Privacy notice for the WeCare2 platform.

Wecare2 Home Services Ltd (“we”, “us”, “our”) is a domiciliary care provider regulated by the Care Quality Commission (CQC). We are committed to protecting the privacy and security of your personal information.

• Company name: Wecare2 Home Services Ltd
• Company number: 17090869 (registered in England and Wales)
• Registered office: 48 Dartmouth St, Walney, LA14 3AS
• Website: wecare2homecare.co.uk

We are the controller of the personal information described in this notice, meaning we decide how and why it is used.

If you have any questions about this notice or how we handle personal information, please contact us at:

• Email: admin@wecare2.co.uk
• Post: 48 Dartmouth St, Walney, LA14 3AS
• Phone: 01229 846646

This notice applies to visitors to our website, people who submit an enquiry or application through our website, our clients and their families or representatives, and our staff and prospective staff, where relevant to the sections below.

Our website includes an application or register interest form. When you complete this form, we collect the information you provide, which typically includes your name, email address, and contact details.

This information is sent directly to our email inbox and is used to respond to your enquiry, discuss your care needs, and, where relevant, progress your application.

Legal basis: we rely on our legitimate interests in responding to enquiries and providing information about our services (Article 6(1)(f) UK GDPR), and, where an enquiry proceeds to arranging care, on taking steps at your request before entering into a contract (Article 6(1)(b) UK GDPR).

When you become a client, or when we assess whether we can meet your care needs, we collect information necessary to plan and deliver safe, appropriate care. This includes:

• Name, date of birth, and contact details
• Emergency contact and next of kin details
• Health information, medical history, and medication details
• Care needs, risk assessments, and daily care notes
• Information relevant to your care such as mobility, dietary needs, and, where applicable, religion or cultural preferences

Some of this information is special category data under the UK GDPR, meaning it needs extra protection. We collect and use it because it is necessary for the provision of health and social care (Article 9(2)(h) UK GDPR), and because it is necessary to protect your vital interests where relevant (Article 9(2)(c) UK GDPR). Our general legal basis for processing client information is that it is necessary for the performance of a contract with you (Article 6(1)(b) UK GDPR) and to comply with our legal and regulatory obligations as a CQC registered provider (Article 6(1)(c) UK GDPR).

Client care records are held on Nursebuddy, our care management software. Nursebuddy’s servers are located in Ireland and Germany, within the European Economic Area, and the platform holds Cyber Essentials Plus certification and meets the NHS Data Security and Protection Toolkit standard.

Care staff involved in your care can access your information on Nursebuddy so they have what they need to deliver your care safely.

Some documents are held in paper form in a locked filing cabinet at our premises, accessible only to authorised staff.

For prospective and current staff, we collect information necessary for recruitment, employment, and compliance with our regulatory obligations, including identity, contact, right to work, qualification, and Disclosure and Barring Service (DBS) check information.

Legal basis: performance of a contract of employment (Article 6(1)(b) UK GDPR), compliance with our legal obligations as a regulated care provider (Article 6(1)(c) UK GDPR), and, for criminal offence and DBS information, our obligations and rights in the field of employment law (Article 9(2)(b) and Schedule 1 of the Data Protection Act 2018).

We may share personal information with the following types of organisations, only where necessary:

• The Care Quality Commission, for regulatory purposes
• Local authorities and NHS or GP contacts involved in a client’s care
• Our accountant or payroll provider, for staff pay and financial administration
• Our DBS check provider, for staff vetting
• Nursebuddy, as our care management software provider, acting as our data processor
• Our insurers, professional advisers, or regulators, where required by law or to protect our legitimate interests

We do not sell personal information to third parties.

Nursebuddy hosts data within the European Economic Area, so this does not involve a transfer of personal information outside the UK or EEA. If we ever use a service provider based outside the UK or EEA, we will ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision, before any transfer takes place.

We keep client care records for a minimum of 8 years after our last contact with you, in line with NHS records management guidance and CQC expectations. This allows us to demonstrate the standard of care provided and to respond to any queries or complaints that may arise after care has ended.

Staff records are kept for as long as required by employment and tax law, and website enquiry information is kept only for as long as needed to respond to your enquiry, unless it proceeds to a care arrangement.

From time to time, we may wish to use photographs of clients or staff, for example for a carer of the month feature or in our advertising and promotional materials.

We will always obtain your specific written consent before using your photograph or personal story in this way, using a consent form. You can withdraw your consent at any time by contacting us using the details in section 2, and we will stop using your photograph in any new materials from that point onwards.

Legal basis: consent (Article 6(1)(a) UK GDPR, and Article 9(2)(a) UK GDPR where an image reveals health related information).

We take appropriate technical and organisational measures to protect personal information, including access controls on Nursebuddy restricted to authorised carers, secure locked storage for paper records, and staff training on data protection and confidentiality.

Under UK data protection law, you have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information in certain circumstances
• Ask us to restrict how we use your information
• Object to certain processing, including for marketing
• Request that we transfer your information to another organisation, in certain circumstances
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, please contact us using the details in section 2. We will respond within one month, in line with our legal obligations.

If you are unhappy with how we have handled your personal information, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this notice from time to time. Any changes will be published on our website, with the date of the most recent update shown at the top of this notice.