Introduction
Lilian Faithfull Care (the “Charity”) is fully committed to being transparent about how it collects, uses, and safeguards the personal data of our residents, and to meeting its data protection obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to the personal data of current and former residents. Where the term “Individual” or “Resident” is used, it encompasses the resident themselves, as well as any legally appointed representatives acting on their behalf.
Powers of Attorney (PoA)
Where a resident has appointed a Power of Attorney, or where a court-appointed Deputy is in place, the Charity will verify the type of permissions granted (e.g. Health and Welfare, Property and Financial Affairs) and ensure the document is duly signed and registered with the Office of the Public Guardian (OPG) before sharing confidential records.
Data Protection Principles
We process all resident-related personal data in accordance with the core principles of the UK GDPR. Data will be:
- Processed lawfully, fairly, and in a transparent manner.
- Collected only for specified, explicit, and legitimate purposes.
- Adequate, relevant, and limited to what is necessary for your care.
- Kept accurate and updated promptly when you inform us of changes.
- Retained only for as long as necessary to fulfil care, legal, and regulatory obligations.
- Protected with robust technical and physical security measures against unauthorised access, loss, or damage.
The Information We Collect
To provide safe, comprehensive residential and nursing care, we must collect and process personal data and “Special Category” (sensitive) data. This includes:
- Identity and Contact Data: Name, date of birth, gender, marital status, National Insurance number, and contact details for you and your next of kin.
- Financial Data: Bank account details, funding arrangements (local authority, NHS, or self-funded), and invoicing history.
- Health and Care Data (Special Category): Detailed medical records, care plans, medication histories, dietary requirements, psychological profiles, and nursing notes.
- Visual Data: Photographs used for identification within care plans, eMAR (electronic medication) systems, or authorised marketing (where explicit consent is granted).
How We Collect It
Information is gathered directly from you and your family during the enquiry and admission process, as well as continuously during your time with us. We also receive vital health data from third-party professionals, including GPs, district nurses, social workers, hospitals, and local authorities.
How We Use Your Personal Information
We will only process your data when the law allows us to. Most commonly, we rely on the following legal grounds:
- Performance of a Contract: To fulfil our residency and care agreement with you.
- Legal Obligation: To comply with health and safety laws, statutory care records legislation, and Care Quality Commission (CQC) regulations.
- Vital Interests: To protect your life in an emergency healthcare crisis where you or your representatives are unable to give consent.
- Legitimate Interests: For the efficient and safe administration of the Charity, provided these do not override your fundamental rights.
Processing Sensitive Health Data
Because health data is classified as Special Category data, we process it under strict statutory exemptions, primarily where it is necessary for the provision of health or social care treatment and management, or where we have obtained your explicit consent.
Storage and Security
Your data is stored securely in both physical and digital formats.
- Digital Records: Held on password-protected electronic care planning and financial systems with strict access controls.
- Physical Files: Secured in lockable filing cabinets within restricted care offices accessible only by authorised staff in the proper performance of their duties.
We maintain a comprehensive internal Record of Processing Activities (ROPA) as required by law. We will never hold your data for longer than is necessary by statute or social care regulatory frameworks.
Disclosure and Third-Party Sharing
We do not sell your data or share it with unauthorised third parties. However, to provide effective care and meet our legal duties, we securely share relevant information with:
- Healthcare and medical professionals (GPs, NHS trusts, district nurses, therapists).
- Social workers, county councils, and funding bodies.
- Our regulator, the Care Quality Commission (CQC).
- Your designated next of kin or Power of Attorney (in line with your documented preferences and legal permissions).
- Professional advisers and trusted third-party IT processors acting under strict written confidentiality contracts.
Data Minimisation
When communicating your information, we practice strict data minimisation. We only share the specific parts of your record that a professional needs to know to perform their duty safely. We do not transfer personal data outside the United Kingdom unless explicit safeguards approved by the ICO are in place.
Your Rights
- Request access to your data (Subject Access Request).
- Request rectification of inaccurate or incomplete data.
- Request erasure of your data (subject to our legal obligations to maintain medical and care records).
- Restrict or object to our processing of your data under legitimate interests.
- Lodge a complaint with the Information Commissioner’s Office (ICO).
Making a Subject Access Request (DSAR)
If you or your authorised legal representative wish to request a copy of the personal data we hold about you, please write to your Home Manager or contact our Data Protection Officer.
- Verification: We will take reasonable, proportionate steps to verify your identity or your representative’s legal authority before releasing any records.
- Cost and Timeline: This service is free of charge. We will respond within one calendar month. For highly complex or large requests, we may extend this timeline by up to two further months, but we will write to you within the first month to explain why.
- Third-Party Redactions: If your files contain personal information regarding other individuals (such as family members or staff), that data will be redacted to protect their privacy rights.
How to Make a Data Protection Complaint
Email: paul.kennedy@lilianfaithfull.co.uk
Post: Faithfull House, Suffolk Square, Cheltenham GL50 2DT, Attn: Data Protection Officer
Once we receive your complaint, we will:
- Acknowledge receipt within 30 days.
- Investigate your concerns and keep you updated.
- Communicate the outcome and actions taken.
Escalation to the Information Commissioner’s Office (ICO): www.ico.org.uk | 0303 123 1113
Marketing and Opting Out
Email: mailbox@lilianfaithfull.co.uk
Post: Lilian Faithfull Care, Head Office, Suffolk Square, Cheltenham, GL50 2DT
Website Cookies
Our website uses cookies to optimise your browsing experience, track visitor patterns, and build up high-level demographic profiles. You can disable cookies in your browser settings. More info: www.allaboutcookies.org
Contact and Changes
DPO: Paul Kennedy
Email: paul.kennedy@lilianfaithfull.co.uk
Address: Lilian Faithfull Care, Faithfull House, Suffolk Square, Cheltenham, GL50 2DT