COVID-19: The latest updates from Four Seasons Health Care - Click here

Privacy Policy

The Four Seasons Health Care Group (the Group) operates care homes throughout the UK and Jersey under the Four Seasons Health Care and brighterkind brands. To provide our care and services, we need to process (gather, use and store) personal data about the people we care for and their loved ones, people who work for and with us, and people who enquire about our care homes.  This privacy notice aims to provide information about the ways in which we use this data.  It begins with some general information that applies to all of our data processing and there are then sections specific to the type of data being processed.

  • Data Controller

    The Group is made up of a number of companies, which work together to provide various aspects of our care and services.  Each company is a data controller in its own right and is registered separately with the Information Commissioner’s Office (ICO - for our companies in the UK), the Jersey Office of the Information Commissioner (JOIC - for our companies on Jersey) and the Isle of Man Information Commissioner (IOMIC – for our companies on the Isle of Man).  The document attached below shows each of our companies and its ICO/JOIC/IOMIC registration number.

    Companies 

  • Data Protection Officer

    The Group has appointed a Data Protection Officer (DPO), who has responsibility for advising on and monitoring data protection compliance. You can contact the DPO at:

    Group Data Protection Officer
    Four Seasons Health Care Group
    Lingfield House
    Lingfield Point
    McMullen Road
    Darlington
    DL1 1RW
    Tel: +44 (0) 1325 346 564
    Email: dpo@fshcgroup.com

  • Exercising your rights

    Under data protection law, you have rights in relation to the way in which your personal data is processed.  These include:

    • the right of access
    • the right to rectification
    • right to complete data
    • the right to erasure
    • the right to restrict processing
    • the right to object to processing
    • the right to data portability

    You can find out more about your rights and the circumstances in which they may apply at:

    UK - https://ico.org.uk/your-data-matters/

    Jersey - https://jerseyoic.org/resource-room/information-rights/?audience=everything

    IOM - https://www.inforights.im/individuals/data-protection/your-data-protection-rights/

    If you wish to make a request to exercise your rights, you can speak to the Home Manager of the relevant care home, or contact the DPO at dpo@fshcgroup.com.  You can expect to receive an initial acknowledgement of your request, and then a substantive response within a month.  If you are making a request on behalf of a loved one residing in one of our homes, please be prepared to provide proof of your identity and a copy of your authority to make the request.

  • Making a complaint

    If you are unhappy with the way in which we have used your personal data, you have the right to make a complaint.  We would ask that you give us the opportunity to look into and respond to your concerns before you refer the matter to the regulator (and the regulator will often expect you to do this before they will agree to look into the matter).  If you wish to raise concerns, you can speak to the Home Manager of the relevant care home, or contact the DPO at dpo@fshcgroup.com.  We operate a complaints process with two stages. 

    The external regulator for data protection issues is the ICO in the UK, the JOIC on Jersey and the IOMIC on the Isle of Man.  Contact details are as follows:

    ICO
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF
    Tel: +44 (0) 303 123 1113
    Website: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/

    JOIC
    2nd Floor, 5 Castle Street
    St. Helier
    Jersey
    JE2 3BT
    Tel: +44 (0) 1534 716530
    Website: https://jerseyoic.org/make-a-complaint

    IOMIC
    PO Box 69
    Douglas
    Isle of Man
    Tel: +44 1642 693260
    Website: 
    https://www.inforights.im/complaint-handling/how-to-make-a-complaint-to-the-information-commissioner/

  • Automated processing

    When computers make decisions instead of people, it is known as automated processing.  Whilst we use computers to help us manage aspects of our services, we do not undertake automated processing; decisions will always be made by real people.

  • Data processors and international transfers

    To help us provide the best care possible we use a number of suppliers to help us with certain aspects of our business and, to do so, they may need to process a limited amount of your personal data.  Where this is the case, we take great care to select suppliers who can demonstrate to us that they have very good data protection and security practices, and we put in place a contract that very clearly sets out what they can and cannot do with the personal data.  We do not allow personal data to be processed outside of European Union unless the supplier is able to demonstrate to us that appropriate safeguards are in place to protect data. 

  • Research

    As a Group, we are keen to participate in research studies when we believe there is a potential benefit to you personally or to our resident population, or where there is a wider public interest.  Most of the time, we will only use anonymised data that does not identify you, however, there may be some cases where identifiable data needs to be shared. 

    You can choose whether to allow your information to be used for these purposes.  If you have objections to being contacted about research, you can opt out under the National Data Opt Out.  For more information about this, please visit www.nhs.uk/your-nhs-data-matters.  If you have no objections, you do not need to do anything and either we, or the researchers, will contact you if there is a study that we think you might be suitable to participate in.

    When we process personal data for research purposes, our lawful basis for processing under the UK GDPR is article 6(1)(a) ‘The data subject has given consent to the processing’ and article 9(2)(a) ‘The data subject has given explicit consent to the processing’.

  • Transfers/Sales of services

    To support continuity of care, it may be necessary from time to time for us to share necessary information about the people who live and work in our service(s) with a prospective operator of the service(s). If a sale/transfer does not proceed, at our request the parties will be required to destroy or to hand back to us any and all information that they may have received.  This sharing of personal data will be subject to robust non-disclosure agreements to ensure that it is protected during any transitional period.  Our lawful basis under the UK GDPR for processing in these circumstances is ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party’ and article 9(2)(b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law‘ or article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’.

Information for people living in our care homes

  • What information do we collect?

    Depending on your circumstances and the nature of the care and services you receive, we may collect the following categories of information about you:

    • your general details (name, address, date of birth, contact details)
    • details of your GP and any other professionals who are supporting you
    • your medical history (physical and mental) and any medications you are taking
    • information about your legal representatives (e.g. attorney/deputy), family and friends
    • your ethnicity and religious beliefs
    • your lifestyle, social circumstances, likes and dislikes
    • photographs of you (clinical and non-clinical)
    • CCTV images (if the home has CCTV in communal areas)
  • Where do we get information from?

    Much of the personal data we process comes directly from you, or from your loved ones.  In certain circumstances, we may also receive personal data from:

    • Other health and social care organisations, e.g. your social worker/care manager, GP, or a NHS trust that is funding your care or treating you
    • People who provide services on our behalf, e.g. chemists, chiropodists
  • What do we do with the information?

    Direct care – we process your information in order to provide you with the care and services that we agreed to provide when you chose to come and live with us.

    Indirect care – we also process your information to manage the care and services we provide more generally.  This includes:

    • Processing fees and personal allowances
    • Auditing our services (e.g. clinical quality audits)
    • Demonstrating to regulators and commissioners the quality of the care we provide
    • Looking into and responding to feedback, complaints and incidents
    • Developing existing services and planning new ones
    • Preparing statistics for local authorities, the Department of Health and Social Care and other regulatory bodies
    • Complying with our legal obligations, e.g. for safeguarding

    Other purposes – we also process a limited amount of personal data for other purposes, for example, promoting our homes.  Where this is the case, we will ask you whether you would like to be involved.  We will never sell your information to third parties for marketing purposes.

  • Lawful basis

    Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarised as:

    • Consent – where we ask you if you would like us to do something and you agree, for example, taking your photograph at an event
    • Contract – where we need to process the data to fulfil our contractual obligations to you, for example, providing you with person-centred care and services, and administering payments
    • Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, allowing a regulator to inspect our services
    • Vital interests – where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services

    We also rely on the following additional lawful basis for processing your special category data (e.g. data about your health):

    • Vital interests - where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services
    • Provision of health or social care – where we need to process your personal data to provide you with care and support, or to manage our services
    • Public health – where we need to process your personal data for public health reasons, for example, to track or prevent the spread of a pandemic
  • Disclosures

    In providing care and services, we may need to share your personal data in the following ways:

    • with internal support teams, for example, the Finance Team or Audit Team to support internal processes, e.g. billing or auditing;
    • with other health and care services to support the care you receive, e.g. your GP, the District Nursing Team;
    • with the organisations that fund your care (if relevant), e.g. the local authority or health trust/board;
    • with regulatory bodies, e.g. the relevant care regulator;
    • with bodies responsible for safeguarding, e.g. the local authority, police, Nursing and Midwifery Council.

    We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e. that we only share what is necessary when there is a legitimate and lawful requirement to do so.

  • Retention

    We will usually keep your information for six years after you leave the care home, after which it will be disposed of using our confidential waste supplier.

Information for people working for the Group

  • What information do we collect?

    Depending on your role, we may collect the following categories of information about you:

    • your general details (name, address, date of birth, contact details)
    • any information you provided to us when you applied for your role, including your qualifications and employment history
    • information about your right to work/suitability to work
    • your bank details
    • information about your next of kin
    • details about your physical and mental health
    • time and attendance records, and details of any leave or absences
    • supervision and performance information
    • equality monitoring information, such as your ethnicity and religious beliefs
    • photographs of you
    • CCTV images (if the site has CCTV in communal areas)
  • Where do we get information from?

    A lot of the personal data we process comes directly from you.  In certain circumstances, we may also receive personal data from:

    • Occupational health services and other medical professionals – this will always be with your knowledge and consent
    • Professional and regulatory bodies, e.g. the Nursing and Midwifery Council
    • Government bodies, for example, the Department for Work and Pensions (DWP)
  • What do we do with the information?

    Depending on the nature of your role and your personal circumstances, we may process your personal data in order to:

    • assess your suitability and right to work for us
    • to ensure that you are fulfilling the requirements of your role
    • to ensure you are receiving any support you may need to be successful in your role
    • to ensure that you are paid appropriately and that you receive any employment benefits that you may be entitled to
    • to meet our legal and contractual obligations, e.g. for taxation, COVID-19 vaccination status, making referrals to the Nursing and Midwifery Council
    • to demonstrate the care and support we prove to our residents
    • to promote our homes – you have the right to ask not be involved in promotional activity if you would prefer
  • Lawful basis

    Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarised as:

    • Consent – where we ask you if you would like us to do something and you agree, for example, taking your photograph at an event
    • Contract – where we need to process the data to fulfil our contractual obligations to you, for example, paying you
    • Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, administering taxation
    • Vital interests – where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services

    We also rely on the following additional lawful basis for processing your special category data (e.g. data about your health):

    • Employment, social security and social protection law – where we need to process your personal data to meet our legal obligations in relation to employment
    • Provision of health or social care – where we need to process your personal data to manage our services or for occupational health purposes
    • Public health – where we need to process your personal data for public health reasons, for example, to track or prevent the spread of a pandemic
  • Disclosures

    We may need to share your personal data in the following ways:

    • with internal support teams, for example, the Finance Team or Audit Team to support internal processes, e.g. payroll or auditing
    • with our occupational health provider – this will always be with your knowledge and consent
    • with other health and care services to support the care our residents receive, e.g. GPs, the District Nursing Team;
    • with the organisations that fund care, e.g. the local authority or health trust/board
    • with regulatory bodies, e.g. the relevant care regulator
    • with bodies responsible for safeguarding and registration, e.g. the local authority, police, Nursing and Midwifery Council
    • with Government bodies, e.g. the DWP

    We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e. that we only share what is necessary when there is a legitimate and lawful requirement to do so.

  • Retention

    We will keep your information for six years after termination of employment, after which it will be disposed of using our confidential waste supplier.

Information for residents’ loved ones

  • What information do we collect?

    Depending on your relationship with the home, we may collect the following categories of information about you:

    • your general details (name, address, date of birth, contact details)
    • your bank details – only if you are responsible for the payment of fees/personal allowances
    • the nature of your relationship with the resident (including whether you are the resident’s legal representative, e.g. attorney or deputy)
    • details of your interactions with the home, including any requests you make or concerns you may raise
    • CCTV images (if the site has CCTV in communal areas)
  • Where do we get information from?

    A lot of the personal data we process comes directly from you.  We may also receive information form the bodies responsible for funding care (if relevant), e.g. the local authority or local health trust/board.

  • What do we do with the information?

    Depending on the nature of your role and your personal circumstances, we may process your personal data in order to:

    • Keep you informed and include you in decision-making about your loved one
    • maintain accurate records of your loved one’s stay with us
  • Lawful basis

    Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarised as:

    Consent – where we ask you if you would like us to do something and you agree, for example, taking your photograph at an event

    Contract – where we process your personal data to administer fees or personal allowances as part of our contract with you and your loved one

    Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, for safeguarding

    Legitimate interests – i.e. to record details of your interactions with the home and your loved one in order to keep a complete and accurate record of your loved one’s stay in our home

  • Disclosures

    We may need to share your personal data in the following ways:

    • with internal support teams, for example, the Finance Team or Audit Team to support internal processes, e.g. collection of fees or auditing
    • with other health and care services to support the care our residents receive, e.g. GPs
    • with the organisations that fund care, e.g. the local authority or health trust/board
    • with regulatory bodies, e.g. the relevant care regulator
    • with bodies responsible for safeguarding, e.g. the local authority, police

    We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e. that we only share what is necessary when there is a legitimate and lawful requirement to do so.

  • Retention

    We will keep your information for six years after your loved one leaves the care home, after which it will be disposed of using our confidential waste supplier.

Information for enquirers

  • What information do we collect?

    When you submit an enquiry form, phone one of the numbers on our website or contact one of our homes directly, we will begin processing the personal data that you provide to us.  We will also process any personal data that you provide to us during follow-up contact. 

    If you, or your loved one, decide to come and live in one of our care homes, your personal data will be processed in accordance with our Resident Privacy Notice (see the section Information for people living in our care homes)

    If you enter the recruitment process, your personal data will be processed in accordance with our Team Member Privacy Notice (see the section Information for people working for the Group)

  • What do we do with the information?

    If you, or your loved one, are thinking about coming to live in one of our care homes, we will use the information you provide to put you in contact with a care home in the right area and will send you appropriate information to help you make a choice. 

    If you are enquiring about working for the Group, we will use the information to direct you to appropriate information about recruitment and, in some cases, to send you information vacancies.

    If you have given us permission to contact you by email, we may follow up the initial contact with further emails about living in our care homes or working for the Group.  This is known as direct marketing.  You can ask us to stop sending direct marketing materials at any time.

    We will also use the information you supply to generate statistics.  These statistics are used internally for management forecasting.  Your identity will not be included when statistics are reported.

  • Lawful basis

    Data protection law says that we must have a lawful basis for processing your personal data.  For enquiries, our lawful bases are:

    Consent – where we ask you if you would like us to do something and you agree, for example, sending you a brochure about a care home.  You can withdraw your consent at any time by unsubscribing directly on direct marketing emails or by contacting the Administrator at the care home involved.  If you withdraw your consent, your information will be removed from our marketing lists and you will receive no further communications from us. 

    Contract – to take steps at your request prior to entering into a contract

    Legitimate interests – where we use enquiry data to generate trends and statistics

  • Disclosures

    We will share your personal information with other companies within our group, and agencies with statutory powers, such as regulators and the police if required.

    Your information will also be shared with suppliers that process information on our behalf, such as our Customer Care Team.  We only share information with suppliers that have satisfied us that they will manage information properly.

    We use one supplier, MailChimp (The Rocket Science Group LLC), a company based in the United States which helps us manage our email communications with you.   MailChimp is EU-US Privacy Shield Framework certified, which means that it has been assessed as being compliant with data protection legislation.

  • Retention

    Your enquiry will stay live on our system until it is resolved because you have told us that you no longer wish to hear from us, you (or your relative) has moved into one of our homes or you have entered the recruitment process. 

    We will keep statistical information that does not identify you indefinitely.

Colour contrast Contrast
default
high
Font size Text size
down
default
up