will not be subject to any automated decision making.

The table below shows you what information we will use and why.

Personal data we obtain	Purpose for processing	Why we use this information
Basic contact details: Full legal name DOB NHS number Telephone number Address Home number Mobile number	To provide safe care for you To let us know how to contact you To communicate and manage our relationship with you To confirm your identity when we speak with other relevant teams about the care we provide you If you fund your own care we will require financial information which would include a credit check.	Legitimate Interest
Sex Ethnicity Religion	To ensure the care package we provide is in keeping with any personal preferences and practises To provide safe personal care	Legitimate interest Processing is necessary for the provision of a health or social care service
Next of Kin details	To contact someone in the event of an emergency	Legitimate Interest.
Details of Clinical condition and medical history Details of assessments from other relevant health professionals Name of GP Practice Name of Hospital/Department Clinic/hospital/GP Code/NHS number Details of care and support provided by us Details of any court orders that will impact delivery of care and support Details of previous and current medication and equipment Referrers: Telephone No Address Email Clinician	To ensure that we can undertake a full clinical assessment To be able to communicate directly with the commissioner of care and MDT in the interest of your/our clients clinical safety To communicate directly in the event of an urgent or emergency finding To ensure we are able to compile a comprehensive Care plan to deliver safe and effective care in the community setting.	Compliance with law Legitimate interest Processing is necessary for the provision of a health or social care service
Details of your diet, routine, likes and dislikes	To ensure the care you receive fits in with your lifestyle To allow you choice in your daily routine To make sure you have the food and drink you like and to keep you healthy. To give you choice	Compliance with law Legitimate interest Processing is necessary for the provision of a health or social care service
Opinions and evaluations of the service that we have provided through routine satisfaction surveys	To enable us to provide a service that meets the individual’s needs and to address any concerns and improve our service	Legitimate Interests
Communication Any complaints on the service provided via email, letter or verbally Any incidents determined	Investigate or prevent any complaints or incidents raised	Compliance with law
	To carry out or assist with any legal or regulatory investigation	Compliance with law
Car insurance information and MOT	Only required if we drive your car	Legitimate Interests

When do you have to provide us with information?

As we are providing care to you, you may be required to provide specific information before we supply that care, in order for us to ensure we can support you in a safe and appropriate way.

Will you use any additional information about me when you provide healthcare services?

When we provide you with care, it may be necessary for us to obtain further information about you from others, to make sure your care and support are appropriate. We have set out below, details of the sources that we will use to obtain this information:

Our workers that care for you – we will need to ask our workers for information relating to the care that they have provided to you and any concerns that relates to your health and wellbeing. This will be documented in your care records.
Other healthcare professionals – we may need to obtain information that will assist us to deliver the best care for you. This could be from a speech and language therapist, psychologist, occupational therapist of other professional that is supporting you.
Professional agencies – we may need to get information from other professional agencies such as social services, where this is necessary to provide support to you.

Why is your personal data shared across the Acacium Group of companies?

The personal data that you provide will be shared within ACACIUM Group, to enable us to provide our services to you, for example the resourcing of workers. We will also share your personal data across Acacium Group to ensure that our legal and regulatory obligations are achieved. The data that is shared will be kept to the minimum needed for the purpose and where possible it will be anonymized or pseudonymized.

Examples of data shared within Acacium Group include:

Shift dates and times with finance teams – to enable workers to be paid and for Acacium to Bill for their services.
Incidents and complaints details to be shared with Clinical Governance teams – in order that they can provide independent oversight and expertise.
Out of Hours team – access will be granted to operationally required data to enable to the out of hours team to support at evenings and weekends.
Management reporting – anonymized and pseudonymized data is used for management reporting.

Will we share your data with third parties?

We will share your personal data with the below third parties when required to do so, this will be limited to necessary information:

The commissioner for your care;
Anyone cited in a court order or if someone has been designated as Legal Power of Attorney;
Our professional advisors;
Local Authorities such as your social worker;
Any educational settings you may attend;
People who are in charge of or involved in your care ie- GP, District Nurses, Consultants;
Approved Secondary suppliers: Limited information would be provided to our approved secondary providers should we not be able to fill a shift with our own staff. We would never supply secondary agency staff without seeking prior agreement from yourself and whoever funds your care;
Organisations who regulate us;
Third parties who provide services or online platforms
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

We require all third parties to respect the security of your personal data and to treat it in accordance with data protection laws. Where we share your personal data with third parties who provide operational services to us, we only permit them to process your personal data for specified purposes in accordance with our instructions.

How long do we keep your personal data for?

We will only keep your personal data for as long as is necessary for the purposes for which it was collected. In order to determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of your personal data. We will also consider legal and regulatory requirements. Under the Record Management Code of Practice for Health and Social Care 2021 we will keep your data for different lengths depending on your age, when we supplied care to you and other factors as set out under this code.

If you are referred to us, and we receive personal data about you, but we do not provide a service of care and support to you, we will delete your data within 6 months of the decision for us not to provide care to you has been made.

Will we transfer your data outside of the country?

Pulse Nursing at Home is based in the UK and your data is processed and stored in the UK.

In the unlikely event that we are required to send your information outside of the EEA we will always ensure that we have adequate safeguards in place in order to ensure a similar degree of protection is afforded by ensuring legal safeguards, and appropriate technical and organizational measures are in place.

Adequate safeguards –

Transfer of data only to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission
Specific contracts approved by the European Commission which give similar level of protection, alongside transfer impact assessments and review of individual rights.

If you would like further information about the methods used to transfer personal data outside of the EEA, please contact us at dpo@acaciumgroup.com

Your data may be transferred outside of the UK at your request, for example if you wish to take a trip abroad, in this case sometimes we may have to notify local hospitals or agencies to ensure your safety whilst away.

How do we safeguard your personal data?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, altered, disclosed, used or accessed in an unauthorised way.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

In addition, we limit access to your personal data to only those who have a business need to know, they will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

How will your data be used for marketing?

As a service user, we will occasionally send you information we feel would be of interest to you or to provide current advice we feel is pertinent.

The types of communication we may send you will include information about:

Thornbury Community Services resources and updates to the service;
Programme surveys and questionnaires;

We appreciate you may not want to receive this information and whilst we’d hate for you to miss out, you can opt out by:

Clicking on the unsubscribe link at the bottom of any marketing emails we send you; or
Emailing us at dpo@acaciumgroup.com.

Please note that legal and service updates relating to your package of care are not direct marketing and cannot not be opted out of, however, you may be able to opt for a different method of communication for these, please contact your operational team for details.

We endeavor to respond to your request to stop marketing as soon as possible but this can take up to 28 days to action. Whilst we work on your request, there is a small chance you may still receive some marketing communication.

What are my rights in relation to my information?

You have a number of rights in relation to how we use your information, these are explained in the table below:

Your Rights	Explanation
Your right to request access to your personal information	You have the right to know that we are using your information and who we are sharing it with.
You have the right to request that any inaccurate data is amended	You have the right to tell us if your information is inaccurate and for it to be changed.
You have the right to ask for your information to be deleted	You have the right to ask for your information to be deleted – this does not include all your information. Please ask if you have any further questions.
You have the right to request restrictions in the processing of your information	You can ask us to stop processing your data if you have concerns that it is being processed outside the law.
You have the right to have your information sent to another organisation	You have the right to ask us to transfer your information to another organisation, this does not apply to all your information. Please ask if you have any further questions
You have the right to object to the processing of your information	You can inform us of any concerns you have regarding the processing of your data and you have the right to discuss this with us.
Your right to request restriction of processing of your personal data	This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the personal data is unlawful but you do not want us to erase it; (c) where you need us to hold the personal data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your personal data but we need to verify whether we have overriding legitimate grounds to use it.
Your right to withdraw consent	This right arises at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide our services to you. We will advise you if this is the case at the time you withdraw your consent.
Your right to Portability	You have the right to ask that we transfer the personal data that you gave us to another organization, or to you, in certain circumstances.

How do I exercise my rights?

If you are under the age of 13 all the above rights still apply to you – your parents or guardians who have parental rights, can exercise these rights on your behalf.

If you would like to exercise any of these rights, please email us at dpo@acaciumgroup.com. In most cases we will deal with your request as soon as possible, and at the latest, within one calendar month of your request. If we need more time, we will inform you of this.

Please note that we do not charge for any such requests unless there are exceptional circumstances.