PRIVACY NOTICE

What is a privacy notice?
The Data Protection (Jersey) Law 2018 requires that data controllers provide certain information to people whose information (personal data) they hold and use. A privacy notice is one way of providing this information.

Information about us
The Care Hub Jersey Ltd
50 Don Street
St Helier
JE2 4TR

Data Protection Officer:
Claire Hudson
claire@carehub.je
07700706940

We are regulated with the Jersey Care Commission.

What does this notice cover?
This notice explains how we use your personal data: how it is collected, how it is held and how it is processed. It also explains your rights under the law relating to your personal data.

What is personal data?
Personal data is defined as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

What are my rights?
Under data protection law, you have rights including:

• Your right of access
• You have the right to ask us for copies of your personal information
• Your right to rectification
• You have the right to ask us to rectify information you think is inaccurate.
• You also have the right to ask us to complete information you think is incomplete

Your right to erasure
You have the right to as us to erase your personal information in certain circumstances

Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain
circumstances

Your right to object to processing
You have the right to object to the processing of your personal data in certain circumstances

Your right to data portability
You have the right to ask that we transfer the information you gave us to another
organisation, or to you, in certain circumstances

In some instances, if you refuse to provide us with certain information when requested, we
may not be able to perform the contract we have entered into with you.

What personal data do you collect?
We may collect some or all of the following personal data (this may vary according to the service that we provide to you):

• Basic personal information, including name and address, date of birth and contact
  details
• Information about you and your family (such as dependents, marital status, next of
  kin and contact details)
• Information about your preferences and interests
• Visual images
• Details of any services you have received from us
• Information we receive from other sources, such as government departments (Long
  Term Care/Health and Community Services) and other health care professionals –
  GP’s, OT’s District Nurses
• Our correspondence and communications with you

Clients – as a care provider, we must collect some personal information about our clients, including personal health information, which is essential to us being able to provide effective care and support.

The information is contained in electronic files and on our recording systems, all of which are subject to strict security and authorised access.

Employees – the organisation operates a recruitment policy to comply with the regulations in which all personal information obtained, including CVs and references, is, as with client information, securely kept, retained and disposed of in line with the Data Protection (Jersey) Law 2018. All employees are aware of their right to access any information about them.

Third parties – all personal information obtained about others associated with the delivery of the care service, including contractors and suppliers will be protected in the same way as information on clients and employees.

We may also process certain categories of information for specific and limited purposes,
such as making our services accessible to clients. We will only process special categories of
information where we have obtained your explicit consent or are otherwise lawfully
permitted to do. This may include:

• Information about racial or ethnic origin, religious, political or philosophical beliefs
• Physical or psychological health details or medical conditions

How we collect information
The bulk of client, employees and third parties personal information is collected directly from them or through form filling, mainly manually, but also electronically for some purposes, eg when contacting the service through its website.

With clients, we might continue to build on the information provided through assessments, reviews and in the process of agreeing care.

With employees, personal information is obtained directly and with consent through such means as references, testimonials and criminal records (DBS) checks. When recruiting staff, we seek applicants’ explicit consent to obtain all the information needed for us to decide to employ them.

How do you use my personal data?
Under the Data Protection (Jersey) Law 2014, we must have a lawful basis for using personal data. This may be because the data is necessary for our performance of an agreement with you, because you have consented to our use of your personal data, or because it is in our legitimate business interests to use it. Your personal data may be used for any of the
following purposes:

• providing and managing your account;
• supplying our services to you. Your personal details are required in order for us to enter into a contract with you;
• personalising and tailoring our services for you;
• communicating with you. This may include responding to emails or calls from you;
• supplying you with information by email AND/OR post that you have opted-in to (you may unsubscribe or opt-out at any time by contacting us);

With your permission and/or where permitted by law, we may also use your personal data for marketing purposes, which may include contacting you by email/telephone/text message and post with information, news, and offers on our products and services. You will not be sent any unlawful marketing or spam.

How long will you keep my personal data?
Personal information that becomes inactive for any reason is kept securely only for as long as it is needed, before being safely disposed of.

We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Your personal data will therefore be kept for the following periods (or, where there is no fixed period, the following factors will be used to determine how long it is kept):

• basic information – 10 years. We may anonymise or pseudonymise the personal data so that it can no longer be associated with you, in which case we may use it without further notice to you
• financial information – 6 years
• medical information – 3 years from discharge
• sensitive information – 3 years from discharge

How are where to you store or transfer my personal data?
The security of your personal data is essential to us, and to protect your data, we take a number of important measures, including the following:

• necessary technical measures to ensure personal data is protected;
• all data transferred is encrypted during transit and at its destination;
• data is not processed for any purpose other than as agreed upon in our terms and
  conditions;
• protect your data from loss;

Our website and databases are regularly checked by experts to ensure they meet all privacy standards, are protected through strong passwords and encryption and comply with our general data protection security and protection policies.

Do you share my personal data?
We only share the personal information of clients, employees and others with their consent on a “need to know” basis, observing strict protocols in doing so. Most information sharing of clients information is with other professionals and agencies involved with their care and treatment.

Likewise, we would not disclose information about our employees without their clear agreement, eg when providing a reference.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

Where we provide information for statistical purposes, the information is aggregated and provided anonymously so that there is no privacy risk involved in its use.

If any of your personal data is required by a third party, as described above, we will take
steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.

How can I access my personal data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email or postal
address shown above. To make this as easy as possible for you, a Subject Access Request Form is available for you to use. You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.

We will respond to your subject access request within 14 days and, in any case, not more than one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

Changes to this Privacy Notice
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if We change our business in a way that affects personal data protection.