At A Glance

When we refer to personal data in this notice, we mean information that can or has the potential to identify you as an individual.

We will collect and process personal data about you at the following stages:

Community Enquiry

During this stage, we rely on our ‘legitimate interests’ to process your personal data.

Community Visit

During this stage, we rely on our ‘legitimate interests’ to process your personal data.

Care Assessment

During this stage, we will rely on our ‘legitimate interests’ to process your personal data.

Care Agreement

During this stage, we will rely on ‘contractual necessity’ to process your personal data.

Resident Stage

During this stage, we will rely on ‘contractual necessity’ to process your personal data with the exception of data marked with a (#) below where we will rely on ‘legal obligation’.

Further Detailed Information

In the usual course of business, Handsale may disclose your personal data which will include health information as recorded below (to the extent necessary) to (i) its affiliates, and certain third-party processors Handsale has retained to perform services on its behalf and pursuant to its instructions.  This may include sharing with:

• Handsale Ltd and H&H Care Homes Ltd for the provision and delivery of services, IT application support, internal audit reviews and investigations, quality assurance, program monitoring, management reporting and other internal purposes
• Operating companies for internal audit, reviews, management information and reporting.  Full details of the operating companies can be found in the glossary
• business partners, suppliers and sub-contractors for the provision of the contracted services.
• organisations providing IT systems support and hosting in relation to the IT systems on which your information is stored.
• third party debt collectors for the purposes of debt collection.
• delivery companies for the purposes of transportation.
• third party service providers who perform services on our behalf based on our instructions, for instance, for the purposes of storage of information and confidential destruction.  We do not authorise these service providers to use or disclose the information except as necessary to perform services on our behalf or comply with applicable legal obligations.

Where a third-party data processor is used, we ensure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under Data Protection Laws.

Handsale may also disclose your personal data (ii) if it is required to do so by law or legal process, or (iii) in response to lawful requests from public authorities, including to meet national security, public interest or law enforcement requirements.  Handsale also reserves the right to transfer Personal Data in the event of an audit or if the company sells or transfers all or a portion of its business or assets (including in the event of a merger, acquisition, joint venture, reorganisation, dissolution or liquidation).

Sensitive personal data (including information relating to your health) will only be disclosed to third parties in accordance with this Privacy Notice. That includes third parties involved with your treatment or care, or in accordance with UK laws and guidelines of appropriate professional bodies.

Where applicable, it may be disclosed to any person or organisation who may be responsible for meeting your treatment and or care. It may also be provided to external service providers and regulatory bodies for the purpose of clinical audit to ensure the highest standards of care and record keeping are maintained.

Medical professionals working with us:  We may share clinical information about you with our medical professionals as we think necessary for your treatment and care.

External practitioners: If we refer you externally for treatment, we may share with the person or organisation that we refer you to, the clinical and administrative information we consider necessary for that referral.  It will always be clear when we do this.

Your GP:  If the practitioners treating you believe it to be clinically advisable, we may also share information about your treatment with your GP.

The NHS:  If you are required to attend hospital, we may share the details of your treatment with the part of the NHS, as necessary to perform further treatment and care.

Care home regulators:  We may be requested, and in some cases required, to share certain information (including personal data and sensitive personal data) about you and your care with regulators such as the CQC, Care Inspectorate and Care Inspectorate Wales.

From time to time we may also make information available on the basis of necessity for treatment, the provision of healthcare and payment.

In an emergency and if you are incapacitated, we may share your personal data (including sensitive personal data) to third parties on the basis of protecting your ‘vital interest’ (i.e. your life or your health).

We will use your personal data in order to monitor the outcome of any treatment associated with your care.

1.5    How we protect your personal data

We maintain appropriate technical and organisational measures designed to protect your personal data against loss or accidental, unlawful or unauthorised, alteration, access, disclosure or use.

1.6    Retention period

We retain personal information for as long as we reasonably require it for legal and business purposes. In determining data retention periods, Handsale also takes into consideration local laws, relevant regulations and contractual obligations.

1.7    Your rights as a data subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you. Handsale reserves the right to charge a reasonable fee based on our administration costs where further copies are requested.
• Right of rectification – you have the right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply you have the right to request that we restrict the processing.
• Right of portability – in certain circumstances you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing and profiling

All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

If you would like to exercise any of your data subject rights, please contact us using one of the methods highlighted below.

1.8    Contact information

Please contact us if you have any questions about our privacy notice or information we hold about you:

• By email at info [at] handsale.co.uk
• By writing to us at Data Protection Board, Handsale Ltd, 3^rd Floor Westbury House, 23-25 Bridge Street, Pinner, Middlesex, HA5 3HR

1.9    Complaints

In the event that you wish to make a complaint about how your personal data is being processed by us (or third parties as described in 1.3 & 1.4 above) please contact the data protection board at the address detailed above.

If you are not satisfied with how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority at the Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Tel 0303 123 1113 or 01625 5457

1.10    Personal data types & items

1.11    Use of cookies

We do not currently use cookies on this website.

1.12    Glossary

Consent

In certain circumstances, we are required to obtain your consent to the processing of your personal data in relation to certain activities.

Article 4 of the GDPR states that (opt-in) consent is “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” In plain language, this means that:

• you have to give us your consent freely;
• you have to know what you are consenting to;
• you should have choice over which processing activities you consent to and which you don’t; and
• you need to take positive and affirmative action in giving us your consent

We will keep records of the consents that we have received from you.

You have the right to withdraw your consent to these activities. You can do so at any time, and details of how to do so can be found above.

Contractual necessity

Article 6 of the GDPR states that we can process your data on the basis that such processing is necessary in order to enter into or perform a contract with you.

The “contractual performance” lawful basis permits the processing of personal data in two different scenarios:

• Situations in which processing is necessary for the performance of a contract to which you, the data subject, is a party. This may include, for example, processing your health details for the provision of residential care.

• Situations that take place prior to entering into a contract such as pre-contractual relations. For example, a formal review of the health confirmation collected during the care package assessment to determine the level of care required and the associated residential costs.

From the point at which contract negotiations commence and throughout your stay with us we will rely on contractual necessity as the lawful basis for the majority of personal data processing activities.

Compliance with legal obligations

Article 6 of the GDPR states that we can process your data on the basis that the we have a legal obligation to perform such processing.  Processing is permitted if it is necessary for compliance with a legal obligation.

Legitimate Interests

Article 6 of the GDPR states that we can process your data where it is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of you which require protection of personal data.

Operating Companies