Privacy and cookie policy

It applies to all companies within the Exemplar Health Care group. You can request details of these companies by contacting the Company Secretary of Exemplar Health Care using the address provided at the end of this notice.

Exemplar Health Care creates records through our contact with you.

These records may contain personal data that is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

‘Personal data’ is information that can be used to identify a person.

This may include your:

• name
• address
• telephone number
• email address
• date of birth
• health information.

Some personal data is classed as ‘special category data’ under the UK GDPR and requires additional protection. This includes certain information about your health, political opinions, religious or philosophical beliefs, and sexual orientation.

Separate rules apply to personal data relating to criminal convictions and offences, known as ‘criminal offence data’.

We will tell you when we collect personal data, including special category data or criminal offence data, what we will use it for, and who we will share it with.

We collect personal information in a variety of ways, including through:

• our website – see ‘Information we collect via our website’ and ‘Cookies’ below
• forms
• service agreements and contracts
• our ongoing contact with you
• CCTV images, in some cases
• recorded telephone calls, in some cases.

When you apply to become an Exemplar Health Care employee, we request and keep any references needed to assess your application, along with any information you provide.

When we receive a request regarding a potential service user, we request and keep any information needed to assess that request. Where appropriate, this may include information from other service providers, the Police, the NHS, support workers, social workers, and mental health workers.

If a service user or funder provides us with personal information about members of a service user’s family or their associates, we will assume that they do so with their knowledge and consent to the collection and processing of that information.

Where a service user does not have capacity, information provided by family members or associates will be treated in the same way as if it had been provided by the service user.

It is important that you notify us of any changes to your personal information.

We collect personal information about the following people.

Service users

This includes current, former, and potential service users who live in our properties or access our support and other services. It may also include their family members and people associated with them.

Colleagues

This includes current, former, and potential colleagues, as well as Board and Committee Members, apprentices, and volunteers.

Other people

This also includes anyone who makes a complaint or enquiry, and visitors to our website, care homes, and offices.

Job applicants, and current and former employees

When you apply to become an Exemplar Health Care employee, we request and keep information needed to process and consider your application.

This includes references, personal contact details, previous employment details, criminal convictions, and any other information you provide.

Personal information about unsuccessful candidates will be held for six months after the recruitment exercise has been completed. It will then be destroyed.

We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from this data.

Once a person starts working for Exemplar Health Care, we will compile a file relating to their employment.

The information in this file will be kept secure and will only be used for purposes directly relevant to that person’s employment.

Once their employment with Exemplar Health Care has ended, we will retain the file in line with our retention schedule and then destroy it.

Your employment file will include the following information:

• personal contact details, such as your name, title, address, telephone numbers, personal email addresses, and emergency contact details
• date of birth
• gender
• marital status and dependants
• referee details, next of kin, beneficiaries, family members, and emergency contacts
• National Insurance number and other tax or governmental identifiers
• bank account, payroll, and tax status
• salary, insurance, annual leave, pension, benefit entitlement, and expenses
• start date and leaving date
• location of employment or workplace
• attendance history
• driving licence details, including copies where we are required to hold them for identification or insurance purposes when you use our vehicles, and vehicle details
• identification documents
• recruitment information, including copies of right-to-work documentation, DBS referrals and checks, past employment history, references, and other information included in your application
• employment records and notes, including job titles, work history, working hours, training records, professional membership, maternity, paternity, and compassionate leave, details of any home-working assessments for health and safety purposes, and education and professional records or qualifications
• performance information, including information generated through our appraisal systems
• disciplinary and grievance information
• movements captured through CCTV footage, and other information obtained electronically, such as through our electronic signing-in app.

Service users

We hold the following information about our service users:

• your name
• your date of birth
• what we do to care for you
• your medical history, including information from other service providers, the Police, the NHS, support workers, social workers, and mental health workers
• information about your next of kin, family members, and associates, where provided by you or the funder of your care
• information about your care funding.

We collect, process, share, and securely store personal information in accordance with the UK GDPR, the Data Protection Act 2018, and other applicable data protection legislation.

All information will be retained in accordance with our ‘Records Management Policy’.

We keep these records to allow us to:

• allocate accommodation
• manage our provision of care
• process payment and service charges
• offer help with debts and benefits
• provide support services that help service users achieve their goals
• prevent and detect crime, and resolve disputes
• promote safety and the quiet enjoyment of our facilities
• engage with service users, and make improvements to the care we provide
• promote equal opportunities and fair treatment for all colleagues and service users
• provide employment and training advice and opportunities
• manage employment and colleague development
• work with partners to deliver mutual success
• provide information services you request from us.

Under the UK GDPR, certain types of personal data are classed as “sensitive” and require additional protection.

Sensitive data is information relating to physical or mental health, sex life, religious or philosophical beliefs, political opinions, membership of a Trade Union, allegations of criminal offences and criminal convictions and offences.

We minimise our collection and use of special category data and criminal offence data. However, given the services we provide, there are times when we need to use this information.

For example, this may be when providing accommodation for disabled people or people with problems around substance abuse, or when helping someone access care services.

We minimise our holding and use of sensitive categories of personal information but, given the services we provide, there are times when we use it, for example when providing accommodation for disabled persons or those with problems around substance abuse, or when helping someone to access care services.

When we collect specific sensitive data, we will tell you how we will use it, including who it may be shared with.

We aim to meet the highest standards across all areas of our business.

We take any complaints we receive very seriously and welcome suggestions for improving our procedures.

If you make a complaint or enquiry, we may collect and store personal information relating to the matter. We will keep this information secure and use it only for the purpose for which it was collected.

When the matter is resolved or completed, we will retain the details in line with our retention schedule and then destroy them.

We collect and store personal information through our website for a number of reasons, including to help us provide better services and products to existing and potential service users.

The information we collect alls into two categories:

1. personal information entered into online forms by visitors to this website
2. anonymous statistical information collected by cookies.

If you request a brochure, callback, or other information from us by email or online form, or register your interest in a service, we will use your information to fulfil that request.

We may also ask whether you would like to receive regular marketing emails. You can choose to opt out at this point, and you will have the opportunity to opt out every time we contact you.

Exemplar Health Care is committed to preserving the privacy of all visitors to www.exemplarhc.com.

All personal data is collected and processed in accordance with the UK GDPR, the Data Protection Act 2018, and other applicable data protection legislation.

Data submitted through online forms will be incorporated into the Exemplar Health Care database and used for future marketing purposes. It will not be passed to any third party.

How we use cookies

The Exemplar Health Care website uses cookies to improve its functionality and monitor site performance.

To find out more about cookies, including how to see which cookies have been set and how to manage and delete them, visit www.allaboutcookies.org

To opt out of being tracked by Google Analytics across all websites, visit tools.google.com/dlpage/gaoptout

Some of our properties have CCTV in public areas.

We use CCTV to deter crime and anti-social behaviour, and to promote public safety by helping to identify and prosecute criminal offenders.

You can ask for a copy of any CCTV images taken of you by making a subject access request. See ‘Accessing your information’ below.

Your personal information will be kept secure and confidential.

We will not usually disclose personal data without consent. However, we may share information with third parties and other agencies we work with, including local authorities, social services, and the NHS.

We may do this when Exemplar Health Care believes it is in your or the public’s interest, or where required by law.

We may ask for your consent to store or process your personal information for specific purposes.

Where we rely on consent as our lawful basis for processing your personal data, this will be on an opt-in basis. Consent will not be assumed by default.

We may also process personal data where another lawful basis applies, including where processing is necessary for our legitimate interests.

Please contact us if you would like copies of specific information from your files. We will provide this as quickly as possible.

If you require a substantial amount of your personal information, there is a formal process under data protection legislation known as a Subject Access Request (SAR).

You can write to us or email us with your request.

For convenience, you can also download the subject access request form. Click the download icon at the bottom of the document, then post or email the completed form back to us.

You can contact us using the details below:

• Post: Legal Director, Exemplar Health Care, Exemplar Health Care Support Centre, 17 Europa View, Tinsley, Sheffield, South Yorkshire, S9 1XH
• Email: infosec@exemplarhc.com
• Telephone: 01709 565795

We may require proof of your identity and address. We will let you know if this is needed when we receive your request.

More information is available on the subject access request form linked above.

There is no charge for processing a normal subject access request under the UK GDPR and the Data Protection Act 2018.

However, data protection legislation allows Data Controllers to make a charge where a request involves disproportionate effort to recover and provide the information required.

When we receive your valid request, along with proof of identity and address if required, we will respond and provide your information within one calendar month at the latest.

You can request to see any information we may hold about you, including CCTV images. The more specific you can be about what you require, the quicker we can respond.

If you are requesting CCTV footage of yourself, please provide the time, date, and location of the footage, along with a clear photograph so we can identify you in the footage.

Please be aware that we may need to edit some information out if it relates to other people, as we must protect the privacy rights of all individuals.

If you have any questions about accessing your information, please email infosec@exemplarhc.com or call 01709 565795.

For further information about how we maintain the security of your information, please contact us to see our ‘Data Protection and Information Governance Policy’.

We will update this privacy notice to reflect changes to the way we operate or changes to the UK GDPR, the Data Protection Act 2018, or other applicable data protection legislation.

We recommend revisiting this notice from time to time to make sure you remain up to date.

This notice applies to this website only.

If you follow a link to an external website, we recommend checking that site’s privacy notice before providing any personal details.