Privacy Notice

Draft for review by a qualified data-protection adviser or solicitor before publishing. Items in [brackets] must be confirmed by AddiCare.

1. Who we are

Addi Care Services Ltd ("AddiCare", "we") is the data controller for the personal data described in this notice. Registered office: Office 1F2, 1st Floor, Penmore House, Hasland Road, Chesterfield, Derbyshire S41 0SJ. Company registration number: [CONFIRM]. ICO registration number: [CONFIRM]. We are registered with the Care Quality Commission to provide personal care.

2. The data we collect

• Enquiry data: your name, phone number, email address, postcode, who needs care, and what you tell us about care needs and preferences.
• Client data (if care begins): assessment and care-plan information, health and support needs, next-of-kin and contact details, visit records, and billing information.
• Applicant data: your name, contact details, availability, experience, qualifications, driving status where relevant, your CV and anything else in your application.
• Website data: limited technical data from strictly necessary cookies and our form-protection measures (such as your IP address, used only to prevent abuse). See our Cookie Information.

Information about health or care needs is special-category data and is treated with extra care.

3. How we collect it

Directly from you (our website forms, phone, email or in person); from a family member or professional enquiring on your behalf; from health and social care professionals involved in your care; and automatically through strictly necessary website cookies.

4. Why we use it and our lawful basis

• Responding to care enquiries and arranging an assessment: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)). Where you share health information at enquiry stage, we rely on your explicit consent (Article 9(2)(a)), which you give by ticking the consent box on our form and can withdraw at any time.
• Providing care: performance of our contract with you (Article 6(1)(b)) and our legal obligations as a CQC-registered provider (Article 6(1)(c)). Health data is processed for the provision of health or social care (Article 9(2)(h)) under the responsibility of staff bound by a duty of confidentiality, and for our regulatory obligations.
• Enquiries made on behalf of someone else: we ask the person enquiring to confirm they are able to share the information. We will speak with the person who needs care, or their lawful representative, before any care begins.
• Recruitment: taking steps at your request before entering into an employment contract (Article 6(1)(b)), our legal obligations such as right-to-work and safeguarding checks (Article 6(1)(c)), and our legitimate interest in recruiting suitable staff (Article 6(1)(f)). Vetting documents are requested only at the appropriate later stage.
• Running and securing the website, and preventing spam: our legitimate interests (Article 6(1)(f)).

5. Who we share it with

Only where necessary: our care management and rostering system [CONFIRM provider]; our email and website hosting providers; our IT support; health and social care professionals involved in your care; the Care Quality Commission, local authorities and other bodies where the law requires; and our professional advisers. We do not sell your data and we do not use it for marketing without your consent.

6. How long we keep it

• Enquiries that do not lead to care: [CONFIRM, suggested 12 months], then deleted.
• Client care records: in line with regulatory requirements for adult social care records [CONFIRM period, commonly 8 years from the end of care].
• Unsuccessful job applications: [CONFIRM, suggested 6 months], then deleted. Successful applicants' data becomes part of their employment record.
• Website form-protection logs: up to 30 days.

7. Keeping your data safe

Access is restricted to staff who need it to do their job. Website enquiries are sent over an encrypted connection to a dedicated care inbox, and job applications to a separate recruitment inbox, and are then transferred to our secure care or recruitment systems and removed from email in line with our retention policy [CONFIRM process]. Staff are trained in confidentiality.

8. International transfers

Our data is stored in the UK or the European Economic Area. Where a provider stores data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement [CONFIRM providers and safeguards].

9. Your rights

You have the right to access your personal data; to have inaccurate data corrected; to have data erased in certain circumstances; to restrict or object to processing; to data portability; and to withdraw consent at any time where consent is our basis. To exercise any right, contact us using the details below. We will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Contact

Data protection contact: [CONFIRM name or role], Addi Care Services Ltd, Office 1F2, 1st Floor, Penmore House, Hasland Road, Chesterfield S41 0SJ. Phone: 07479 552287. Email: [CONFIRM]. You can also use our contact form.

11. Changes

We may update this notice from time to time. The "last updated" date at the top shows the current version.