Privacy Policy

Preston Bethany Care is a Christian charitable company which operates Bethany House Residential Care Home. As part of the services we offer, we are required to process personal data about our staff, service users, speakers and volunteers, supporters, suppliers of goods and services, website users and, in some instances, the friends or relatives of our service users and staff. ‘Processing’ can mean collecting, recording, organising, storing, sharing or destroying data.

Your privacy is important to us and this privacy notice describes how we collect and use personal information about you in accordance with the law, including the General Data Protection Regulations (GDPR) and Data Protection Act 2018. It also explains your rights regarding your data.

Service users

What data do we have?

So that we can provide a safe and high-quality service, we need to keep certain records about you. We may process the following types of personal data:

Your basic details and contact information, e.g. your name, address, date of birth, NHS number and next of kin
Your financial details, e.g. details of how you pay us for your care or your funding arrangements
Photographs and videos for your care records

We also record the following data which is classified as 'special category':

Health and social care data about you, which might include both your physical and mental health
We may also record data about your nationality, ethnic origin, sexual orientation or religion
Confidential visiting records may be kept by our pastoral team

Why do we have this data?

We process your data because:

It is a legitimate interest to respond to enquiries about the home
We have a legal obligation to do so – generally under the Health and Social Care Act 2012, the Mental Capacity Act 2005, the Social Security (Claims and Payments) Regulations 1979 or RIDDOR 2013
It is necessary for our contract with you to provide your accommodation and care. Without this information, we will be unable to accept you as a resident and manage the contract for your care.

We process your special category data because:

It is necessary due to social security and social protection law (e.g. in safeguarding instances)
It is necessary for us to provide and manage social care services
It enables our pastoral team to provide an effective and confidential service. This is part of our legitimate activities in connection with our charitable purposes.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent at any time.

How do we process your data?

So that we can provide you with high quality care and support we need specific data. This is collected from and/or shared with:

You or your legal representative(s)
Other parts of the health and care system such as the NHS, local hospitals, the GP, the pharmacy, social workers, clinical commissioning groups, and other health and care professionals
The Local Authority
Your family or friends – with your permission
Organisations we have a legal obligation to share information with e.g. the CQC, the HSE
Our insurers and legal representatives, if necessary for a claim or potential claim
The police or other law enforcement agencies, if we have to by law or court order
Our pastoral team does not share information unless you ask them to or if there is a safeguarding risk

We do this face to face and via phone, paper and digital communications.

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential patient information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/.

Staff

What data do we have?

So that we can recruit and manage staff in a lawful and professional way, we need to keep certain records about you. We may process the following types of personal data:

Your basic details and contact information, e.g. your name, address, date of birth, National Insurance number and next of kin
Your employment history, qualifications, references and application information
Facsimiles of your identification documents
Your financial details (e.g. for wage payments), National Insurance, pension and tax details
Your training and employment records

We also record the following data which is classified as 'special category:

Health and social care data about you, which might include both your physical and mental health data – we will only collect this if it is necessary for us to know as your employer, e.g. fit notes, details in order for you to be paid statutory maternity/paternity pay, COVID-19 vaccination status, COVID-19 test data
We may also, with your permission, record data about your race, ethnic origin, sexual orientation or religion

As part of your application, depending on your job role, you may be required to apply for a criminal records check.

Preston Bethany Care reserves the right to monitor use of its telecommunications network (including without limitation your telephone, email and internet use) to such extent as we consider necessary, including reading all of your email traffic if we consider it reasonably necessary to do so and always in accordance with applicable law.

Why do we have this data?

We require this data so that we can contact you, pay you and make sure you receive the training and support you need to perform your job. We process your data because:

We have a legal obligation under UK employment law
We have a legal obligation to do so e.g. under The Health and Social Care Act 2012, The Social Security (Claims and Payments) Regulations 1979 or RIDDOR 2013
It is necessary for your contract of employment. Without this information, we may, for example, be unable to pay you.
We have a legitimate interest in processing your data – for example, we provide data about your training to Skills for Care’s National Minimum Data Set (this allows Skills for Care to produce reports about workforce planning); in the event of an employment dispute.

We process your special category data because:

It is necessary for us to process requests for sick pay or maternity pay
It is a legitimate interest as a social care provider to handle COVID-19 test data and vaccination status to enable us to provide a safe service.

If we request your criminal records data it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. We do not keep disclosure information for any longer than is necessary in order to allow for the consideration and resolution of any disputes or complaints, and where required by a government regulator. Criminal record certificate information is stored securely and separately from your other records, with access restricted to those legally entitled to see it.

How do we process your data?

As your employer we need specific data. This is collected from and/or shared with:

You or your legal representative(s)
Your previous or prospective employers
Her Majesty’s Revenue and Customs (HMRC)
Our NEST pension scheme provider
Our external payroll provider
The DBS Service and the uCheck online application service
Organisations we have a legal obligation to share information with, e.g. the CQC, the HSE, the NHS
Our insurers and legal representatives, if necessary for a claim or potential claim
The police or other law enforcement agencies if we have to by law or court order

We do this face to face and via phone, paper and digital communications.

Relatives/friends of service users or staff

What data do we have?

As part of our work providing high-quality care and support, it might be necessary that we hold the following information on you:

Your basic details and contact information, e.g. your name and address, telephone number, email address

We also record the following data which is classified as 'special category:

Health and social care data such as COVID-19 test data

Why do we have this data?

We process your personal data because

It is a legitimate interest to respond to enquiries about the home
We have a legitimate interest in holding next of kin and lasting power of attorney information about the individuals who use our service and keeping emergency contact details for our staff
Under The Social Security (Claims and Payments) Regulations 1979 and RIDDOR 2013, we have a legal obligation to process details of accidents that may occur on our premises

We process your special category data because:

It is a legitimate interest as a social care provider to handle COVID-19 test data to enable us to provide a safe service.

How do we process your data?

This is collected from and/or shared with:

You or your legal representative(s)
The service user or staff member with whom you are associated
Other parts of the health and care system such as local hospitals, the GP, the pharmacy, social workers, and other health and care professionals
The Local Authority
Organisations we have a legal obligation to share information with, e.g. the HSE
Our insurers and legal representatives, if necessary for a claim or potential claim
The police or other law enforcement agencies if we have to by law or court order

We do this face to face and via phone, paper and digital communications.

Speakers, volunteers and supporters

What data do we have?

As part of enabling you to participate in the life of Bethany House, it might be necessary that we hold the following information on you:

Your basic details and contact information, e.g. your name and address, telephone number, email address

We also record the following data which is classified as 'special category:

Health data about you, such as COVID-19 vaccination status and COVID-19 test data. We will only collect this if it is necessary for us to know in relation to your role.

Before beginning volunteer work with us, depending on the role, you may be required to apply for a criminal record check.

Why do we have this data?

We process your personal data because:

We have a legitimate interest in contacting you about your volunteer role and to publicise our meetings and activities
Under The Social Security (Claims and Payments) Regulations 1979 and RIDDOR 2013, we have a legal obligation to process details of accidents that may occur on our premises

We process your special category data because:

It is a legitimate interest as a social care provider to handle COVID-19 test data and vaccination status to enable us to provide a safe service.

If we request your criminal records data it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. We keep information required by the CQC for the duration of your role at Bethany House, but retain only a record of the certificate number once your role ceases. Criminal record certificate information is stored securely and separately from your other information, with access restricted to those legally entitled to see it.

How do we process your data?

This is collected from and/or shared with:

You or your legal representative(s)
Other volunteers/speakers, if you consent to this
Service users (the names of speakers and activity leaders may appear in event programmes)
The Local Authority
Organisations we have a legal obligation to share information with, e.g. the HSE, the NHS
Our insurers and legal representatives, if necessary for a claim or potential claim
The police or other law enforcement agencies if we have to by law or court order

We do this face to face and via phone, paper and digital communications.

Suppliers of goods and services

What data do we have?

So that we can procure goods and services, we need to keep certain records about you. We may process the following types of personal data:

Your basic details and contact information, e.g. your name, address, telephone number, email address
Your financial information, e.g. bank details to make payments

We also record the following data which is classified as 'special category:

Health data about you, such as COVID-19 vaccination status and COVID-19 test data. We will only collect this if it is necessary for us to know in relation to your role.

Why do we have this data?

We process your data because:

It is necessary to enter into a contract with you to provide goods and/or services to us. Without this information, we may be unable to perform the contract with you, e.g. making payments.
We need to contact healthcare professionals (e.g. GP, dentist, social worker) as part of fulfilling our legal obligations associated with providing care
We may need to comply with legal obligations, e.g. inspection by regulators; to prevent fraud
Under The Social Security (Claims and Payments) Regulations 1979 and RIDDOR 2013, we have a legal obligation to process details of accidents that may occur on our premises

We process your special category data because:

It is a legitimate interest as a social care provider to handle COVID-19 test data and vaccination status to enable us to provide a safe service.

How do we process your data?

This is collected from and/or shared with:

You or your legal representative(s)
Third parties, e.g. trade references as part of the process of becoming a supplier, banks to make payments, our auditors
The Local Authority
Service users and prospective service users or their representatives
Organisations we have a legal obligation to share information with, e.g. the CQC, the HSE, the NHS
Our insurers and legal representatives, if necessary for a claim or potential claim
The police or other law enforcement agencies, if we have to by law or court order

We do this face to face and via phone, paper and digital communications.

Website users

What data do we have?

While using our website, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. This may include, but is not limited to:

Your basic details and contact information, e.g. your name, email address and telephone number

Cookies and usage data

Usage Data

We may collect information about how the service is accessed and used. This usage data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Tracking and Cookies Data

We use cookies and similar tracking technologies to track the activity on our service and hold certain information. Cookies are files with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags and scripts to collect and track information, and to improve and analyse our service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service. Examples of cookies we use are:

Session cookies. We use temporary session cookies to operate our service.
Preference cookies. We use preference cookies to remember your preferences and various settings.
Security cookies. We use security cookies for security purposes.

Why do we have this data?

We use your data to provide and improve the service. By using the service, you consent to the collection and use of information in accordance with this notice. Preston Bethany Care uses the collected data for various purposes:

To provide and maintain the service
To provide customer care and support and respond to enquiries
To provide analysis or information so that we can improve the service
To monitor the usage of the service
To detect, prevent and address technical issues

How do we process your data?

Transfer of Data

Your information, including personal data, may be transferred to and maintained on computers located outside of your state, province, country or other governmental jurisdiction, where the data protection laws may differ than those from your jurisdiction. Your consent to this privacy notice followed by your submission of such information represents your agreement to that transfer.

Preston Bethany Care will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy notice and no transfer of your personal data will take place to an organisation or a country unless there are adequate controls in place relating to the security of your data.

Disclosure Of Data

Preston Bethany Care may disclose your personal data in the good faith belief that such action is necessary:

to comply with a legal obligation
to protect and defend the rights or property of Preston Bethany Care
to prevent or investigate possible wrongdoing in connection with the service
to protect the personal safety of users of the service or the public
to protect against legal liability

Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

Service Providers

We may employ third party companies and individuals to facilitate our service, to provide the service on our behalf, to perform website-related services or to assist us in analysing how our service is used. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

We use YouTube to embed videos. Cookies are used by this service to track levels of usage. To opt out of having cookies set by YouTube, please see the relevant cookie and privacy policies on their website.

We use Google Analytics to track website traffic. This data is shared by Google with its other services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. You can opt-out of having made your activity on the service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google privacy and terms webpage.

Links to Other Sites

Our website may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Children's Privacy

Our website service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

CCTV

CCTV equipment is installed outside Bethany House. Images are recorded for public safety, for the prevention and detection of crime, and to provide evidence in the event that a crime takes place. We have a legitimate interest in doing so to protect the premises and authorised users of Bethany House.

The CCTV system is only accessible to trained and authorised staff. Images may only be shared with a limited number of authorised organisations, such as the police, our regulators or our insurers. This is strictly controlled by our data protection policy and procedures to ensure lawful handling of data and the minimisation of privacy intrusion.

Your rights regarding your data

It is important that the personal information we hold about you is accurate and current. Please inform us if your personal information changes (e.g. address, contact details).

You have the following rights with regard to your data.

You have the right to be informed about the collection and use of your data.
You have the right to request access to a copy of all the data we keep about you. Generally, we will not charge for this service.
You have the right to ask us to correct any data we have which you believe to be inaccurate or incomplete. You can also request that we restrict all processing of your data while we consider your rectification request.
You can ask for your data to be erased if we have asked for your consent to process your data. You can withdraw consent at any time – please contact us to do so. You also have the right to ask that we erase any of your personal data which is no longer necessary for the purpose we originally collected it for.
You may also request that we restrict processing if we no longer require your personal data for the purpose we originally collected it for, but you do not wish for it to be erased.
If we are processing your data as part of our legitimate interests as an organisation or in order to complete a task in the public interest, you have the right to object to that processing. We will restrict all processing of this data while we look into your objection.
If we are processing your data by automated means (i.e. not paper files) on the basis of consent or in the performance of a contract, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format, where this is technically feasible.

If you have a concern about the way we are collecting or using your personal information, please contact us using the details below. We will always respond to your request as soon as possible and, at the latest, within one month. You may need to provide adequate information for our staff to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately.

You can also contact the Information Commissioner’s Office at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or at ico.org.uk.

Storing your data

We will keep your data secure in accordance with our data protection policy and procedures. Data will not be transferred outside the UK, unless adequate controls are in place relating to the security of your data.

We will only retain your personal information for as long as necessary to fulfil the purposes for which we have collected it. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. When we no longer have a lawful purpose for holding your data, we will securely destroy your personal information in accordance with our data protection policy and procedures.

Preston Bethany Care reserves the right to lawfully transfer such information as is required to obtain legal advice and to protect the rights, property or safety of Preston Bethany Care, its employees, service users and others. Preston Bethany Care may transfer its business assets (which include information) on re-organisation, sale or merger of the whole or any part of its business.

Review of this Privacy Notice

We regularly review and, when necessary, update our privacy information. The last update to this privacy notice was on 16 June 2022.

Contact

If you would like further information regarding this privacy notice please contact the manager by email at admin@bethanyhouse.org.uk or by mail at Bethany House, Gamull Lane Ribbleton, Preston, PR2 6TQ.

Bethany House is operated by Preston Bethany Care, which is a registered company, number 7394756 (England & Wales), and a registered charity, number 1140242.